Merge pull request 'Release 2.1.1: changelog entry' (#179 ) from release-2.1.1 into main

Reviewed-on: #179
Release 2.1.1: changelog entry
2026-10-14 11:20:15 +02:00 · 2026-10-14 17:19:27 +08:00 · 2026-10-14 11:17:50 +02:00 · 2026-10-14 17:13:23 +08:00 · 2026-10-14 17:13:20 +08:00 · 2026-10-14 17:09:34 +08:00
44 changed files with 365 additions and 65 deletions
@@ -7,7 +7,7 @@ name: Code metrics
 #       branches: [main]
 #   jobs:
 #     metrics:
-#       uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1
+#       uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2
 #       permissions:
 #         contents: write
 #
@@ -51,7 +51,7 @@ on:
      tools-ref:
        description: "Tag or branch of TirSystem/github-action whose tools/ files are run; pin it to the exact tag together with the workflow"
        type: string
-        default: "v1"
+        default: "v2"

 jobs:
  code-metrics:
@@ -31,7 +31,7 @@ on:
      tools-ref:
        description: "Tag or branch of TirSystem/github-action whose tools/publish_wiki.py is run; pin it to the exact tag together with the workflow"
        type: string
-        default: "v1"
+        default: "v2"
    secrets:
      TOKEN_FOR_GITEA_WIKI:
        description: "Gitea token with write access to the wiki of the calling repository"
@@ -36,7 +36,7 @@ on:
      tools-ref:
        description: "Tag or branch of TirSystem/github-action whose tools/quality-checks-cpp.sh is run; pin it to the exact tag together with the workflow"
        type: string
-        default: "v1"
+        default: "v2"

 jobs:
  quality-checks-cpp:
@@ -27,7 +27,7 @@ on:
      tools-ref:
        description: "Tag or branch of TirSystem/github-action whose tools/quality-checks-csharp.sh is run; pin it to the exact tag together with the workflow"
        type: string
-        default: "v1"
+        default: "v2"

 jobs:
  quality-checks-csharp:
@@ -38,7 +38,7 @@ on:
      tools-ref:
        description: "Tag or branch of TirSystem/github-action whose tools/quality-checks.sh is run; pin it to the exact tag together with the workflow"
        type: string
-        default: "v1"
+        default: "v2"

 jobs:
  quality-checks:
@@ -20,6 +20,21 @@ Each release lists its changes in these groups, in this order:

 ## [Unreleased]

+## [2.1.1] - 2026-10-14
+
+### Fixed
+
+- `code-metrics.yml` could not be called as documented. Its guide, header
+  comment and `tools-ref` default named `v1`, which has neither the workflow nor
+  `tools/code-metrics.sh`: a call at `@v1` created no run, and a call at `@v2`
+  with the defaults failed in "Validate the inputs" (exit 127). The default
+  `tools-ref` of `code-metrics.yml`, `quality-checks.yml`,
+  `quality-checks-cpp.yml`, `quality-checks-csharp.yml` and
+  `publish-wiki-pages.yml` is now the current major (`v2`), defined once in
+  `MAJOR_TAG`, and a test fails when a default differs from it or names a tag
+  without the script. The guides, README and wiki pages call
+  `code-metrics.yml` at `@v2`.
+
 ## [2.1.0] - 2026-10-14

 ### Added
@@ -0,0 +1 @@
+v2
@@ -240,7 +240,7 @@ deactivate Workflow

 ### 🏅 Code metrics

-A reusable workflow that counts the code files and the lines of code (without comment and blank lines) of a repository and publishes them, with the test coverage, as three SVG badges on a `badges` branch, called with `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1` (ADR-0010). It needs `contents: write` and runs no test: an earlier job of the caller produces a Cobertura XML coverage report and uploads it as an artifact ([guide](guides/code-metrics.md)).
+A reusable workflow that counts the code files and the lines of code (without comment and blank lines) of a repository and publishes them, with the test coverage, as three SVG badges on a `badges` branch, called with `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2` (ADR-0010). It needs `contents: write` and runs no test: an earlier job of the caller produces a Cobertura XML coverage report and uploads it as an artifact ([guide](guides/code-metrics.md)).

 #### 🔀 Workflow

@@ -250,7 +250,7 @@ title Code metrics and coverage badges (reusable workflow)

 autonumber

-actor "Calling repository\nuses: ...code-metrics.yml@v1" as Caller
+actor "Calling repository\nuses: ...code-metrics.yml@v2" as Caller
 participant "Gitea Actions\ncode-metrics" as Workflow
 participant "Branch badges\nof the caller" as Branch

@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Reviewed (RC-038): the security impact of installing the tools from PyPI named | [385d2fb] |
 | 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Added the input tools-ref: the shell steps moved to a script file fetched at that ref (RC-051) | [670f0ac] |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Amendment: the default `tools-ref` is the current major tag (MIL-011) | [eaa0e30] |

 Allowed Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by ADR-NNNN`.

