fix(coverage): finish legacy Actions retirement

.github/agent-guides/catalogue.md

@@ -9,8 +9,9 @@ This repository also hosts the suite's shared CI/CD building blocks: composite a
 [`.github/workflows/`](../../.github/workflows/). They were imported from `devantler-tech/actions` as one
 snapshot (#235). The one-time importer is retired and preserved in Git history; the current
 catalogue and its documentation are authored here, not generated from that historical source.
-That repository is frozen pending verified migration and retirement (#240). Consumers reference
-the catalogue here as:
+That repository was deleted after verified migration and retirement (#240); historical signer
+identities remain verification data, never executable dependencies. Consumers reference the
+maintained catalogue here as:
 
 ```yaml
 uses: devantler-tech/.github/actions/<action>@<full-commit-sha> # vX.Y.Z

.github/governance-audits.md

@@ -16,7 +16,10 @@ audit. It closes that issue only after both complete audits succeed.
 Routine admission has no experimental switches. The natural daily run completed
 both full checks and the success reporter; its implementation and observation are
 tracked in [#395](https://github.com/devantler-tech/.github/issues/395).
-Legacy maintenance retirement remains [#84](https://github.com/devantler-tech/.github/issues/84).
+Legacy maintenance retirement is complete under [#84](https://github.com/devantler-tech/.github/issues/84).
+Actions retirement is recorded in [#240](https://github.com/devantler-tech/.github/issues/240);
+the deleted repository no longer has a coverage exemption. Recreating an undeclared repository
+must produce a coverage finding.
 
 Organization-settings adoption and observer scheduling remain separate in
 [#85](https://github.com/devantler-tech/.github/issues/85) and

AGENTS.md

@@ -122,8 +122,9 @@ Routine repository/admin-team monitoring is described in
 [`.github/governance-audits.md`](.github/governance-audits.md). Its daily schedule is enabled;
 manual execution is input-free and requires reviewed main. Keep admission, private-diagnostic suppression,
 complete-outcome reporting and source/credential mutations in required CI. Routine admission has no experimental switches. Natural scheduled observation and
-main dispatch prove both full checks and the reporter. Legacy maintenance retirement
-remains a separate gate (#84).
+main dispatch prove both full checks and the reporter. Legacy maintenance retirement is complete
+(#84). Actions has also been deleted (#240); its temporary coverage exemption is removed, so
+an undeclared recreation must fail the coverage audit. Historical signer identities remain data.
 
 The existing organization CodeQL finding rule is imported Observe-only. Run
 `bash tests/code-scanning-ruleset.sh` after changing its identity, read-only

README.md

@@ -23,8 +23,10 @@ but new callers should own their publication job.
 
 The shared CI/CD building blocks used across devantler-tech projects — both **composite actions** and
 **reusable `workflow_call` workflows** — in one maintained catalogue. Use this repository for new
-consumers and changes. Retired repositories are not supported adoption targets; the remaining
-Actions retirement safeguards are tracked in [#240](https://github.com/devantler-tech/.github/issues/240).
+consumers and changes. The former `maintenance` and `actions` repositories have been deleted after
+migration; do not copy references from older examples. Their recovery limits and verified retirement
+are recorded in [#84](https://github.com/devantler-tech/.github/issues/84) and
+[#240](https://github.com/devantler-tech/.github/issues/240).
 
 ## Using them
 
@@ -334,7 +336,7 @@ The release is published with a GitHub App token, so the caller must set the `AP
 
 Npm alignment runs unconditionally. Release runs read requirements from the consumer's `packageManager` field and npm entries under `devEngines.packageManager` after checkout. An exact stable `packageManager` version is installed exactly; integrity-suffixed descriptors fail explicitly because this workflow cannot verify their digest. Otherwise, blocking `devEngines` entries must describe complete npm majors (`11`, `11.x`, `^11.0.0`, or `>=11.0.0 <12.0.0`). Arrays are alternatives: versionless npm entries satisfy the contract, and when no entry matches the final alternative's `onFail` controls the result. Without an exact npm `packageManager` requirement, `warn` and `ignore` keep the current npm; `error` and `download` align to a supported complete-major alternative or fail. Compatible declarations resolve to the exact `packageManager` version, consumers with neither an exact npm `packageManager` requirement nor a blocking npm `devEngines` version keep the bundled npm, and explicit nulls, unknown properties, malformed, contradictory, prerelease, or otherwise unenforceable contracts fail explicitly.
 
-When adopting this breaking release, remove the retired `align-npm-with-consumer-contract` argument. Previously published canonical revisions and the frozen `devantler-tech/actions` catalogue retain their existing APIs and behavior. The frozen family's disposition remains tracked in [#392](https://github.com/devantler-tech/.github/issues/392); retiring this canonical input does not remove that legacy input.
+When adopting this breaking release, remove the retired `align-npm-with-consumer-contract` argument. Previously published revisions of this canonical catalogue retain their existing APIs and behavior. The former `devantler-tech/actions` catalogue has been deleted; its old APIs are not available adoption targets. Historical migration context remains in [#392](https://github.com/devantler-tech/.github/issues/392).
 
 Release runs for one repository and ref run one at a time, in the order they were queued, and waiting runs are kept (up to GitHub's limit of 100) rather than cancelled. Two merges that land close together therefore produce two sequential release runs instead of racing for the same version. Callers need no `concurrency` block of their own.
 
@@ -1267,7 +1269,8 @@ inspection; a skipped job is not an inspected release.
