[ptr727]

Summary

• Re-vendor the current fleet instruction sections and generated GitHub skills.
• Adopt the released reusable validation, release, and merge-bot workflows.
• Preserve ESPHome-specific validation through a local composite-action hook.

Verification

• actionlint with bundled shellcheck
• markdownlint-cli2
• CSpell across the repository's widened documentation set
• EditorConfig checker
• hub prose, EOL coverage, SHA-pin, host, and live repository-configuration gates
• 21 declared verbatim instruction sections compared byte-for-byte with hub 537b183

[Copilot]

Pull request overview

This pull request resyncs this ESPHome operational repository with the current ptr727 fleet governance and GitHub Actions standards, switching CI entry points to hub-hosted reusable workflows while keeping ESPHome-specific validation via a local composite-action hook.

Changes:

• Re-vendor governance/contract documents and add a large set of generated GitHub Copilot Skills.
• Adopt hub reusable workflows for PR validation, release planning/publishing, and merge-bot behavior.
• Add/update local validation hooks and repo lint tooling configuration (CSpell words, EditorConfig checker exclusions, .gitattributes EOL pins).

Reviewed changes

Copilot reviewed 46 out of 46 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
WORKFLOW.md	Updates workflow contract text to match the current fleet CI/CD model and terminology.
GOVERNANCE.md	Resyncs write-safety, tooling, and review-loop governance language.
cspell.json	Updates repository spelling allowlist terms to match new naming.
AGENTS.md	Updates agent workflow pointers and rule map entries.
.github/workflows/test-pull-request.yml	Switches PR validation to hub validate-task.yml, keeps repo-specific compile gating and aggregator required check.
.github/workflows/publish-release.yml	Switches release publishing to hub publish-plan-task.yml + build-release-task.yml.
.github/workflows/merge-bot-pull-request.yml	Converts merge-bot workflow to a thin caller of hub merge-bot-task.yml.
.github/skills/workflow-ci-contract/SKILL.md	Adds/updates workflow CI contract skill content.
.github/skills/workflow-ci-contract/references/test-methodology.md	Adds/updates workflow test methodology reference.
.github/skills/workflow-ci-contract/references/d-guarantees.md	Adds/updates condensed D-guarantees reference.
.github/skills/upstream-contribution-workflow/SKILL.md	Adds/updates upstream contribution workflow skill.
.github/skills/standup-a-repo/SKILL.md	Adds/updates repo standup procedure skill.
.github/skills/skill-lifecycle/SKILL.md	Adds/updates skill lifecycle governance skill.
.github/skills/shell-codestyle/SKILL.md	Adds/updates shell scripting codestyle skill.
.github/skills/resync-a-repo/SKILL.md	Adds/updates repo resync procedure skill.
.github/skills/repo-worktree/SKILL.md	Adds/updates worktree/isolation mechanics skill.
.github/skills/python-codestyle/SKILL.md	Adds/updates Python codestyle skill.
.github/skills/python-codestyle/references/testing.md	Adds/updates Python testing conventions reference.
.github/skills/python-codestyle/references/profiles.md	Adds/updates Python profile definitions reference.
.github/skills/python-codestyle/references/code-style.md	Adds/updates Python code style reference.
.github/skills/pr-review-conduct/SKILL.md	Adds/updates PR review loop contract skill.
.github/skills/operational-vs-release-workflow/SKILL.md	Adds/updates workflow model (operational vs release) skill.
.github/skills/operational-vs-release-workflow/references/release-publish-mechanics.md	Adds/updates detailed release/publish mechanics reference.
.github/skills/operational-vs-release-workflow/references/branch-protection-and-promotion.md	Adds/updates branch protection/promotion mechanics reference.
.github/skills/git-commit-conventions/SKILL.md	Adds/updates git staging/commit/signing rules skill.
.github/skills/git-commit-conventions/references/history-rewrite.md	Adds/updates history rewrite rules reference.
.github/skills/fleet-conformance-check/SKILL.md	Adds/updates in-repo conformance self-check skill.
.github/skills/dotnet-codestyle/SKILL.md	Adds/updates .NET codestyle skill (fleet-wide, even if repo-local usage is limited).
.github/skills/dotnet-codestyle/references/testing.md	Adds/updates .NET testing conventions reference.
.github/skills/dotnet-codestyle/references/project-config.md	Adds/updates .NET project configuration reference.
.github/skills/dotnet-codestyle/references/conventions.md	Adds/updates .NET conventions reference.
.github/skills/copilot-instructions-keeper/SKILL.md	Adds/updates Copilot instructions drift/ledger preservation skill.
.github/skills/comment-and-doc-style/SKILL.md	Adds/updates documentation/prose style skill.
.github/skills/comment-and-doc-style/references/markdown-links.md	Adds/updates Markdown link style reference.
.github/skills/comment-and-doc-style/references/line-endings.md	Adds/updates line ending policy reference.
.github/skills/comment-and-doc-style/references/carried-doc-references.md	Adds/updates carried-doc reference rules reference.
.github/skills/code-review/SKILL.md	Adds/updates code review skill and required review marker contract.
.github/skills/carried-instruction-file-guard/SKILL.md	Adds/updates guard skill to prevent destructive overwrites of carried instruction files.
.github/skills/audit-a-repo/SKILL.md	Adds/updates audit procedure skill.
.github/skills/agent-conduct/SKILL.md	Adds/updates agent conduct/verification discipline skill.
.github/skills/add-host-tool/SKILL.md	Adds/updates managed host tool lifecycle skill.
.github/actions/validate/action.yml	Adds repo-specific validation hook action for the hub validation workflow to invoke.
.gitattributes	Adds explicit LF pins for execution-sensitive files under * -text.
.editorconfig-checker.json	Excludes common generated caches/venvs from editorconfig-checker scans.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 47 out of 47 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/publish-release.yml:36

