chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
mkdocs-include-markdown-plugin (changelog)	==7.2.2 → ==7.3.0				minor
nolte/gh-plumbing	v1.1.12 → v1.1.25				patch
nolte/gh-plumbing	v1.1.19 → v1.1.25			action	patch
pymdown-extensions	==10.21.2 → ==11.0				major

---

Release Notes

mondeja/mkdocs-include-markdown-plugin (mkdocs-include-markdown-plugin)

v7.3.0

Compare Source

New features

• Add new setting include_from_url

nolte/gh-plumbing (nolte/gh-plumbing)

v1.1.25

Compare Source

Changes

🧰 Maintenance

• feat(release): add asset-filename input to reusable-release-publish (#​378) @​nolte

---

Project context

Audiences served

• Downstream repositories consuming reusable workflows → addressed by §Reusable workflow changes
• Downstream repositories extending Probot configurations → no published Probot commons-* config changed this release
• Downstream repositories consuming Renovate presets → no Renovate preset changed this release
• Repository maintainer (nolte) → addressed by the Maintenance section above

Reusable workflow changes

• reusable-release-publish.yml gains an optional asset-filename input that names the HACS zip-release asset the publish step builds and attaches (#​378, .github/workflows/reusable-release-publish.yml). Backward compatible: the empty default falls back to hacs.json .filename, then to <domain>.zip. When set, it takes precedence over hacs.json .filename; a divergence between the two emits a workflow warning, since HACS reads hacs.json to pick the asset, so the two MUST agree. HACS-source consumers only — no input-contract change for non-HACS consumers of this reusable workflow.

Open questions

• Project-type autodetection matched documentation-only (signal: mkdocs.yml present, no application source), but the audience artefact (AUDIENCES.md) describes a configuration-only asset repository whose published surface is reusable workflows, Probot commons-* configs, and Renovate presets — not documentation pages. Per the spec's "audience artefact wins" rule, the audience artefact drove the section bundle (reusable-workflow surface) instead of the docs-only bundle (page moves / removals / translations). Consider formalising a reusable-workflow project type via .github/release-skill-layer.yml or a per-repo bundle in references/project-bundles.md.
• This release touched only the reusable-workflow surface (#​378). The Probot-config and Renovate-preset surfaces consumed by primary audiences D2 and D3 were unchanged, so no sections were produced for them.

v1.1.24

Compare Source

Changes

🧰 Maintenance

• feat(hacs): add reusable-hacs-validate + zip-release asset in release-publish (#​373) @​nolte

---

Project context

Audiences served

• Downstream reusable-workflow consumers → addressed by §Workflow contract changes
• Downstream Probot / Renovate config consumers → addressed by §Probot / Renovate config changes
• Supply-chain / security reviewers → addressed by §Workflow contract changes

Workflow contract changes

• New reusable workflow reusable-hacs-validate.yaml — validates a HACS-distributed Home Assistant custom integration via hacs/action and Home Assistant Core's hassfest. Inputs (all optional, with defaults): category (integration), ignore (""), run_hassfest (true), hacs_action_ref (main). Consume via uses: nolte/gh-plumbing/.github/workflows/reusable-hacs-validate.yaml@<tag>. Documented in docs/{en,de}/workflows/hacs.md. (PR #​373; .github/workflows/reusable-hacs-validate.yaml)
• reusable-release-publish.yml attaches a HACS <domain>.zip asset to the draft before the draft→published flip, gated on the hacs version-bearing-file source. No-op for every non-HACS consumer; existing callers see no behaviour change. (PR #​373; .github/workflows/reusable-release-publish.yml)

Compatibility breaks

• None. Both changes are additive: the new workflow's inputs all carry defaults, and the release-publish asset step is gated and a no-op for non-HACS consumers.

Probot / Renovate config changes

• None in this release.

v1.1.23

Compare Source

Changes

• docs: render icons, surface language switcher, document coverage workflows (#​366) @​nolte
• fix(docs): bump pymdown-extensions to 10.21.3 for Pygments 2.20 compat (#​365) @​nolte

🧰 Maintenance

• feat(mkdocs): add pre-build-command hook to deploy + strict-build reusables (#​372) @​nolte
• chore(ci): give every workflow a speaking display name (#​371) @​nolte
• chore(settings): require docs / MkDocs Build check on develop (#​369) @​nolte
• chore(ci): wire mkdocs --strict build into static CI (#​368) @​nolte
• chore(ci): add reusable mkdocs --strict build workflow (#​367) @​nolte

v1.1.22

Compare Source

Changes

🧰 Maintenance

• feat(workflows): add reusable Node.js coverage workflow with job summary (#​364) @​nolte
• feat(workflows): add reusable Python coverage workflow with job summary (#​363) @​nolte

---

Project context

Audiences served

• Downstream repositories consuming reusable workflows (primary) → §Reusable workflows added, §Input contracts
• Security-conscious downstream users & supply-chain reviewers (secondary) → §Security notes

Probot-config and Renovate-preset consumers are unaffected by this release — no commons-*.yml or renovate-configs/ change landed.

