Promote Develop: Flag the .NET Coverage Upload and Tick the PlexCleaner Tracker Items

.github/actions/prose-gate/action.yml

@@ -48,7 +48,7 @@ runs:
         } >> "$GITHUB_OUTPUT"
 
     - name: Setup uv step
-      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       with:
         enable-cache: false
 

.github/actions/pypi-build-default/action.yml

@@ -36,7 +36,7 @@ runs:
         exit 1
 
     - name: Setup uv step
-      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       with:
         version: ${{ inputs.uv-version }}
         enable-cache: true

.github/actions/validate/action.yml

@@ -11,7 +11,7 @@ runs:
   steps:
 
     - name: Setup uv step
-      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+      uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       with:
         python-version: "3.13"
 

.github/workflows/canonical-review-sweep.yml

@@ -55,7 +55,7 @@ jobs:
       # It also imports datetime.UTC at module level.
       # So the interpreter is pinned to the floor spec/host-tools.json declares, rather than left as whatever the runner image ships.
       - name: Setup uv step
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: '3.13'
 

.github/workflows/test-pull-request.yml

@@ -43,7 +43,7 @@ jobs:
 
       # The repo gate's action reader falls back to uvx, a declared host tool, where PyYAML does not import.
       - name: Setup uv step
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           ignore-nothing-to-cache: true
 

.github/workflows/validate-task.yml

@@ -353,7 +353,7 @@ jobs:
       # Each Python step sets UV_PYTHON to the resolved interpreter instead, which every uv call in it reads.
       - name: Setup uv step
         if: steps.python.outputs.any == 'true' || hashFiles('.github/actions/**/action.yml', '.github/actions/**/action.yaml') != ''
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: "3.13"
 
@@ -707,6 +707,7 @@ jobs:
         uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           directory: ./coverage
+          flags: dotnet
           fail_ci_if_error: false
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -720,7 +721,7 @@ jobs:
       # A root the undeclared default skips still sets uv up, so an empty cache is a normal outcome rather than an error at post-job save.
       - name: Setup uv step
         if: steps.python.outputs.any == 'true'
-        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           python-version: ${{ matrix.python-version || fromJSON(inputs.python-versions)[0] }}
           ignore-nothing-to-cache: true

docs/reusable-workflows.md

@@ -197,7 +197,7 @@ Hub: `get-version-task.yml` and `publish-plan-task.yml` hosted, and the downstre
   - [ ] ESPHome-NonRoot (`get-version-task.yml` and `publish-plan-task.yml`)
   - [ ] NxWitness (`get-version-task.yml` and `publish-plan-task.yml`)
   - [ ] PhotoCleaner (`get-version-task.yml`)
-  - [ ] PlexCleaner (`get-version-task.yml`, and gains the `plan` job D4.1 requires by adopting `publish-plan-task.yml` rather than by a copy)
+  - [x] PlexCleaner (`get-version-task.yml`, and gains the `plan` job D4.1 requires by adopting `publish-plan-task.yml` rather than by a copy): its copy deleted. Versioning runs through the hub's `build-release-task.yml`, which calls `get-version-task.yml`. Its `plan` job calls `publish-plan-task.yml` by pin. The change was adopted on `develop` in ptr727/PlexCleaner#940 at `0e9b0b9`, merged 2026-08-30 and carried on `main`, its ground-truth branch. There `.github/workflows/` holds only the `merge-bot-pull-request.yml`, `publish-release.yml`, and `test-pull-request.yml` stubs.
   - [x] VSCode-Server-DotNetCore (`get-version-task.yml`): carries no copy, with versioning through the hub's `build-release-task.yml`, which calls `get-version-task.yml`. The change was adopted on `develop` in ptr727/VSCode-Server-DotNetCore#129 and carried on `main`, its ground-truth branch, at `e571822`. There the `main` audit run 2026-10-16T06:40:34Z reports no `interface` finding.
   - [x] KiCadLibrary (`get-version-task.yml`): its copy deleted, with versioning through the hub's `build-release-task.yml`, which calls `get-version-task.yml`, in ptr727/KiCadLibrary#60. The change was promoted to `main` in ptr727/KiCadLibrary#65, where the `main` audit run 2026-10-04T01:15:54Z reports no `interface` finding.
   - [ ] aiopurpleair (`get-version-task.yml`)
@@ -214,7 +214,7 @@ Hub: `build-release-task.yml` provides the `dotnet-publish`, `build-nuget`, and
 - [x] Hub pull request on `develop` in #762.
 - [x] Promoted to `main` in #774 (`0b07a59d`) and released as `2.0.352`, the first tag carrying `build-release-task.yml` and `build-docker-task.yml`. The first release attempt, on `82fecef`, ended in `startup_failure` in [run-startup-failure][run-startup-failure] because `build-nuget` and `github-release` declared job-level permissions. #772 fixed it before #774 promoted.
 - [x] PhotoCleaner (pilot, vanilla Docker plus .NET publish): ptr727/PhotoCleaner#55 on `develop` (`c80cb29`), promoted in ptr727/PhotoCleaner#56 (`fa91db0`). The migration deleted five carried task files. It mapped every value to a task input (`dotnet_publish_project`, `docker_image`) and needed no repo hook. The [pilot publish run][pilot-publish-run] released `1.1.11` with the .NET publish asset and Docker image. That run exposed an archive naming regression between the hub default and the repo leaf. The fix derives the name from the project file, with `dotnet_publish_asset_name` as an override. The next PhotoCleaner release proves the fix.
-- [ ] PlexCleaner (second, the same shape)
+- [x] PlexCleaner (second, the same shape): adopted on `develop` in ptr727/PlexCleaner#940 at `0e9b0b9`, merged 2026-08-30 and carried on `main`, its ground-truth branch. There `publish-release.yml` calls `build-release-task.yml` by pin, and so does the smoke job in `test-pull-request.yml`.
 - [x] VSCode-Server-DotNetCore (vanilla Docker only): `publish-release.yml` on `main`, its ground-truth branch, calls `build-release-task.yml` by pin with `enable_docker: true` and the other legs off. The repo's `main` at `e571822` carries only the `merge-bot-pull-request.yml`, `publish-release.yml`, and `test-pull-request.yml` stubs, where the `main` audit run 2026-10-16T06:40:34Z reports no `interface` finding.
 - [ ] ESPHome-NonRoot (`docker-prepare` hook for the upstream pin)
 - [ ] NxWitness (matrix hook and `build-base`)
@@ -237,6 +237,7 @@ Hub: `publish-docker-readme-task.yml` with a `docker-readme-transform` hook, `ch
 - [x] Promoted to `main` in #774 (`0b07a59d`) and released as `2.0.352`, the first tag carrying `publish-docker-readme-task.yml`, `check-upstream-version-task.yml`, `deploy-site-task.yml`, and `run-codegen-pull-request-task.yml`.
 - [ ] Adoption, one checkbox per carrier added when the hub pull request merges.
   - [x] VSCode-Server-DotNetCore (`publish-docker-readme-task.yml`): `publish-release.yml` on `main`, its ground-truth branch, calls `publish-docker-readme-task.yml` by pin and keeps no local copy, at `e571822`. There the `main` audit run 2026-10-16T06:40:34Z reports no `interface` finding.
+  - [x] PlexCleaner (`publish-docker-readme-task.yml`): adopted on `develop` in ptr727/PlexCleaner#940 at `0e9b0b9`, merged 2026-08-30 and carried on `main`, its ground-truth branch. There `publish-release.yml` calls `publish-docker-readme-task.yml` by pin and keeps no local copy.
   - [ ] NxWitness (`publish-docker-readme-task.yml`, moving the readme job out of `publish-release.yml`, and `run-codegen-pull-request-task.yml` with its scheduler)
   - [ ] ESPHome-NonRoot (`check-upstream-version-task.yml`, both trackers, the second with `auto-merge: false`)
   - [ ] Blog (`deploy-site-task.yml`, keeping `deploy-site.yml` as its own caller)
@@ -489,6 +490,8 @@ Quote each entry, and give each one a version. The `Build test matrix job` runs
 
