From 45abe5b87b1544b6b46d795e8d27a82fc56be19e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 14:55:05 +0000
Subject: [PATCH 1/2] Bump the nuget-deps group with 1 update (#389)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Updated [Serilog](https://github.com/serilog/serilog) from 4.3.1 to
4.4.0.
Release notes
_Sourced from [Serilog's
releases](https://github.com/serilog/serilog/releases)._
## 4.4.0
## What's Changed
* Emit SelfLog warning when extra arguments are provided by @matantsach
in https://github.com/serilog/serilog/pull/2222
* dont WriteQuotedJsonString for null by @SimonCropp in
https://github.com/serilog/serilog/pull/2216
* Pin System.Security.Cryptography.Xml to 8.0.3 in tests by @ArieGato
in https://github.com/serilog/serilog/pull/2232
* Route optional interfaces through OptionalInterfaceForwardingSink for
restricted sinks by @ArieGato in
https://github.com/serilog/serilog/pull/2234
* `SelfMetrics` by @nblumhardt in
https://github.com/serilog/serilog/pull/2237
## New Contributors
* @matantsach made their first contribution in
https://github.com/serilog/serilog/pull/2222
* @ArieGato made their first contribution in
https://github.com/serilog/serilog/pull/2232
**Full Changelog**:
https://github.com/serilog/serilog/compare/v4.3.1...v4.4.0
Commits viewable in [compare
view](https://github.com/serilog/serilog/compare/v4.3.1...v4.4.0).
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore ` will
remove the ignore condition of the specified dependency and ignore
conditions
Signed-off-by: dependabot[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
Directory.Packages.props | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 330a748..5617c40 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -5,7 +5,7 @@
-
+
From 1568ac190562ef2da21062b717830b2c723c2003 Mon Sep 17 00:00:00 2001
From: Pieter Viljoen
Date: Fri, 10 Jul 2026 08:40:03 -0700
Subject: [PATCH 2/2] publish-release: gate auto-publish to bot merges on main
only (release-model) (#388)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Part of the fleet release-model change: **a human PR merge never
auto-cuts a release; only a bot (Dependabot/codegen) code-merge to
`main` does, plus manual dispatch.**
- **`push` trigger narrowed to `[main]`** — bot merges to `develop` no
longer release; `develop` prereleases come via `workflow_dispatch`.
- **Publish gated** to `github.actor == 'ptr727-codegen[bot]'` (the App
merges every bot PR) / `dependabot[bot]`, so a human merge/promotion to
`main` skips — the maintainer dispatches when release-ready. The
`paths:` filter still means an Actions-only bump publishes nothing.
- Empirically validated actor values on real runs (bot merges → App
identity; human merges → `ptr727`).
Header/comment updated to match. Takes effect on `main` once promoted.
Companion to LanguageTags #255; template docs (WORKFLOW.md/AGENTS.md) +
`PUBLISH_ON_MERGE` deletion follow.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context)
---
.github/workflows/publish-plan-task.yml | 84 +++++++++++++++++++++++++
.github/workflows/publish-release.yml | 52 ++++++++-------
.github/workflows/test-pull-request.yml | 1 -
3 files changed, 114 insertions(+), 23 deletions(-)
create mode 100644 .github/workflows/publish-plan-task.yml
diff --git a/.github/workflows/publish-plan-task.yml b/.github/workflows/publish-plan-task.yml
new file mode 100644
index 0000000..ab7dbbb
--- /dev/null
+++ b/.github/workflows/publish-plan-task.yml
@@ -0,0 +1,84 @@
+name: Publish plan task
+
+# Single source of truth for the release-gate decision, reused by every publish-release.yml job so the policy
+# lives here, not scattered across job `if:` conditions. A human PR merge never auto-publishes; a release is a
+# deliberate dispatch, a bot (Dependabot/codegen) code-merge to main, or the Docker weekly schedule.
+#
+# Outputs:
+# publish - 'true' when this run should publish: a bot-authored push (the codegen App merges every bot PR, so
+# its identity - or dependabot[bot] - is the gate), a schedule, or a workflow_dispatch of main/develop.