@@ -118,6 +118,14 @@ The rules that follow from it:
 - [ADR-0004] — the same pattern of a shared scoped or reusable workflow with an
  explicit gate; this ADR does not change it.

+
+## Amendment (MIL-011)
+
+The default of the input `tools-ref` in the quality-check contract is the current major tag, defined once in the file
+`MAJOR_TAG` of this repository (`v2` from release 2.1.1), and no longer `v1`. A default must
+name a tag that holds the script the workflow runs; a test checks it. Callers at `@v1` are
+not affected: the `v1` tag keeps the `v1` workflow files.
+
 ---

 [MIL-003]: ../milestones/mil-003-quality-checks.md
@@ -126,3 +134,4 @@ The rules that follow from it:
 [ADR-0004]: ./adr-0004-shared-wiki-publishing-opt-in.md
 [385d2fb]: https://git.tirsystem.com/TirSystem/github-action/commit/385d2fb7cb9be1fdc8fd3503d0af624fa38eafc7
 [670f0ac]: https://git.tirsystem.com/TirSystem/github-action/commit/670f0ac469043bb166c84290c0dbf62b4908e3cc
+[eaa0e30]: https://git.tirsystem.com/TirSystem/github-action/commit/eaa0e30beaa097dfeb1c07c814a71d02a6987060
@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-11 | Deprecated | Jens Tirsvad Nielsen | S01 | Initial version | [11cba35] |
 | 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Reviewed (RC-054): abbreviations expanded at first use and the security impact of downloading tools named | [9e7aedd] |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Amendment: the default `tools-ref` is the current major tag (MIL-011) | [eaa0e30] |

 Allowed Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by ADR-NNNN`.

@@ -134,6 +134,14 @@ The rules that follow from it:
 - [ADR-0005] — the contract that this decision extends, unchanged.
 - [ADR-0006] — raising a default tool version is breaking.

+
+## Amendment (MIL-011)
+
+The default of the input `tools-ref` in the C++ and C# quality-check contract is the current major tag, defined once in the file
+`MAJOR_TAG` of this repository (`v2` from release 2.1.1), and no longer `v1`. A default must
+name a tag that holds the script the workflow runs; a test checks it. Callers at `@v1` are
+not affected: the `v1` tag keeps the `v1` workflow files.
+
 ---

 [MIL-007]: ../milestones/mil-007-cpp-csharp-quality-checks.md
@@ -143,3 +151,4 @@ The rules that follow from it:
 [ADR-0006]: ./adr-0006-release-process-and-version-pinning.md
 [11cba35]: https://git.tirsystem.com/TirSystem/github-action/commit/11cba358b83cb7b6624f6b0956ae7b0c112d3692
 [9e7aedd]: https://git.tirsystem.com/TirSystem/github-action/commit/9e7aeddb11c2b41ac893d9f7893d663a53fbe470
+[eaa0e30]: https://git.tirsystem.com/TirSystem/github-action/commit/eaa0e30beaa097dfeb1c07c814a71d02a6987060
@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-13 | Deprecated | Jens Tirsvad Nielsen | S01 | Initial version | [01b9c29] |
 | 2026-10-13 | Accepted | Jens Tirsvad Nielsen | S01 | Review findings fixed (RC-063): the product owner's language is spelled out, the security consequence is named, and the secret passing is recorded as verified | [8c2c52e] |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Amendment: the default `tools-ref` is the current major tag (MIL-011) | [eaa0e30] |

 Allowed Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by ADR-NNNN`.

@@ -93,6 +93,14 @@ The rules that follow from it:
 - [ADR-0004] — its scoped delivery and marker parts are replaced once the
  scoped workflow is removed; its token and safety rules stand.

+
+## Amendment (MIL-011)
+
+The default of the input `tools-ref` in the wiki publishing contract is the current major tag, defined once in the file
+`MAJOR_TAG` of this repository (`v2` from release 2.1.1), and no longer `v1`. A default must
+name a tag that holds the script the workflow runs; a test checks it. Callers at `@v1` are
+not affected: the `v1` tag keeps the `v1` workflow files.
+
 ---