 A caller carrying a .NET test project as well repeats that half of the job once per leg. The matrix is on the job rather than on its Python steps. So naming a second version there buys runner minutes rather than a second measurement. The `lint` job runs once, and its Python steps run under the first interpreter `python-versions` names. So a `uv.lock` whose `requires-python` floor is above the default still syncs there. The prose and repo gates beside them stay on 3.13, the floor the hub's own scripts declare. Its type check is performed at that interpreter alone. `mypy` and `pyright` each default their target to the one they run under. That holds where the repo's own `[tool.mypy]` or `[tool.pyright]` section does not name a version. Meanwhile `ruff` takes its target from `requires-python` where the `pyproject.toml` declares a `[project]` table and from its own default where it does not. A repo testing several interpreters settles the type-check target in its own configuration. The `lint` job refuses a `python-versions` value whose first entry is not a quoted version string, with a named cause.
 
+The .NET upload carries one fixed `dotnet` flag, the same in every leg. A caller whose `codecov.yml` configures flags names `dotnet` for the .NET unit-test share, beside the Python legs' own flags. A .NET caller's coverage reads as a `dotnet` series from its first pin bump onto a release carrying the flag, rather than unflagged.
+
 A repo whose pytest legs differ by dependency versions names them in `test-matrix`, a JSON array of objects, one leg per entry. It replaces the `python-versions` legs. Each entry needs a string `label` naming the leg and its Codecov flag. It may carry a `python-version`, defaulting to the first `python-versions` entry. Any other key is the repo's own, passed through to its hook.
 
 ```yaml

tests/test_release_guards.py

@@ -1965,6 +1965,16 @@ def test_validator_pytest_leg_fans_out_over_every_named_interpreter(self) -> Non
         # Without a flag naming its leg, each upload merges into one number that hides which leg it came from.
         self.assertIn("          flags: python-${{ matrix.label || matrix.python-version }}\n", job)
 
+    def test_validator_dotnet_upload_carries_a_fixed_flag(self) -> None:
+        """A path filter cannot tell the .NET upload from a Python leg's upload where their paths overlap.
+
+        The .NET upload therefore carries one fixed flag, the same in every leg, so a caller can name it.
+        """
+        workflow = (REPO / ".github/workflows/validate-task.yml").read_text(encoding="utf-8")
+        job = workflow.split("\n  unit-test:\n", 1)[1].split("\n  validate:\n", 1)[0]
+        upload = yaml_step(job, "Upload coverage to Codecov step")
+        self.assertEqual(yaml_value(upload, "with", "flags"), "dotnet")
+
     def test_validator_checks_out_the_triggering_commit(self) -> None:
         """A ref: on any checkout moves the gate off the commit a publisher releases.