• The plan reusable-workflow job inherits the workflow-level permissions: {} and currently does not declare its own permissions. If publish-plan-task.yml needs to check out the repo or read via the API, it will fail with an under-scoped GITHUB_TOKEN. Grant the minimal read scope at the call site so the plan job can run reliably.
  .github/actions/validate/action.yml:27
• The Python subtree is a lint-only uvx/ruff setup (no lockfile), and the repo’s own python-codestyle guidance says CI should use uvx ruff@latest because uvx <tool>@<ver> pins are not tracked by Dependabot and silently go stale. This action currently pins ruff to 0.15.22, which contradicts that contract and can drift over time.

        set -Eeuo pipefail
        uvx ruff@0.15.22 check .
        uvx ruff@0.15.22 format --check .

.gitattributes:9

• The comment claims an extensionless executable “matches no extension rule”, but .editorconfig has a global [*] end_of_line = lf which does match extensionless files. Consider rewording this comment to clarify the real point (git-level LF enforcement on checkout/renormalize) without implying EditorConfig cannot match extensionless names.

# Exception: scripts must stay LF regardless of the `* -text` default, because a CRLF shebang breaks execution.
# `.editorconfig` covers `*.sh`, but an extensionless executable matches no extension rule.
# Pin those here, so git enforces LF on checkout and on `--renormalize`.

[ptr727]

Second-round suppressed-finding triage (3 total):\n\n- publish-release.yml plan permissions: Disproven. The pinned hub plan workflow is a pure shell decision job; it neither checks out content nor calls the GitHub API or token. An empty permission set is therefore deliberate least privilege.\n- validate/action.yml Ruff 0.15.22 pin: Disproven. CODESTYLE.md explicitly records this repo-specific pin as a deliberate fleet divergence, and OPERATIONS.md plus the VS Code task use the same version.\n- .gitattributes explanation: Fixed in 9b0c865. The comment now correctly distinguishes EditorConfig content validation from Git checkout and renormalization behavior.\n\nThe same commit also advances both validation callers to ProjectTemplate 2.0.376 (537b1837fe90e2288f71034ef96cc4e949937712), which contains the self-contained prose-gate fix tracked by ptr727/ProjectTemplate#824.

[Copilot]

Pull request overview

Copilot reviewed 47 out of 47 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 47 out of 47 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/publish-release.yml:36

• The workflow sets top-level permissions: {}, but the plan job doesn’t grant any permissions to the called publish-plan-task.yml. If that reusable workflow needs to read repository contents (e.g., checkout/read version.json or config), it will run with an effectively permissionless GITHUB_TOKEN and can fail at runtime. This also contradicts WORKFLOW.md D7.2 (“every reusable job declares valid permissions”).

Grant the minimal read permission explicitly on the plan job (and expand only if the reusable workflow proves it needs more).
GOVERNANCE.md:214

• This bullet links to ./docs/reusable-workflows.md, but this repository doesn’t have a docs/ directory, so the link is broken. Either add the referenced doc or remove/adjust the reference so the guidance remains navigable in this repo.

[ptr727]

Final-round suppressed-finding triage (2 total):\n\n- publish-release.yml plan permissions: Disproven. The pinned publish-plan-task.yml is a pure shell decision workflow. It does not check out repository content, read version.json, call the GitHub API, or consume GITHUB_TOKEN. The caller's empty permission set is therefore valid least privilege; adding contents: read would grant an unused capability.\n- GOVERNANCE.md broken docs/reusable-workflows.md link: Confirmed hub defect. The affected Governance section is byte-locked carried content, so changing it only in this downstream repo would violate the fleet contract. Filed ptr727/ProjectTemplate#829 with acceptance criteria for a downstream-safe canonical link and carry-time coverage.