 [MIL-008]: ../milestones/mil-008-wiki-reusable-workflow.md
@@ -102,3 +110,4 @@ The rules that follow from it:
 [ADR-0005]: ./adr-0005-quality-check-contract.md
 [01b9c29]: https://git.tirsystem.com/TirSystem/github-action/commit/01b9c2972b4317bcc590540010aea0eaf7f30014
 [8c2c52e]: https://git.tirsystem.com/TirSystem/github-action/commit/8c2c52ebd2a27e4d0edb4008c31c002718d280fb
+[eaa0e30]: https://git.tirsystem.com/TirSystem/github-action/commit/eaa0e30beaa097dfeb1c07c814a71d02a6987060
@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-14 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version; reviewed (RC-072) | [0dc5132] |
 | 2026-10-14 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | The report reaches the workflow as an artifact of the caller's run (input `coverage-artifact`), because a called workflow runs in its own job; reviewed (RC-073) | [0dc5132] |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Amendment: the default `tools-ref` is the current major tag (MIL-011) | [eaa0e30] |

 Allowed Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by ADR-NNNN`.

@@ -207,6 +207,14 @@ The rules that follow from it:
 - [ADR-0006] — adding a language, or changing a colour or a default, is a
  release under its rules; raising a default threshold is breaking.

+
+## Amendment (MIL-011)
+
+The default of the input `tools-ref` in the code metrics contract is the current major tag, defined once in the file
+`MAJOR_TAG` of this repository (`v2` from release 2.1.1), and no longer `v1`. A default must
+name a tag that holds the script the workflow runs; a test checks it. Callers at `@v1` are
+not affected: the `v1` tag keeps the `v1` workflow files.
+
 ---

 [MIL-010]: ../milestones/mil-010-code-metrics-badges.md
@@ -215,3 +223,4 @@ The rules that follow from it:
 [ADR-0005]: ./adr-0005-quality-check-contract.md
 [ADR-0006]: ./adr-0006-release-process-and-version-pinning.md
 [0dc5132]: https://git.tirsystem.com/TirSystem/github-action/commit/0dc5132a2ea419ba05035ee3594cec63335c240b
+[eaa0e30]: https://git.tirsystem.com/TirSystem/github-action/commit/eaa0e30beaa097dfeb1c07c814a71d02a6987060
@@ -11,7 +11,7 @@ each document lives in *this* project and the next version to use.
 | SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 |
 | PP | Project Plan | docs/project-plan.md | 002 |
 | MIL | Milestone / Gateway | docs/milestones/*.md | 012 |
-| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 077 |
+| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 079 |
 | TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 |
 | ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0011 |
 | UCD | Use Case Diagram | docs/use-case-diagram.md | 002 |
@@ -9,7 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-14 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version; reviewed (RC-076), accepted by the author in chat as stand-in for S01 | [02e3794] |
+| 2026-10-14 | Accepted | Jens Tirsvad Nielsen | S01 | Added the results of task 1 (reproduction and the defaults of the five workflows); reviewed (RC-077), accepted by the AI as stand-in for S01 in autonomous mode | [e11c43f] |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Added the results of tasks 2 to 5 (the fix, the test, the guides, the run on the instance); reviewed in RC-078, the release follows | [a6892c3] |

 ---

@@ -77,6 +78,35 @@ A patch release (`2.1.1`, [ADR-0006]) in which: the default `tools-ref` of every
 | 8 | Add MIL-011 to the Project Plan | Add the schedule row, the Gantt bar, the scope entry and the dependency to [PP-001], and its review to the traceability matrix. | No | |
 | 9 | Review | Record `RC-*` for this milestone, the workflow and tests, and the guides, each with a verdict. | No | |