Reusable workflows added

• reusable-python-coverage.yaml — runs pytest with pytest-cov and renders the coverage report into the GitHub Actions job summary, with an optional fail-under gate (#​363, 4fbfe9a).
• reusable-nodejs-coverage.yaml — runs Node.js tests (Vitest or Jest) and renders the Istanbul json-summary coverage report into the job summary, with an optional fail-under gate (#​364, f7c2a87).

Input contracts (for consumers pinning @v1.1.22)

• reusable-python-coverage.yaml: python-version (3.x), working-directory (.), install-command (pip install -e .[test]), coverage-source (.), pytest-args (""), fail-under (0). No secrets required.
• reusable-nodejs-coverage.yaml: node-version (lts/*), working-directory (.), install-command (npm ci), test-command (npm test), coverage-summary-path (coverage/coverage-summary.json), fail-under (0). No secrets required.

Breaking changes

• None. Both workflows are additive; no existing reusable-workflow contract changed.

Security notes

• Both jobs declare least-privilege permissions: contents: read and require no secrets.
• Actions are version-pinned (actions/checkout@v6.0.0, actions/setup-python@v6, actions/setup-node@v6).
• Inputs are consumed only inside the calling (trusted) workflow; the Node renderer passes inputs via env: rather than inline interpolation.

v1.1.21

Compare Source

Changes

🧰 Maintenance

• chore(docs): proofread README and docs prose for grammar and style (#​362) @​nolte

---

Project context

Project type: documentation-only repository. gh-plumbing publishes reusable workflows and Probot/Renovate configs; the MkDocs site documents that surface. This release touches documentation only — no published workflow, Probot, or Renovate contract changed.

Audiences served

• Downstream reusable-workflow consumers → §Published-surface contract
• Downstream Probot-config consumers → §Published-surface contract
• Downstream Renovate-preset consumers → §Published-surface contract
• Maintainer & contributors → §Documentation changes

Published-surface contract

• No changes to .github/workflows/reusable-*, .github/commons-*.yml, or renovate-configs/ since v1.1.20. This tag is a safe pinning target: identical input/secret contracts, so consumers on @v1.1.20 can move to @v1.1.21 with no behavioural change.

Documentation changes

• Proofread the README and the bilingual MkDocs docs — fixed grammar, capitalisation, German address-form consistency, and abbreviation expansions (ff1ffca, #​362). Touches README.md and docs/{de,en}/** only.

v1.1.20

Compare Source

Changes

• feat(renovate): track nolte/vale-style releases via .vale.ini customManager (#​361) @​nolte
• feat(portfolio): add portfolio manifest (reusable CI/CD plumbing capabilities) (#​360) @​nolte

v1.1.19

Compare Source

Changes

• docs(portfolio-app): document Issues:write permission for auto-close (#​359) @​nolte
• docs(portfolio-app): document App registration form fields in detail (#​354) @​nolte
• fix(taskfile): repoint includes from deleted branch to develop (#​353) @​nolte
• docs(portfolio-app): make user-account mode visible in MkDocs site (#​352) @​nolte
• feat(terraform): add user-account mode to portfolio-app module (#​351) @​nolte
• docs(de): mirror #​346 edits into docs/de/ tree (#​348) @​nolte
• docs: overhaul docs/ + README, close catalog drift and 12 Vale alerts (#​346) @​nolte
• feat(docs): publish documentation in EN and DE via mkdocs-static-i18n (#​347) @​nolte
• fix(docs): align mkdocs casing with upstream vocab tightening (#​344) @​nolte
• docs(probot): clarify _extends pinning contract and per-surface strategy (#​343) @​nolte

🧰 Maintenance

• feat(workflows): wire release-drafter and mkdocs through the App-token pattern (#​357) (#​358) @​nolte
• fix(workflows): wire refresh-master through the App-token pattern (#​356) @​nolte
• feat(commons): declare portfolio App as branch-protection bypass actor (Phase 2 of #​330) (#​355) @​nolte
• feat(terraform): add portfolio-app provisioning module (stacked on #​349) (#​350) @​nolte
• feat(workflows): mint portfolio App token in emitting wrappers (Phase 1 of #​330) (#​349) @​nolte

