Repository navigation
Decide the versioning and cutover strategy for the actions→.github merge #165
Description
🤖 Generated by the Agentic Engineer
Why this is a Spike
Merging actions into .github (#164) is blocked on one decision that cannot be made by writing code: how consumers reference the merged content, and how they cut over across 83 uses: call sites in ~14 repositories.
The destination layout is already settled by maintainer direction and is not in scope here: composite actions go in actions/ at the root of .github (devantler-tech/.github/actions/<name>@<ref>), and reusable workflows necessarily keep .github/workflows/ because GitHub requires it (devantler-tech/.github/.github/workflows/<file>@<ref>). See #164.
What the measurement already settled
Consumers pin SHAs, not tags: 1,418 of 1,434 uses: devantler-tech/actions references in a local sweep are 40-character SHAs, 0 are version tags, with # vX.Y.Z carried as a trailing comment.
So the question is not "which tag do consumers move to" — nothing resolves by tag. Rewriting a call site means writing a new SHA regardless of what the tag train does. What remains open is narrower and mostly about tooling.
What to determine
- Update tooling. How do Renovate/Dependabot track the moved actions? The version comment and the datasource both change when the pin moves to
.github. Does the existing config follow it automatically, or does every consumer need a config change alongside the SHA change? - Release train. Does
.githubadoptactions' release-please setup, keep its own, or run a distinct tag namespace for the merged content? Note this is now largely a legibility and tooling decision rather than a resolution one — weigh it accordingly and do not overspend on it. - Dual-resolution window. Can both old and new references resolve during cutover — and if so, by what mechanism (leaving
actionslive as a shim, tag aliasing, or simply repointing repo-by-repo whileactionsstays untouched until last)? Merge devantler-tech/actions into devantler-tech/.github as the single home for GitHub software and configuration #164 assumes incremental repointing rather than a 14-repo flag day. - Cutover order. Per-repo or batched, and which repo goes first as the canary.
platformcarries the most references (24) and the heaviest CI, so it is a poor canary; a small template repo is likely better. - Whether the two halves move together. Composite actions and reusable workflows have different destination paths and could move in separate passes.
Timebox
One working session. If no option is clearly better by then, record the trade-offs and pick the most reversible one — this decision blocks the whole Epic and must not sit.
Definition of done
Per the Spike type: a recorded decision on this issue plus the follow-up issues it implies, filed as sub-issues of #164. No delivery PR.
The decision record states the evidence, the options considered, the chosen path, and why — so a later run does not relitigate it.
Part of #164
Activity
chore: agent-claim #165 nonce=0a45bb2223ac574d60515ff2a149fab3
devantler commentedon Sep 25, 2026
Decision (2026-09-25, chosen by the maintainer in session)
.github's semantic-release train. The imported catalogue ships as one major version (v2.0.0)..github.actionsgets only mirrored urgent fixes until consumers move. It is archived last.go-templateis the first consumer repointed.platformgoes last.Evidence
devantler-tech/actionstodevantler-tech/.github, so Dependabot never compares the two version lines. The# v13.x→# v2.xcomment change is cosmetic, which is why the cheapest train won.devantler-tech/*, and that also matchesdevantler-tech/.github. Three repositories (platform-tenant-template,wedding-app,ascoachingogvaner) have caller-pin tests that hard-code theactionspath and look up its tags. Those change in each repository's repoint PR.mainhere only accepts squash merges with linear history. A snapshot import is the only compliant route, andactions' history stays readable once it is archived.../.scripts, andvalidate-go-project.yamlpinsapply-signed-fixes.yamlremotely 3 times. A split move leaves two partial copies calling each other.ci.yamlis the only workflow filename both repositories use. There is still oneCI - Required Checksgate: the imported suite runs inside it.actions(948529001), and only one of those rules is declared indeploy/. They must move before the archive.uses: devantler-tech/actionsin 74 files across 21 repositories (default branches only, so a floor).Options not chosen
Follow-ups (sub-issues of #164)
actions(blocked by Import the devantler-tech/actions catalogue into .github as one snapshot #235).go-template(blocked by Import the devantler-tech/actions catalogue into .github as one snapshot #235).actions(blocked by Repoint organization-required workflows from actions to .github #237 and Repoint the remaining consumers from actions to .github #239).devantler commentedon Sep 25, 2026
Addendum to the follow-ups: #242 was added after the decision record. The platform checks tenant artifact signatures against a subject pinned to
devantler-tech/actions's publish workflows, so it must accept the.githubidentity before any publishing repository is repointed. #239 is now blocked by #242.feat!: import the devantler-tech/actions catalogue (#243)