+## Verification results
+
+Task 1 was run on 2026-10-14 with the throwaway branch `verify-code-metrics-defaults` of `TirSystem/github-action`. It calls `code-metrics.yml` at the two refs a caller could use, with every input at its default.
+
+| Call | Result | Evidence |
+| --- | --- | --- |
+| `...code-metrics.yml@v2`, defaults | Fails in the step "Validate the inputs": `bash: shared-scripts/tools/code-metrics.sh: No such file or directory`, exit code 127. The input `tools-ref` is `v1`, so the scripts are fetched from `v1`. | run 1499, job 1638 |
+| `...code-metrics.yml@v1`, defaults | No run is created at all, and no error is shown: two pushes of a workflow that calls it (once with the `@v2` job beside it, once alone) made no run in over a minute, while the push of the `@v2` call alone made one | commits `5654905` and `46e752d` (no run), `9a17868` (run 1499) |
+
+The defaults of the five reusable workflows at `v2.1.0` (`v1` is `1.2.2`, `v2` is `2.1.0`):
+
+| Workflow | Default `tools-ref` | Script it runs | At the default | At `v2` |
+| --- | --- | --- | --- | --- |
+| `code-metrics.yml` | `v1` | `tools/code-metrics.sh` | **absent** | present |
+| `quality-checks.yml` | `v1` | `tools/quality-checks.sh` | present | present |
+| `quality-checks-cpp.yml` | `v1` | `tools/quality-checks-cpp.sh` | present | present |
+| `quality-checks-csharp.yml` | `v1` | `tools/quality-checks-csharp.sh` | present | present |
+| `publish-wiki-pages.yml` | `v1` | `tools/publish_wiki.py` | present | present |
+
+Only `code-metrics.yml` is broken. The other four resolve, but a caller at `@v2` runs their scripts from `1.2.2` and not from `2.1.0`; `tools/publish_wiki.py` changed in `2.0.0` (it requires `WIKI_PRUNE` and no longer reads a marker). Whether that is a defect is decided in task 2.
+
+
+Tasks 2 to 5 were done on 2026-10-14 on the branch `mil-011-fix`:
+
+- **Fix (task 2):** the file `MAJOR_TAG` holds the current major (`v2`); the default `tools-ref` of the five reusable workflows is `v2`, and the header comment of `code-metrics.yml` calls it at `@v2`. The four workflows other than `code-metrics.yml` followed the older major only by default and changed no behaviour for a caller at `@v1`; for a caller at `@v2` the scripts now come from the same major as the workflow.
+- **Test (task 3):** `tests/test_tools_ref.py` ties `MAJOR_TAG` to the highest major of the changelog and checks every reusable workflow's default and script. With `default: "v1"` seeded in `code-metrics.yml` three tests failed; restored, they pass. The suite passes (540 tests).
+- **Guides (task 4):** `guides/code-metrics.md`, `guides/upgrading.md`, the three quality-check guides, `README.md` and the wiki pages in English, Danish and Bahasa Malaysia; the amendments of ADR-0005, ADR-0008, ADR-0009 and ADR-0010. A search for `code-metrics.yml@v1` finds none.
+- **Instance (task 5):** the workflow at `@mil-011-fix` with every input at its default except `badges-branch` ran as run 1509 (job 1649): `tools-ref` resolved to `v2`, the scripts were fetched, and the badges were committed to `badges-verify` (commit `041d991`).
+
 ---