---

Project context

Audiences served

• Downstream repos consuming reusable workflows (D1) → §Reusable workflows
• Downstream repos extending Probot configurations (D2) → §Probot commons configurations
• Repository maintainer (C1) → §Maintainer infrastructure, §Documentation site
• Open-source readers (I2) → §Documentation site
• Security-conscious downstream reviewers (I1) → §Reusable workflows

Reusable workflows

Portfolio-App token plumbing landed in two phases (tracked by #​330):

• reusable-release-cd-refresh-master.yml, reusable-release-publish.yml, reusable-automerge.yaml — emitting wrappers now mint a portfolio-App token so cascaded push / release events run under an App identity (Phase 1: #​349, 67cbd5a)
• reusable-release-cd-refresh-master.yml — refresh-master path wired through the App-token pattern (#​356, 04b9e77)
• reusable-release-drafter.yml, reusable-mkdocs.yaml — release-drafter and mkdocs paths wired through the App-token pattern (Phase 2: #​358, 2d0c883)

Downstream uses: callers do not need to change; the App identity replaces the implicit GITHUB_TOKEN inside the reusable workflows themselves.

Probot commons configurations

commons-settings.yml:

• nolte-portfolio-app is now declared as the branch-protection push-restriction actor on both master and develop (#​355, 2279d2b). Consumers on personal accounts (non-organisation) inherit silently — the Settings App skips restrictions.apps for those repositories.

Renovate presets

No changes to renovate-configs/ in this release.

Maintainer infrastructure (new)

Net-new module that operators need before adopting the App-token pattern downstream:

• terraform/portfolio-app/ — Terraform module that provisions the portfolio GitHub App, with both organisation and personal-account owner modes (#​350, e17369b; #​351, 0dc4f35)

Documentation site

• EN/DE bilingual publication via mkdocs-static-i18n, including the new docs/de/ mirror (#​347, ba1747e; #​348, 5e2c78a)
• Top-level docs and README overhaul; closes 12 Vale alerts and resolves catalog drift (#​346, 70205a6)
• New portfolio App setup pages — organisation and personal-account modes, App registration form fields, the Issues: write permission needed for auto-close (#​352, a227612; #​354, 599b6f4; #​359, 5ebca9f)
• Probot _extends pinning contract and per-surface strategy documented (#​343, a50c14d)
• MkDocs casing aligned with upstream Vale vocabulary tightening (#​344, f07dfd3)

v1.1.18

Compare Source

Changes

🧰 Maintenance

• fix(settings): make develop branch protection portfolio-neutral (#​341) @​nolte
• fix(docker-publish): make latest-tag logic deterministic (#​342) @​nolte

v1.1.17

Compare Source

Changes

🧰 Maintenance

• feat(docker): add reusable Docker build/publish and lint/dry-build workflows (#​339) @​nolte

v1.1.16

Compare Source

Changes

🧰 Maintenance

• chore(static-tests): add workflow_dispatch trigger (#​338) @​nolte
• chore(settings): harden merge strategy to squash-only (#​334) @​nolte
• chore(pre-commit): validate label description length ≤100 chars (#​336) @​nolte
• chore(labels): close drift items in commons-settings and trigger sync (#​335) @​nolte
• chore(settings): trigger Probot sync; document _extends propagation gap (#​333) @​nolte
• chore(automerge): delete source branch after successful squash (#​332) @​nolte
• fix(release): add workflow_dispatch escape hatch to refresh-master (#​329) @​nolte

v1.1.15

Compare Source

Changes

🧰 Maintenance

• fix(release): drop targetCommitish from gh release list calls (#​328) @​nolte
• fix(release-drafter): preserve release-skill-layer project-context block (#​327) @​nolte
• feat(release): add release-publish workflow per release-automation spec (#​326) @​nolte

---

Project context

Audiences served

• Downstream repos consuming reusable workflows → addressed by §Reusable workflows.
• Downstream repos extending Probot configs → addressed by §Shared Probot configs.
• Downstream repos consuming Renovate presets → no changes in this release (see §Renovate presets).
• Repo maintainer → addressed by §Reusable workflows + §Shared Probot configs (release-process automation reduces toil).

