Add the reusable quality-check workflows for C++ and C#

Task: MIL-007#4

Task: MIL-007#5

.gitea/scoped_workflows/publish-wiki.yml

@@ -23,13 +23,12 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
         with:
           repository: TirSystem/github-action
           ref: v1

.gitea/scoped_workflows/sync-github-metadata.yml

@@ -16,10 +16,9 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 5
     steps:
       - name: Fetch the shared script
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
         with:
           repository: TirSystem/github-action
           ref: v1

.gitea/workflows/quality-checks-cpp.yml

@@ -43,7 +43,6 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     env:
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
       STD: ${{ inputs.std }}
@@ -53,10 +52,10 @@ jobs:
       QC_VENV: /tmp/quality-tools
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/quality-checks-csharp.yml

@@ -34,7 +34,6 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     env:
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
       PROJECT: ${{ inputs.project }}
@@ -42,10 +41,10 @@ jobs:
       DOTNET_ROOT: /tmp/dotnet
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/quality-checks.yml

@@ -45,7 +45,6 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     env:
       LANGUAGES: ${{ inputs.languages }}
       WORKING_DIRECTORY: ${{ inputs.working-directory }}
@@ -56,10 +55,10 @@ jobs:
       QC_VENV: /tmp/quality-tools
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
 
       - name: Fetch the shared script
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
         with:
           repository: TirSystem/github-action
           ref: ${{ inputs.tools-ref }}

.gitea/workflows/release.yml

@@ -26,10 +26,9 @@ jobs:
     permissions:
       contents: write
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
 
       - name: Check and publish the release
         env:

.gitea/workflows/sync-milestones.yml

@@ -45,10 +45,9 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     steps:
       - name: Check out the project
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.TOKEN_FOR_GITEA }}
 
@@ -68,11 +67,23 @@ jobs:
           git submodule update --init --recursive --depth=1
 
       - name: Make sure curl and jq are available
-        run: bash framework/scripts/ci-publish-milestones.sh ensure-tools
+        run: |
+          set -euo pipefail
+          if command -v curl >/dev/null && command -v jq >/dev/null; then exit 0; fi
+          sudo_cmd=""
+          if [ "$(id -u)" -ne 0 ]; then sudo_cmd="sudo"; fi
+          $sudo_cmd apt-get update -qq
+          $sudo_cmd apt-get install -y -qq curl jq
 
       - name: Publish accepted milestones
         env:
           GITEA_TOKEN: ${{ secrets.TOKEN_FOR_GITEA }}
           # Empty on a push (a real run); "true" or "false" on a manual run.
           DRY_RUN: ${{ inputs.dry_run }}
-        run: bash framework/scripts/ci-publish-milestones.sh publish
+        run: |
+          set -euo pipefail
+          if [ "$DRY_RUN" = "true" ]; then
+            bash framework/scripts/sync-project.sh --accepted-only
+          else
+            bash framework/scripts/sync-project.sh --accepted-only --apply
+          fi

.gitea/workflows/validate-workflows.yml

@@ -11,10 +11,9 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4
 
       - name: Create a virtual environment and install test dependencies
         run: |

AGENTS.md

@@ -15,49 +15,6 @@ framework.
 the working tree first; edit, summarise and stop. The commit/PR rules below
 apply once a commit has been asked for.
 
-## Related repositories
-
-This project is one of four repositories that change together. Each has one
-job; a change goes to the repository that owns it, not to the one that happens
-to be open.
-
-| Repository | Owns | Consumed by | Pinned or released as |
-| --- | --- | --- | --- |
-| `TirSystem/SQA-QC-Checklists` | the QC checklists (`qc/artifacts/`, `qc/code/`) | `sqa-qc-framework` | a commit, pinned as the `qc/` submodule |
-| `TirSystem/sqa-qc-framework` | the skills, process documents, catalog, templates (`templates/ci/`) and scripts | every project, as the `framework/` submodule | a release tag (`v0.5.2`, ...) |
-| `TirSystem/github-action` | the shared workflows (`quality-checks`, `release`), the scoped workflows (`publish-wiki`, `sync-github-metadata`) and the scripts they call (`tools/`) | every repository of the organisation, by `uses:` and `ref:` | a release tag and a moving major tag (`v1`), made by its release workflow |
-| `TirSystem/sqa-and-qc` | the SQA and AI project management: project artifacts, review records, the traceability matrix | itself | the pull request that merges it |
-
-Where a thing lives:
-
-- A QC checklist, a convention or a template is changed in its owner above and
-  reaches this project by moving the pin. The review record of a checklist is
-  written in the project that reviews it (`docs/sqa/reviews/`), not in the
-  checklist repository.
-- A workflow that other repositories call is changed in `github-action` and
-  released there. A workflow a project copies from `templates/ci/` is changed
-  in the framework; the project updates its copy after the pin moves.
-- A script a workflow needs is a file (`tools/` of `github-action`, or
-  `scripts/` of the framework for the templates), never a long `run:` block
-  (`QC-WF-001` criterion 20).
-- The `framework/` pin here is independent of the one in `sqa-and-qc`; the two
-  may differ, and neither is moved to follow the other without a reason in
-  the pull request.
-
-A change that spans repositories:
-
-1. One pull request per repository, in dependency order: checklists, then
-   framework, then `github-action` and the projects. A pull request names the
-   ones it depends on in its description.
-2. A downstream repository moves a pin only to a merged commit or tag of the
-   upstream, never to an unmerged branch.
-3. Nothing is released or tagged until its dependencies are merged; a release
-   is a separate, deliberate step (the release workflow defaults to a dry run).
-4. A related repository is added to the session as a working directory only
-   when the task needs it. In autonomous mode work in a related repository is
-   inside the accepted plan only if the plan names it; otherwise the run stops
-   and reports.
-
 ## Workflow order
 
 Business Case, Stakeholder Analysis, Project Plan, milestones, tasks synced as

CHANGELOG.md

@@ -32,17 +32,6 @@ Each release lists its changes in these groups, in this order:
   or later (input `dotnet-sdk-version`, default `10.0.401`), with the inputs
   `working-directory`, `project` and `tools-ref`.
 
-### Changed
-
-- Every job has a `timeout-minutes` (5 to 15), so a hung step no longer holds a
-  runner for the host's default limit.
-- `actions/checkout` is referenced by the exact tag `v4.2.2` instead of the
-  moving tag `v4`. No change for callers.
-- The framework pin moves from `v0.5.2` to `v0.6.0`, and the two long `run:`
-  blocks of this repository's own `sync-milestones.yml` call
-  `framework/scripts/ci-publish-milestones.sh`. No change for callers of the
-  shared workflows.
-
 ## [1.1.0] - 2026-10-11
 
 ### Added