actions/checkout v7 is now GA and refuses to fetch fork PR head code in
pull_request_target / workflow_run workflows when unsafe ref patterns are
detected. The enforcement backports to all supported majors on 2026-07-16,
so pinned SHAs must be upgraded manually.
Pin all 36 checkout usages across 26 workflows to v7.0.0
(9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0), collapsing the prior v6.0.2 and
v4 pins to one version. All pull_request_target/workflow_run workflows check
out trusted refs (main / default branch) and never the fork head, so v7's new
refusal does not affect them — no allow-unsafe-pr-checkout opt-out needed.
Co-authored-by: Isaac
ap-web's lockfile is generated and validated with `--legacy-peer-deps`
everywhere (lint, e2e-ui, ap-web-tests, the regen jobs) because of a React 19
peer conflict. The release workflow's plain `npm ci` is the only npm-ci that
omits it, so it rejects the lockfile ("Missing: yaml@1.10.3 from lock file").
Add the flag to match. (The secure-publish workflow needs the same one-line
fix on its side.)
Co-authored-by: Isaac
* ci: multi-line long pytest paths + trim inline comments (ci.yml)
Fold the matrix `paths:` values (esp. the misc shard's long --ignore list)
into >- block scalars (fold back to the identical space-joined string passed
to pytest -- no behavior change) and cut the verbose inline comments to terse
one-liners, keeping a tightened top-of-file description. Verified the parsed
YAML is identical apart from comments.
Co-authored-by: Isaac
* ci: trim inline comments + multi-line long commands across workflows
Apply the ci.yml cleanup to the rest of the workflows: condense each file's
top block to a concise behavior+caveats description, cut verbose inline
narration to terse WHY-only one-liners, and fold any long word-split arg
lists into >- block scalars. Comment/formatting only -- verified per file by
parsing old vs new YAML and asserting the structures are identical after
stripping comment lines (every trigger/job/step/expression/run command and
folded arg-string is unchanged). Also dropped a couple of stale internal
references from comments while condensing.
Co-authored-by: Isaac
PyPI publishing has moved to the central secure-release repo
(databricks/secure-public-registry-releases-eng, workflow omnigent.yml).
The old tag-push trigger here still fired on version tags and
double-published to TestPyPI, colliding with the secure pipeline on the
same tag (seen on v0.1.1rc1: `400 File already exists`). Drop the
push:tags trigger; keep workflow_dispatch as a manual fallback. The whole
workflow will be deleted once the secure path has done a prod release.
Co-authored-by: Isaac
Daniel Lok