Reusable workflows

• New reusable-release-publish.yml per spec/project/release-automation/ §Operational contract: implements draft resolution, target-SHA reachability check, version-bearing-file alignment (auto-detect for claude / python / node / hacs, plus .github/release-automation.yml override), chore(release): <tag> alignment-commit verification, dry_run support, job-summary disclosure, and post-publish sanity checks (#​326, 9e39b97). Follow-up runner-CLI compat fix in #​328 / 6af10e9 (drops targetCommitish from gh release list; resolves it via gh release view per matched tag).
• reusable-release-drafter.yml now preserves the <!-- release-skill-layer:project-context-* --> marker pair across re-runs by capturing the block before release-drafter@v6 rewrites the body and restoring it after, with tag-mismatch and already-restored guards (#​327, b955ede). Same #​328 follow-up unblocked the capture step on the runner CLI.
• Verified end-to-end against draft v1.1.15 itself: dry-run dispatch of release-publish.yml exercised every gate; manual marker injection survived a re-run of release-drafter.yml.

Shared Probot configs

• commons-release-drafter.yml — new autolabeler rule that assigns the release label to PRs whose title starts with chore(release):, plus exclude-labels: [release] so version-alignment PRs no longer appear in the changelog (per release-automation §Release notes categorization). Auto-propagates via _extends: to every consumer of gh-plumbing:.github/commons-release-drafter.yml (#​326, 9e39b97).
• commons-settings.yml — declares the new release label so the autolabeler has a target (#​326, 9e39b97). Probot Settings App syncs it into consumer repos on its next run; observed sync lag in nolte/gh-plumbing itself remains an open workflow-health item.

Renovate presets

• No changes in this release. renovate-configs/common.json is unchanged since v1.1.13.

Documentation site

• No changes in this release. (AUDIENCES.md addition was in v1.1.14.)

Adoption guidance for downstream consumers

• The release-publish.yml wrapper is a new MUST in branching-model §Required GitHub workflows (companion spec edit in nolte/claude-shared#31, merged as ec6d491). Consumers add a workflow_dispatch-only wrapper that calls nolte/gh-plumbing/.github/workflows/reusable-release-publish.yml@v1.1.15 once this release ships.
• The commons-* propagation is automatic — no consumer action needed beyond a Probot Settings sync.

Breaking changes for downstream consumers

• None. All changes are additive: a new optional reusable, an additive autolabeler rule, an additional declared label.

v1.1.14

Compare Source

Changes

• docs: add AUDIENCES.md for downstream consumer audiences (#​325) @​nolte

🧰 Maintenance

• docs: rework docs site and label spec changes (#​322) @​nolte

---

Project context

Audiences served

• Downstream repos consuming reusable workflows → no changes in this release (see §Reusable workflows).
• Downstream repos extending Probot configs → addressed by §Shared Probot configs.
• Downstream repos consuming Renovate presets → no changes in this release (see §Renovate presets).
• Repo maintainer → addressed by §Documentation site.

Shared Probot configs

• commons-boring-cyborg.yml — added spec label routing for paths under spec/**. Auto-applies the spec label to PRs touching spec/** in every repo extending this config (#​322, 260643d).

Reusable workflows

• No changes in this release. Consumers pinning to a previous tag have no compatibility concerns.

Renovate presets

• No changes in this release. renovate-configs/common.json is unchanged since v1.1.13.

Documentation site

• Restructured docs/ taxonomy: docs/features/* retired, replaced by docs/probot/* (settings + labelling) and docs/workflows/* (release, documentation, static-tests). New docs/getting-started/index.md and docs/development/index.md landed (#​322, 260643d).
• mkdocs.yml navigation rework matching the new taxonomy.
• Added AUDIENCES.md at the repository root, declaring the bounded context (configuration-only repo) and eight audience entries across the five spec categories. Read downstream by release-notes-curate to scope project-context bundles in release notes (#​325, 6f6fa96).

Breaking changes for downstream consumers

• None. The spec label addition is additive — repos extending commons-boring-cyborg.yml gain the new routing automatically without action.

v1.1.13

Compare Source

Changes

• Add CLAUDE.md guidance file for Claude Code (#​321) @​nolte

🧰 Maintenance

• chore(labels): add conventional-commits type + area labels (#​324) @​nolte
• fix(automerge): set MERGE_METHOD=squash to match commons policy (#​323) @​nolte

facelessuser/pymdown-extensions (pymdown-extensions)

v11.0

Compare Source

11.0

• BREAK: B64: Restricts relative links to base_path by default. Can be disabled by setting new restrict_path
  option to False. The new root_path can be specified if paths are desired to be restricted to a different
  location separate base_path which is also used as a relative base for image paths.
• NEW: Drop Python 3.9 support.
• FIX: Tabbed: Fix issue where an empty title would cause an exception.

v10.21.3

Compare Source

10.21.3

• FIX: Fix regression that allows a snippet to be loaded outside of the base path using directory traversal when
  restrict_base_path is enabled (the default). Found by @​gistrec.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.