 [BC-001]: ../business-case.md
@@ -85,4 +115,5 @@ A patch release (`2.1.1`, [ADR-0006]) in which: the default `tools-ref` of every
 [ADR-0010]: ../adr/adr-0010-code-metrics-badges-contract.md
 [ADR-0006]: ../adr/adr-0006-release-process-and-version-pinning.md
 [PP-001]: ../project-plan.md
-[02e3794]: https://git.tirsystem.com/TirSystem/github-action/commit/02e3794d7b05799af2544ca303c99271da788e82
+[e11c43f]: https://git.tirsystem.com/TirSystem/github-action/commit/e11c43f0a41e7dd9647f7804947d6e464407a597
+[a6892c3]: https://git.tirsystem.com/TirSystem/github-action/commit/a6892c372aca9f2e12826a4c3b260290a0656ecb
@@ -0,0 +1,50 @@
+# Review Record: MIL-011 task 1 results (delta)
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-077 |
+| CrossReference | [MIL-011], [RC-076], [QC-MIL-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-14 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version; accepted | [eaa0e30] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [MIL-011], the Version History row and the section "Verification results" added in project pull request 177 (the results of task 1)
+- Checklist used: [QC-MIL-001] (criteria 1, 2 and 4 re-scored; 3, 5 and 6 not affected)
+- Scope: delta re-review, reason: the milestone changed in content after [RC-076]
+- Language and domain: n/a (technical type)
+- Mode: autonomous, not independent (the reviewer is `AI as stand-in for S01`; the user chose autonomous mode in chat on 2026-10-14 and the accepted plan is [MIL-011])
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | A concrete deliverable is defined for every gate | Pass | `## Deliverable` is unchanged and task 1 has its record: the results name the run (1499, job 1638), the commits and the five workflows. |
+| 2 | Explicit Go/No-Go criteria are stated for each gate | Pass | Criterion 1 ("reproduced and recorded") and criterion 2 ("all five checked and listed") are met by the section; the evidence was read from the run's log (`bash: shared-scripts/tools/code-metrics.sh: No such file or directory`, exit code 127) and from `git cat-file` per tag. |
+| 3 | Dependencies on other milestones are explicitly mapped | N-A | Not affected. |
+| 4 | Each milestone is traceable to a Business Case objective or KPI | Pass | Unchanged (O5). |
+| 5 | Milestone owner and approving reviewer are identified | N-A | Not affected. |
+| 6 | Milestone has a defined target date consistent with project constraints | N-A | Not affected (2026-10-23). |
+
+## Overall Verdict
+
+Go - the results are true to the evidence: the failure at `@v2` is in the log of job 1638, and the absence of a run at `@v1` was observed on two pushes (`5654905`, `46e752d`) against a run for the `@v2` call alone (`9a17868`). The finding that the other four workflows resolve but follow the older major is stated as a question for task 2, not as a defect. The AI accepts the row as stand-in for S01; there is no independent reader and the decision stays open to challenge in the run summary.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | - | - |
+
+---
+
+[MIL-011]: ../../milestones/mil-011-code-metrics-default-tools-ref.md
+[RC-076]: ./rc-076-mil-011-plan.md
+[QC-MIL-001]: ../../../framework/qc/artifacts/qc-milestones-gateways.md
+[eaa0e30]: https://git.tirsystem.com/TirSystem/github-action/commit/eaa0e30beaa097dfeb1c07c814a71d02a6987060
@@ -0,0 +1,56 @@
+# Review Record: MIL-011 fix of the tools-ref defaults
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-078 |
+| CrossReference | [MIL-011], [RC-077] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version: Go for tasks 2 to 5, criteria 6 to 8 open until the release | [a6892c3] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: the deliverables of tasks 2 to 5 of [MIL-011], branch `mil-011-fix` at `eaa0e30` (the five workflows, `MAJOR_TAG`, `tests/test_tools_ref.py` and the three changed tests, the guides, README and wiki pages in three languages, the amended ADR-0005, ADR-0008, ADR-0009 and ADR-0010, the changelog)
+- Checklist used: the eight Go/No-Go criteria of [MIL-011]; for the workflow files and the tests, the review is the pass of the repository's own test suite and the validation workflow
+- Scope: full review of the deliverables before the release (task 6); the milestone itself was reviewed in [RC-076] and [RC-077]
+- Language and domain: n/a (technical deliverables)
+- Mode: autonomous, not independent (the reviewer is `AI as stand-in for S01`)
+
+## Checklist Results
+
+Go/No-Go criteria of [MIL-011]:
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | The defect is reproduced before the fix | Pass | Run 1499 (job 1638): `bash: shared-scripts/tools/code-metrics.sh: No such file or directory`, exit code 127; a call at `@v1` creates no run. Recorded in [MIL-011], "Verification results". |
+| 2 | Every default `tools-ref` names a tag that holds the script | Pass | Listed per workflow in [MIL-011]. After the fix all five name `v2` (`MAJOR_TAG`), and the script of each is in `v2`; `test_default_tools_ref_is_the_current_major_and_holds_the_script` checks the tag with `git cat-file`. |
+| 3 | The default is derived and a test fails on a seeded wrong default | Pass | `MAJOR_TAG` is the one definition, and a test ties it to the highest major of the changelog. With `default: "v1"` seeded in `code-metrics.yml` three tests failed ("default tools-ref is 'v1', the current major is 'v2'"); restored, 13 passed. The full suite passes: 540 tests. |
+| 4 | No guide, comment, README or wiki page tells a caller to use `@v1` for `code-metrics.yml` | Pass | `grep -rn 'code-metrics.yml@v1' guides README.md docs/wiki .gitea` finds 0; no `default: "v1"` is left in `.gitea/workflows`. The accepted ADRs keep their original text and have an amendment; the body of ADR-0010 still reads "default `v1`" above the amendment, which is how amendments are read. |
+| 5 | A call with the documented defaults runs on the instance and commits the badges | Pass | Run 1509 (job 1649) of the throwaway branch `verify-code-metrics-defaults`: the workflow at `@mil-011-fix`, `tools-ref` resolved to `v2` (scripts fetched at `16faffa`), "Validate", "Count" and "Publish the badges" succeeded, branch `badges-verify` has the commit `041d991` "Update code metrics badges [skip ci]", and the raw SVG answers `200 image/svg+xml`. Only `badges-branch` was set, to keep the verification away from `badges`. |
+| 6 | The release is a patch (2.1.1); `v2` moves to it, `v1` is untouched | Open | Not released: task 6. Re-scored in the record after the release. |
+| 7 | The framework `Badges` page no longer tells a caller to set `tools-ref` | Open | Task 7, after the release. |
+| 8 | Reviewed | Open | This record covers criteria 1 to 5; the record after the release closes 6 to 8. |
+
+## Overall Verdict
+
+Go for the deliverables of tasks 2 to 5: criteria 1 to 5 pass on the evidence above. Criteria 6 to 8 are open only because the steps that satisfy them (the release and the framework page) come after this review; nothing in the deliverables is missing. The AI accepts the record as stand-in for S01 in autonomous mode; there is no independent reader and the decision stays open to challenge in the run summary.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| Release 2.1.1 and re-score criteria 6 and 8 | S05 | 2026-10-23 |
+| Remove the `tools-ref` workaround from the framework `Badges` page and re-score criterion 7 | S05 | 2026-10-23 |
+| Delete the throwaway branch `verify-code-metrics-defaults` after the results are merged | S05 | 2026-10-23 |
+
+---
+
+[MIL-011]: ../../milestones/mil-011-code-metrics-default-tools-ref.md
+[RC-076]: ./rc-076-mil-011-plan.md
+[RC-077]: ./rc-077-mil-011-task-1-results.md
+[a6892c3]: https://git.tirsystem.com/TirSystem/github-action/commit/a6892c372aca9f2e12826a4c3b260290a0656ecb
@@ -9,8 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Added RC-075 (MIL-010 outcome, release 2.1.0) | [aa20e56] |
 | 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Added MIL-011 and RC-076 (fix the defaults of the code metrics workflow) | [3d7a9df] |
+| 2026-10-14 | Proposed | Jens Tirsvad Nielsen | S01 | Added RC-077 and RC-078 (MIL-011 task 1 results, and the fix of the defaults) | [a6892c3] |

