Fix reusable workflows installing stale extension versions

UN
27m ago
+420-214

Closes #238

Scheduled sync and closeout callers can update their Dependabot workflow pin while keeping a stale extension input. Both reusable workflows now read their own package.json at job.workflow_sha, normalize the exact release version, and use it when the input is omitted. An explicit exact hold is honored with a warning naming both versions. Public exact-version registry metadata is validated before checkout/setup or any tracker mutation; installed metadata is still verified separately.

For example, workflow 2026.11.14 defaults to extension 2026.11.14; an explicit 2026.10.16 remains a visible deliberate hold. Callers should remove pm-github-version so future workflow pin updates also update the extension. The migration is documented in README and the changelog item title, so it appears in generated release notes. No callers are edited here. docs/workflow-version-callers.md inventories 51 calls across 28 public fleet repositories with exact pins, inputs, and contents blob receipts from the GitHub contents API.

Validation uses extracted real workflow bash, real scratch pm trackers without Git, and the pinned pm installer with local synthetic extension packages. Live HTTP smoke checks confirm default 2026.11.14, explicit 2026.10.16 plus the warning, and unavailable 2099.1.1 refusal before an install version is exported.

Behavioral reverts in disposable copies: default selection 4/4 failures, explicit hold 2/2, warning 2/2, registry preflight 2/2. Restoring the entire old resolver fails all 8 selected issue regressions across both workflows. The fixed implementation is restored and passing.

Local validation: focused tests 64/64 through the pinned pm test --run --progress --timeout 300 (286.7 seconds); workflow-order tests 2/2; typecheck, test typecheck, lint, privacy (9288 objects), docstrings (33 files / 315 declarations), YAML parsing, and diff whitespace checks passed. The first linked run exceeded its default 120-second deadline; the linked timeout is now 600 seconds. Changelog generation and its check pass after the final tracker write. Full npm/Bun release gates and unchanged 100/100/100/100 source coverage are certified by CI. There are no changed authored TypeScript/JavaScript source modules; workflow branches are exercised by the focused tests. actionlint is unavailable locally; both workflows parse as YAML.

PM evidence: pm-github-workflow-own-release.

Supplemental local strict health detects the existing global-extension host skew (pinned pm-cli 2026.11.6 versus global extension host requirement 2026.11.13) and seven advisory stale in-progress items. Tracker integrity passed. No SDK pin or global installation was changed; clean CI verifies the complete gate.

Summary by cubic

Fixes the pm-github sync and closeout workflows installing a stale extension version when callers update their Dependabot workflow pin. Both workflows now read their own package.json at job.workflow_sha and default the extension to that exact release; an explicit exact hold via pm-github-version remains honored but warns when it differs, and the selected version is validated against the public registry before any tracker write.

Migration

  • Callers must move the workflow pin to the release containing this fix and remove pm-github-version in the same change; a pin update alone keeps the stale input as an explicit hold.
  • No caller repositories are edited in this PR; docs/workflow-version-callers.md inventories the 51 existing holds for a follow-up sweep.

Summary by Sourcery

Make reusable workflows derive their default extension version from the release pinned by the workflow and fail closed when that release cannot be validated.

Bug Fixes:

  • Make sync and closeout reusable workflows install the extension version associated with their pinned workflow release instead of silently using stale caller inputs.
  • Validate the selected extension release before checkout, setup, or tracker mutations while retaining independent installed-version verification.

Enhancements:

  • Honor explicit exact extension holds with warnings that identify both the workflow and selected extension versions.
  • Document the caller migration and inventory existing extension-version holds across public fleet repositories.

Documentation:

  • Update the README and changelog with manifest-based version resolution, registry preflight behavior, and caller migration guidance.

Tests:

  • Expand workflow tests to cover manifest resolution, normalization, explicit holds, registry failures, preflight ordering, tracker immutability, and real extension installation.

Chores:

  • Record workflow release ownership and historical PM evidence for the change.