+# A human push (a merge/promotion to main) or a dispatch from any other branch is 'false'.
+# stable - 'true' when the target branch is main (stable channel); main-only jobs gate on publish && stable.
+# Both outputs are the strings 'true'/'false' - gate with == 'true'; a bare `if: ${{ needs.plan.outputs.publish }}`
+# is always truthy (a non-empty string is truthy in an Actions expression).
+#
+# Shared across repo types: a library/package repo triggers only push + dispatch and uses `publish`; a
+# Docker/wrapper repo also triggers the weekly schedule and gates main-only jobs on `stable`. A case a given
+# caller never triggers (e.g. schedule for a library) is simply inert for it - expected of a single-source task.
+
+on:
+ workflow_call:
+ inputs:
+ event_name:
+ description: The triggering event (github.event_name).
+ required: true
+ type: string
+ actor:
+ description: The actor that triggered the run (github.actor).
+ required: true
+ type: string
+ ref_name:
+ description: The short ref name (github.ref_name).
+ required: true
+ type: string
+ outputs:
+ publish:
+ description: "'true' when this run should publish."
+ value: ${{ jobs.plan.outputs.publish }}
+ stable:
+ description: "'true' when the target branch is main (stable channel)."
+ value: ${{ jobs.plan.outputs.stable }}
+
+jobs:
+
+ plan:
+ name: Plan release job
+ runs-on: ubuntu-latest
+ outputs:
+ publish: ${{ steps.decide.outputs.publish }}
+ stable: ${{ steps.decide.outputs.stable }}
+
+ steps:
+
+ - name: Decide release plan step
+ id: decide
+ env:
+ EVENT: ${{ inputs.event_name }}
+ ACTOR: ${{ inputs.actor }}
+ REF: ${{ inputs.ref_name }}
+ run: |
+ set -euo pipefail
+ publish=false
+ case "$EVENT" in
+ workflow_dispatch)
+ # A human release: only the long-lived branches publish (a stray feature-branch dispatch is a no-op).
+ [[ "$REF" == "main" || "$REF" == "develop" ]] && publish=true
+ ;;
+ schedule)
+ # Docker weekly refresh (main-only by schedule config).
+ publish=true
+ ;;
+ push)
+ # A human merge never auto-publishes; only a bot merge to main does. The codegen App merges every
+ # Dependabot/codegen PR, so github.actor is its identity (dependabot[bot] allowed defensively). The
+ # ref==main guard keeps the task self-contained even if a caller's push trigger is not main-only.
+ if [[ "$REF" == "main" ]] && { [[ "$ACTOR" == "ptr727-codegen[bot]" ]] || [[ "$ACTOR" == "dependabot[bot]" ]]; }; then
+ publish=true
+ fi
+ ;;
+ esac
+ stable=false
+ [[ "$REF" == "main" ]] && stable=true
+ echo "publish=$publish" >> "$GITHUB_OUTPUT"
+ echo "stable=$stable" >> "$GITHUB_OUTPUT"
+ echo "Release plan: event=$EVENT actor=$ACTOR ref=$REF -> publish=$publish stable=$stable"
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 8c40eae..a2dfd5c 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -1,21 +1,20 @@
name: Publish project release action
-# Branch-scoped self-publisher: a push to main or develop, or a manual dispatch, publishes that branch.
+# Publisher. A human PR merge never auto-publishes; a release is a deliberate dispatch or a bot merge to main.
#
-# - Trigger: a push that changes a shipped input (the on.push.paths inclusion list below - library source,
-# version floor, build configuration, or package versions), or a workflow_dispatch on the target branch.
-# - Inclusion-only: add a path to that list when a new input starts affecting the shipped package. Package
-# versions (Directory.Packages.props) ARE listed: a NuGet package cannot be rebuilt on a cadence (a version
-# can't be re-pushed), so a dependency bump must republish to keep the package's declared dependencies
-# current - this closes the stale/vulnerable-dependency window. GitHub Actions bumps are not listed (they do
-# not ship in the package), so an Actions Dependabot bump does not republish (a package-version bump does).