 ---

@@ -44,7 +44,7 @@ updated whenever an artifact instance is created or reviewed.
 | [MIL-008] | MIL | [BC-001], [PP-001], [MIL-006], [ADR-0004] | [MIL-009] | [RC-060], [RC-061] |
 | [MIL-009] | MIL | [BC-001], [PP-001], [MIL-008], [ADR-0004], [ADR-0006], [ADR-0009] | - | [RC-064], [RC-066] |
 | [MIL-010] | MIL | [BC-001], [PP-001], [MIL-003], [MIL-004] | [MIL-011] | [RC-068], [RC-074], [RC-075] |
-| [MIL-011] | MIL | [BC-001], [PP-001], [MIL-010], [ADR-0006], [ADR-0010] | - | [RC-076] |
+| [MIL-011] | MIL | [BC-001], [PP-001], [MIL-010], [ADR-0006], [ADR-0010] | - | [RC-076], [RC-077], [RC-078] |
 | [RC-007] | RC | [MIL-004] | - | - |
 | [RC-008] | RC | [BC-001] | - | - |
 | [RC-009] | RC | [PP-001] | - | - |
@@ -134,6 +134,8 @@ updated whenever an artifact instance is created or reviewed.
 | [RC-074] | RC | [MIL-010] | - | - |
 | [RC-075] | RC | [MIL-010] | - | - |
 | [RC-076] | RC | [MIL-011], [PP-001] | - | - |
+| [RC-077] | RC | [MIL-011] | - | - |
+| [RC-078] | RC | [MIL-011] | - | - |

 ## Coverage Notes

@@ -245,6 +247,8 @@ updated whenever an artifact instance is created or reviewed.
 [RC-074]: ./reviews/rc-074-mil-010-results.md
 [RC-075]: ./reviews/rc-075-mil-010-outcome.md
 [RC-076]: ./reviews/rc-076-mil-011-plan.md
+[RC-077]: ./reviews/rc-077-mil-011-task-1-results.md
+[RC-078]: ./reviews/rc-078-mil-011-fix.md
 [ADR-0008]: ../adr/adr-0008-cpp-csharp-quality-check-contract.md
 [ADR-0009]: ../adr/adr-0009-wiki-publishing-reusable-workflow.md
 [ADR-0007]: ../adr/adr-0007-release-publish-destination.md
@@ -254,5 +258,5 @@ updated whenever an artifact instance is created or reviewed.
 [ADR-0006]: ../adr/adr-0006-release-process-and-version-pinning.md
 [UC-005]: ../uc-005/uc.md
 [ADR-0005]: ../adr/adr-0005-quality-check-contract.md
-[aa20e56]: https://git.tirsystem.com/TirSystem/github-action/commit/aa20e56110f4c2fab91a8432ba008ee8300926a2
 [3d7a9df]: https://git.tirsystem.com/TirSystem/github-action/commit/3d7a9df3a3a4712dcc5214a71b0569d90122bf4e
+[a6892c3]: https://git.tirsystem.com/TirSystem/github-action/commit/a6892c372aca9f2e12826a4c3b260290a0656ecb
@@ -1,4 +1,4 @@
-<!-- translation of CodeMetrics.md, source sha256 edfcb7cf99c9 -->
+<!-- translation of CodeMetrics.md, source sha256 03134e97a78a -->

 > Dette er en oversættelse af [`CodeMetrics`](CodeMetrics). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.

