fix(ci): regenerate workflows from pinned Velnor

Author: donbeave

.github/ci/.github-actions-generator-state

@@ -7,8 +7,8 @@ generator	49
 [outputs]
 .github/actionlint.yaml	ec35f48ae7e90e0e
 .github/ci/project.toml	b19da7b7165e2f66
-.github/workflows/ci-main.yml	7b55f4df4a234985
-.github/workflows/ci-policy.yml	a9a48676140ac8dd
+.github/workflows/ci-main.yml	9674edd8e9649bc5
+.github/workflows/ci-policy.yml	29d78b9957b5e17f
 .github/workflows/ci-pr.yml	aa0b4d40949af2ad
 .github/workflows/ci-unit-gradle.yml	a8a769d0f75f737d
 .github/workflows/maintenance.yml	44cdcd6db1e77d43

.github/workflows/ci-main.yml

@@ -176,24 +176,13 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           DEFAULT_BRANCH: main
-          DECLARED_RULESET_CONTEXTS: DCO,Policy,ci-required
         run: |
           set -euo pipefail
-          stderr="$(mktemp)"
-          trap 'rm -f "$stderr"' EXIT
-          if contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" 2>"$stderr" \
+          contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" \
             | jq -r '.[] | select(.target == "branch" and .enforcement == "active") | .id' \
             | while read -r id; do gh api "repos/$GITHUB_REPOSITORY/rulesets/$id"; done \
             | jq -r --arg branch "refs/heads/$DEFAULT_BRANCH" 'select(.conditions.ref_name.include | any(. == "~DEFAULT_BRANCH" or . == "~ALL" or . == $branch)) | .rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context' \
-            | sort -u | paste -sd, -)"; then
-            :
-          elif grep -qE '(HTTP 403|Upgrade to GitHub Team)' "$stderr"; then
-            echo "::warning::rulesets API returned 403; falling back to declared contexts [$DECLARED_RULESET_CONTEXTS]"
-            contexts="$DECLARED_RULESET_CONTEXTS"
-          else
-            cat "$stderr" >&2
-            exit 1
-          fi
+            | sort -u | paste -sd, -)"
           echo "RULESET_CONTEXTS=$contexts" >> "$GITHUB_ENV"
       - name: Enforce workflow policy
         env:

.github/workflows/ci-policy.yml

@@ -80,24 +80,13 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           DEFAULT_BRANCH: main
-          DECLARED_RULESET_CONTEXTS: DCO,Policy,ci-required
         run: |
           set -euo pipefail
-          stderr="$(mktemp)"
-          trap 'rm -f "$stderr"' EXIT
-          if contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" 2>"$stderr" \
+          contexts="$(gh api "repos/$GITHUB_REPOSITORY/rulesets?includes_parents=true" \
             | jq -r '.[] | select(.target == "branch" and .enforcement == "active") | .id' \
             | while read -r id; do gh api "repos/$GITHUB_REPOSITORY/rulesets/$id"; done \
             | jq -r --arg branch "refs/heads/$DEFAULT_BRANCH" 'select(.conditions.ref_name.include | any(. == "~DEFAULT_BRANCH" or . == "~ALL" or . == $branch)) | .rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context' \
-            | sort -u | paste -sd, -)"; then
-            :
-          elif grep -qE '(HTTP 403|Upgrade to GitHub Team)' "$stderr"; then
-            echo "::warning::rulesets API returned 403; falling back to declared contexts [$DECLARED_RULESET_CONTEXTS]"
-            contexts="$DECLARED_RULESET_CONTEXTS"
-          else
-            cat "$stderr" >&2
-            exit 1
-          fi
+            | sort -u | paste -sd, -)"
           echo "RULESET_CONTEXTS=$contexts" >> "$GITHUB_ENV"
       - name: Enforce workflow policy
         env: