feat(retired-links): check retired repository links by default

.github/agent-guides/validation.md

@@ -70,15 +70,16 @@ before searching captured output; do not blanket-exempt the repository's scripts
 Every shared-action call validates. Linux/macOS fixtures cover clean, unsafe and
 malformed scans. An invalid scope must fail without a `validated` output.
 
-**Retired repository links:** `validate-retired-repo-links` is a default-off,
-read-only Go validator with no module dependencies. Keep both flag states, real
+**Retired repository links:** `validate-retired-repo-links` is a default-on,
+read-only Go validator with no module dependencies; `enabled: "false"` switches it
+off without removing the step. Keep the default, both explicit states, real
 good/bad action fixtures on Linux/macOS, and the required-check wiring covered.
 Successful calls expose their exact action module directory for same-job consumer
 refusal controls; disabled and failed calls expose neither validation nor source
 outputs. Keep the native usable-source assertions and
 `.github/tests/test-retired-repo-links-source.sh` passing when changing this boundary.
 Configuration belongs to each consumer; never hard-code retired portfolio names
 or blanket historical exemptions in the action. Exceptions require an exact
-file, repository and reason. Consumer adoption and flag retirement are in
-[#269](https://github.com/devantler-tech/.github/issues/269).
+file, repository and reason. The `enabled` input is a supported off switch, not a
+temporary rollout flag ([#269](https://github.com/devantler-tech/.github/issues/269)).
 

.github/workflows/ci.yaml

@@ -169,7 +169,7 @@ jobs:
   test-validate-retired-repo-links-disabled:
     needs: [select-ci-tests]
     if: "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') && contains(fromJSON(needs.select-ci-tests.outputs.selected), 'test-validate-retired-repo-links-disabled') }}"
-    name: "[Test] Retired Repository Links - Disabled"
+    name: "[Test] Retired Repository Links - Default and Disabled"
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -182,12 +182,19 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: Omitted opt-in skips a missing consumer
+      - name: Omitted input validates by default
         id: omitted
         # actionlint rejects $/ syntax (#1234); this tests the checked-out candidate.
         uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository]
         with:
-          working-directory: missing-directory
+          working-directory: .github/fixtures/retired-repo-links
+      - name: Omitted input rejects the seeded violation
+        id: omitted_violation
+        continue-on-error: true
+        uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository]
+        with:
+          working-directory: .github/fixtures/retired-repo-links
+          config-file: invalid.json
       - name: Explicit false skips the seeded violation
         id: disabled
         uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository]
@@ -201,21 +208,26 @@ jobs:
         uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository]
         with:
           enabled: "yes"
-      - name: Assert disabled and invalid calls do not validate
+      - name: Assert default calls validate and disabled or invalid calls do not
         shell: bash
         env:
           OMITTED: ${{ steps.omitted.outputs.validated }}
+          OMITTED_VIOLATION: ${{ steps.omitted_violation.outcome }}
+          OMITTED_VIOLATION_VALIDATED: ${{ steps.omitted_violation.outputs.validated }}
           DISABLED: ${{ steps.disabled.outputs.validated }}
           INVALID: ${{ steps.invalid.outcome }}
           OMITTED_SOURCE: ${{ steps.omitted.outputs.source-directory }}
           DISABLED_SOURCE: ${{ steps.disabled.outputs.source-directory }}
           INVALID_SOURCE: ${{ steps.invalid.outputs.source-directory }}
           INVALID_VALIDATED: ${{ steps.invalid.outputs.validated }}
         run: |
-          test -z "$OMITTED"
+          test "$OMITTED" = true
+          test -n "$OMITTED_SOURCE"
+          test "$(cd "$OMITTED_SOURCE" && pwd -P)" = "$(cd actions/validate-retired-repo-links && pwd -P)"
+          test "$OMITTED_VIOLATION" = failure
+          test -z "$OMITTED_VIOLATION_VALIDATED"
           test -z "$DISABLED"
           test "$INVALID" = failure
-          test -z "$OMITTED_SOURCE"
           test -z "$DISABLED_SOURCE"
           test -z "$INVALID_SOURCE"
           test -z "$INVALID_VALIDATED"

actions/validate-retired-repo-links/README.md

@@ -9,7 +9,7 @@ does not call GitHub, follow links, or infer retirement from a repository name.
 
 | Name | Description | Required | Default |
 |------|-------------|----------|---------|
-| `enabled` | Opt in to validation; exactly `true` or `false`. | No | `false` |
+| `enabled` | Run validation; exactly `true` or `false`. Set `false` to switch the check off without removing the step. | No | `true` |
 | `config-file` | JSON configuration relative to `working-directory`. | No | `.github/retired-repo-links.json` |
 | `working-directory` | Consumer directory, relative to `GITHUB_WORKSPACE` or absolute. | No | `.` |
 
@@ -38,19 +38,16 @@ steps:
     with:
       persist-credentials: false
   - uses: devantler-tech/.github/actions/validate-retired-repo-links@<full-commit-sha> # vX.Y.Z
-    with:
-      enabled: "true"
 ```
 
-Omitted or false `enabled` inputs do not install Go, read configuration or scan
-files. Enabled runs install the Go version from this action's module and build a
-standard-library-only validator from the pinned action revision. The caller's Go
-module and workspace are not used. That Go stays on `PATH` for later steps in the
-same job, so run the action in its own job, or set up your own Go version again
-after it. Linux and macOS runners are supported.
-
-Consumer adoption and removal of the temporary `enabled` flag are tracked in
-[#269](https://github.com/devantler-tech/.github/issues/269).
+The check runs by default. An `enabled: "false"` input switches it off without
+removing the step: it then does not install Go, read configuration or scan files.
+Callers that already pass `enabled: "true"` keep working unchanged. Enabled runs
+install the Go version from this action's module and build a standard-library-only
+validator from the pinned action revision. The caller's Go module and workspace are
+not used. That Go stays on `PATH` for later steps in the same job, so run the action
+in its own job, or set up your own Go version again after it. Linux and macOS
+runners are supported.
 
 ## Configuration
 
@@ -110,7 +107,7 @@ GOWORK=off go -C /path/to/actions/validate-retired-repo-links run -mod=readonly
   --root /path/to/consumer --config .github/retired-repo-links.json
 ```
 
-The CLI always validates; the opt-in belongs to the composite action. Exit codes
+The CLI always validates; the `enabled` switch belongs to the composite action. Exit codes
 are `0` for a complete clean scan, `1` for retired links, and `2` for configuration,
 argument or filesystem errors.
 

actions/validate-retired-repo-links/action.yaml

@@ -3,9 +3,9 @@ description: Reject links to configured retired GitHub repositories with documen
 author: devantler-tech
 inputs:
   enabled:
-    description: Opt in to checking retired repository links.
+    description: Check retired repository links; set to false to switch the check off without removing the step.
     required: false
-    default: "false"
+    default: "true"
   config-file:
     description: JSON configuration path relative to working-directory.
     required: false
@@ -24,14 +24,14 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Check opt-in input
+    - name: Check enabled input
       shell: bash
       env:
         ENABLED: ${{ inputs.enabled }}
       run: |
         case "$ENABLED" in
           true) ;;
-          false) echo "Retired repository link validation is disabled; set enabled to true to opt in." ;;
+          false) echo "Retired repository link validation is switched off by enabled: false." ;;
           *) echo "::error::enabled must be exactly true or false"; exit 1 ;;
         esac