@@ -34,7 +34,7 @@ jobs:
    needs: tests
    permissions:
      contents: write
-    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1
+    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2
    with:
      coverage-artifact: coverage
      coverage-report: coverage.xml
@@ -49,7 +49,7 @@ jobs:
 | `coverage-warn` | `60` | Dækning i procent, under hvilken badget er rødt |
 | `coverage-good` | `80` | Dækning i procent, fra hvilken badget er grønt; derimellem er det gult |
 | `badges-branch` | `badges` | Gren, der indeholder badge-filerne; den oprettes, hvis den ikke findes |
-| `tools-ref` | `v1` | Tag eller gren i `TirSystem/github-action`, hvorfra scripts i `tools/` hentes |
+| `tools-ref` | `v2` | Tag eller gren i `TirSystem/github-action`, hvorfra scripts i `tools/` hentes |

 Reference workflowet ved major-tagget (`@v1`) eller ved et præcist tag, aldrig ved `main`. Et kald ved et præcist tag er kun fuldt fastlåst, når `tools-ref` navngiver samme tag. Se opgraderingsvejledningen. Start workflowet kun ved push til din standardgren: badge-committet har `[skip ci]` og laves med kørslens token, som ikke starter en ny kørsel, men en trigger på alle grene ville skrive ét commit pr. gren.

@@ -40,7 +40,7 @@ jobs:
    needs: tests
    permissions:
      contents: write
-    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1
+    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2
    with:
      coverage-artifact: coverage
      coverage-report: coverage.xml
@@ -55,9 +55,9 @@ jobs:
 | `coverage-warn` | `60` | Coverage in percent below which the badge is red |
 | `coverage-good` | `80` | Coverage in percent from which the badge is green; in between it is yellow |
 | `badges-branch` | `badges` | Branch that holds the badge files; it is created when it does not exist |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the scripts in `tools/` are fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the scripts in `tools/` are fetched |

-Reference the workflow at the major tag (`@v1`) or at an exact tag, never at
+Reference the workflow at the major tag (`@v2`) or at an exact tag, never at
 `main`. A call at an exact tag is pinned completely only when `tools-ref` names
 the same tag. See the upgrade guide. Start the workflow on pushes to your
 default branch only: the badge commit carries `[skip ci]` and is made with the
@@ -1,4 +1,4 @@
-<!-- translation of CodeMetrics.md, source sha256 edfcb7cf99c9 -->
+<!-- translation of CodeMetrics.md, source sha256 03134e97a78a -->

 > Ini ialah terjemahan [`CodeMetrics`](CodeMetrics). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.

@@ -34,7 +34,7 @@ jobs:
    needs: tests
    permissions:
      contents: write
-    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1
+    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2
    with:
      coverage-artifact: coverage
      coverage-report: coverage.xml
@@ -49,7 +49,7 @@ jobs:
 | `coverage-warn` | `60` | Liputan dalam peratus di bawahnya lencana berwarna merah |
 | `coverage-good` | `80` | Liputan dalam peratus yang bermulanya lencana berwarna hijau; di antaranya kuning |
 | `badges-branch` | `badges` | Cabang yang memegang fail lencana; ia dicipta jika tidak wujud |
-| `tools-ref` | `v1` | Tag atau cabang `TirSystem/github-action` tempat skrip dalam `tools/` diambil |
+| `tools-ref` | `v2` | Tag atau cabang `TirSystem/github-action` tempat skrip dalam `tools/` diambil |

 Rujuk aliran kerja pada tag major (`@v1`) atau pada tag tepat, jangan sekali-kali pada `main`. Panggilan pada tag tepat hanya tersemat sepenuhnya apabila `tools-ref` menamakan tag yang sama. Lihat panduan menaik taraf. Mulakan aliran kerja pada push ke cabang lalai anda sahaja: commit lencana membawa `[skip ci]` dan dibuat dengan token larian, yang tidak memulakan larian lain, tetapi pencetus pada setiap cabang akan menulis satu commit bagi setiap cabang.

@@ -1,4 +1,4 @@
-<!-- translation of Home.md, source sha256 810981fb9bc8 -->
+<!-- translation of Home.md, source sha256 9b967f9e1aff -->

 > Dette er en oversættelse af [`Home`](Home). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.

@@ -237,7 +237,7 @@ deactivate Workflow

 ### Kodemålinger og dækningsbadges

-Et genbrugeligt workflow, der tæller kodefilerne og kodelinjerne (uden kommentar- og tomme linjer) i et repository og udgiver dem sammen med testdækningen som tre SVG-badges på en `badges`-gren, kaldt med `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1` (ADR-0010). Det kræver `contents: write` og kører ingen test: et tidligere job hos kalderen frembringer en dækningsrapport i Cobertura XML-format og uploader den som artefakt ([vejledning](CodeMetrics.da)).
+Et genbrugeligt workflow, der tæller kodefilerne og kodelinjerne (uden kommentar- og tomme linjer) i et repository og udgiver dem sammen med testdækningen som tre SVG-badges på en `badges`-gren, kaldt med `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2` (ADR-0010). Det kræver `contents: write` og kører ingen test: et tidligere job hos kalderen frembringer en dækningsrapport i Cobertura XML-format og uploader den som artefakt ([vejledning](CodeMetrics.da)).