 
 This first version accepts only public active `devantler-tech` repositories, stable `vX.Y.Z` tags,
 failed push runs on the default branch and immutable original `create-release.yaml` producers from
-this catalogue or the frozen `devantler-tech/actions` catalogue. It reads configuration as data:
+this catalogue or historical `devantler-tech/actions` references. The latter repository has been
+deleted; recognizing its old identity does not make it executable. It reads configuration as data:
 only the supported JSON `.releaserc` with the default branch, commit analyzer, release-notes
 generator and GitHub publisher is accepted. Analyzer/notes options are limited to the observed
 breaking-header pattern and breaking/revert release rules; GitHub publisher options are unsupported.
@@ -1406,7 +1409,7 @@ provides this proof; its [repository-list response](https://docs.github.com/en/r
 provides the independent pagination totals. Installation mode requires this reviewed
 main workflow context and its unrestricted token mint.
 A skipped run is not evidence of compliance. The routine combined workflow also runs
-daily and reports only complete outcomes. Legacy maintenance retirement remains #84.
+daily and reports only complete outcomes. Legacy maintenance retirement is complete under #84.
 
 An operator with organization-admin visibility can evaluate the shared checker
 with `bash scripts/check-repository-admin-teams.sh --organization-admin`.

scripts/check-repository-coverage.sh

@@ -59,11 +59,9 @@ abort() {
 # Live repositories deliberately left out of deploy/, as "<repo>". Each is
 # declared intent with a tracked reason; the check fails on a stale entry, so
 # this list cannot rot.
-exemptions=(
-  # actions stays outside Repository management until verified full deletion
-  # (#240). Remove this exemption immediately after deletion is verified.
-  "actions"
-)
+# Actions was deleted after verified migration and withdrawal (#240). An
+# accidentally recreated repository must now be reported like any other gap.
+exemptions=()
 
 command -v yq >/dev/null || abort "required tool 'yq' not found"
 

tests/repository-coverage-api.sh

@@ -72,7 +72,7 @@ reset_case() {
   : >"$work/requests"
   jq -n '[range(1;11)|{id:.,name:("fixture-repo-"+tostring),full_name:("devantler-tech/fixture-repo-"+tostring),
     owner:{id:99,login:"devantler-tech"},private:(. % 2 == 0),archived:(. == 10)}] +
-    [{id:11,name:"actions",full_name:"devantler-tech/actions",owner:{id:99,login:"devantler-tech"},private:false,archived:false}] |
+    [{id:11,name:"retired-fixture",full_name:"devantler-tech/retired-fixture",owner:{id:99,login:"devantler-tech"},private:false,archived:true}] |
     [{total_count:11,repositories:.[0:6]},{total_count:11,repositories:.[6:]}]' >"$work/fixtures/repositories.json"
   printf '%s\n' '{"id":77,"app_id":88,"target_id":99,"target_type":"Organization","account":{"id":99,"login":"devantler-tech","type":"Organization"},"repository_selection":"all","suspended_at":null,"suspended_by":null}' >"$work/fixtures/installation.json"
 }

tests/repository-coverage.sh

@@ -23,7 +23,7 @@ fail() {
 readonly FIXTURE_REPOS=10
 
 # Writes a render declaring fixture-repo-1..10 (fixture-repo-10 archived) and a
-# live listing that matches it, plus the exempt `actions` repository.
+# live listing that matches it. Retired repositories have no exemption.
 build_fixture() {
   local dir="$1" i archived
   mkdir -p "$dir"
@@ -56,7 +56,6 @@ spec:
   forProvider:
     repository: labels-only
 EOF
-  echo "actions false" >>"$dir/live.txt"
 }
 
 # Runs the check on a fixture; sets $out and $rc.
@@ -73,7 +72,7 @@ run_check() {
 build_fixture "$work/clean"
 run_check "$work/clean"
 [[ "$rc" -eq 0 ]] || fail "clean fixture should pass, got rc=$rc: $out"
-[[ "$out" == *"all 10 live repositories are declared"* ]] ||
+[[ "$out" == *"all 9 live repositories are declared"* ]] ||
   fail "clean fixture should report the live count, got: $out"
 
 # 2. A live repository deploy/ does not declare: finding.
@@ -106,13 +105,23 @@ run_check "$work/unseen"
 [[ "$rc" -eq 2 ]] || fail "a listing that misses a declared repository should fail closed with 2, got rc=$rc: $out"
 [[ "$out" == *"UNSEEN fixture-repo-3"* ]] || fail "the unseen repository should be named, got: $out"
 
-# 6. An exemption that no longer applies: finding.
+# 6. Recreating the retired repository must be reported, not silently exempted.
+build_fixture "$work/recreated-retirement"
+echo "actions false" >>"$work/recreated-retirement/live.txt"
+run_check "$work/recreated-retirement"
+[[ "$rc" -eq 1 && "$out" == *"UNDECLARED actions"* ]] ||
+  fail "the retired repository must have no permanent exemption, got rc=$rc: $out"
+
+# Keep stale-exemption detection covered without putting a production exception
+# back. A test-only copy has one deliberately synthetic exception.
 build_fixture "$work/stale"
-grep -v '^actions ' "$work/stale/live.txt" >"$work/stale/live.tmp"
-mv "$work/stale/live.tmp" "$work/stale/live.txt"
+sed 's/^exemptions=(/exemptions=( "fixture-exemption"/' "$check" >"$work/stale-check.sh"
+saved_check="$check"
+check="$work/stale-check.sh"
 run_check "$work/stale"
-[[ "$rc" -eq 1 && "$out" == *"STALE-EXEMPTION actions"* ]] ||
-  fail "an exemption for a repository that is gone should be reported stale, got rc=$rc: $out"
+check="$saved_check"
+[[ "$rc" -eq 1 && "$out" == *"STALE-EXEMPTION fixture-exemption"* ]] ||
+  fail "a stale synthetic exemption should still fail, got rc=$rc: $out"
 
 # 7. An empty listing: fail closed.
 build_fixture "$work/empty"