-# - Output: main publishes a stable release, develop a prerelease. A dispatch force-publishes its branch.
-# - Gate: the publish job needs the same validate-task the PR runs, so nothing publishes that would fail
-# validation, on any path (push, dispatch, or force-push).
-# - The merge-bot merges with an App token, so its merge commits reach this push trigger.
+# - Push trigger (main only, on.push.paths inclusion list below - library source, version floor, build config,
+# or package versions): a code-affecting Dependabot/codegen merge auto-publishes a stable release. The plan
+# job (publish-plan-task.yml) computes the gate once - only the codegen App / Dependabot actor qualifies on a
+# push, so a human merge or promotion to main skips and the maintainer dispatches when release-ready.
+# - Inclusion-only: add a path when a new input starts affecting the shipped package. Package versions
+# (Directory.Packages.props) ARE listed: a NuGet version can't be re-pushed, so a dependency bump must
+# republish to keep declared dependencies current (closes the stale/vulnerable-dependency window). GitHub
+# Actions bumps are not listed (they don't ship in the package), so an Actions bump merges without republishing.
+# - workflow_dispatch: the maintainer publishes the chosen branch - main a stable release, develop a prerelease.
+# - Gate: the publish job needs the same validate-task the PR runs, so nothing publishes that would fail validation.
on:
push:
- branches: [main, develop]
+ branches: [main]
paths:
- 'Utilities/**'
- 'version.json'
@@ -31,22 +30,31 @@ concurrency:
jobs:
- # The same unit-test + lint gate the PR runs. The publish job needs it, so a failing test or lint blocks
- # the release.
+ # Single source of the release-gate decision (publish? stable?); validate + publish gate on its outputs
+ # instead of re-testing event/actor/branch. See publish-plan-task.yml for the policy.
+ plan:
+ name: Plan release job
+ uses: ./.github/workflows/publish-plan-task.yml
+ with:
+ event_name: ${{ github.event_name }}
+ actor: ${{ github.actor }}
+ ref_name: ${{ github.ref_name }}
+
+ # The same unit-test + lint gate the PR runs, on the branch tip; runs only when a publish will happen.
validate:
name: Validate job
+ needs: [plan]
+ if: ${{ needs.plan.outputs.publish == 'true' }}
uses: ./.github/workflows/validate-task.yml
- # Thread CODECOV_TOKEN through so the unit-test job can upload coverage.
secrets: inherit
- # Build, version, validate, push, and release the triggering branch. Grants the write scopes
- # build-release-task needs (it declares none, so the read-only smoke caller is not forced to over-grant).
- # The push trigger is already limited to main/develop, and the if-guard covers a workflow_dispatch, which
- # can target any branch.
+ # Build, version, validate, push, and release the triggering branch (main = release, develop = prerelease via
+ # dispatch). Grants the write scopes build-release-task needs (it declares none, so the read-only smoke caller
+ # is not forced to over-grant). Gated on the plan decision.
publish:
name: Publish project release job
- needs: validate
- if: ${{ github.event_name == 'push' || github.ref_name == 'main' || github.ref_name == 'develop' }}
+ needs: [plan, validate]
+ if: ${{ needs.plan.outputs.publish == 'true' }}
uses: ./.github/workflows/build-release-task.yml
secrets: inherit
permissions:
diff --git a/.github/workflows/test-pull-request.yml b/.github/workflows/test-pull-request.yml
index df5e561..5c8a3fe 100644
--- a/.github/workflows/test-pull-request.yml
+++ b/.github/workflows/test-pull-request.yml
@@ -26,7 +26,6 @@ jobs:
name: Validate job
if: ${{ !github.event.deleted }}
uses: ./.github/workflows/validate-task.yml
- # Thread CODECOV_TOKEN through so the unit-test job can upload coverage.
secrets: inherit
# Build and pack the library in its branch configuration to prove it ships, publishing nothing. Runs on