 #### Workflow

@@ -247,7 +247,7 @@ title Code metrics and coverage badges (reusable workflow)

 autonumber

-actor "Calling repository\nuses: ...code-metrics.yml@v1" as Caller
+actor "Calling repository\nuses: ...code-metrics.yml@v2" as Caller
 participant "Gitea Actions\ncode-metrics" as Workflow
 participant "Branch badges\nof the caller" as Branch

@@ -237,7 +237,7 @@ deactivate Workflow

 ### Code metrics

-A reusable workflow that counts the code files and the lines of code (without comment and blank lines) of a repository and publishes them, with the test coverage, as three SVG badges on a `badges` branch, called with `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1` (ADR-0010). It needs `contents: write` and runs no test: an earlier job of the caller produces a Cobertura XML coverage report and uploads it as an artifact ([guide](CodeMetrics)).
+A reusable workflow that counts the code files and the lines of code (without comment and blank lines) of a repository and publishes them, with the test coverage, as three SVG badges on a `badges` branch, called with `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2` (ADR-0010). It needs `contents: write` and runs no test: an earlier job of the caller produces a Cobertura XML coverage report and uploads it as an artifact ([guide](CodeMetrics)).

 #### Workflow

@@ -247,7 +247,7 @@ title Code metrics and coverage badges (reusable workflow)

 autonumber

-actor "Calling repository\nuses: ...code-metrics.yml@v1" as Caller
+actor "Calling repository\nuses: ...code-metrics.yml@v2" as Caller
 participant "Gitea Actions\ncode-metrics" as Workflow
 participant "Branch badges\nof the caller" as Branch

@@ -1,4 +1,4 @@
-<!-- translation of Home.md, source sha256 810981fb9bc8 -->
+<!-- translation of Home.md, source sha256 9b967f9e1aff -->

 > Ini ialah terjemahan [`Home`](Home). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.

@@ -237,7 +237,7 @@ deactivate Workflow

 ### Metrik kod dan lencana liputan

-Aliran kerja boleh guna semula yang mengira fail kod dan baris kod (tanpa baris komen dan baris kosong) sesebuah repositori dan menerbitkannya, bersama liputan ujian, sebagai tiga lencana SVG pada cabang `badges`, dipanggil dengan `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1` (ADR-0010). Ia memerlukan `contents: write` dan tidak menjalankan sebarang ujian: kerja yang lebih awal oleh pemanggil menghasilkan laporan liputan format Cobertura XML dan memuat naiknya sebagai artifak ([panduan](CodeMetrics.ms)).
+Aliran kerja boleh guna semula yang mengira fail kod dan baris kod (tanpa baris komen dan baris kosong) sesebuah repositori dan menerbitkannya, bersama liputan ujian, sebagai tiga lencana SVG pada cabang `badges`, dipanggil dengan `uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2` (ADR-0010). Ia memerlukan `contents: write` dan tidak menjalankan sebarang ujian: kerja yang lebih awal oleh pemanggil menghasilkan laporan liputan format Cobertura XML dan memuat naiknya sebagai artifak ([panduan](CodeMetrics.ms)).

 #### Aliran kerja

@@ -247,7 +247,7 @@ title Code metrics and coverage badges (reusable workflow)

 autonumber

-actor "Calling repository\nuses: ...code-metrics.yml@v1" as Caller
+actor "Calling repository\nuses: ...code-metrics.yml@v2" as Caller
 participant "Gitea Actions\ncode-metrics" as Workflow
 participant "Branch badges\nof the caller" as Branch

@@ -1,4 +1,4 @@
-<!-- translation of QualityChecksCSharp.md, source sha256 36e34031e0b9 -->
+<!-- translation of QualityChecksCSharp.md, source sha256 a024fde8d1b3 -->

 > Dette er en oversættelse af [`QualityChecksCSharp`](QualityChecksCSharp). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.

@@ -32,7 +32,7 @@ jobs:
 | `working-directory` | `.` | Mappe, relativt til repositoryets rod, hvis filer kontrolleres |
 | `project` | tom | Solution- eller projektfil, relativt til `working-directory`; tom bruger den eneste sporede `*.sln` eller `*.slnx`, ellers den eneste `*.csproj`, der er sporet dér |
 | `dotnet-sdk-version` | `10.0.401` | Præcis version af .NET SDK, 10 eller nyere; en kanal som `10.0`, et interval og en version under 10 afvises |
-| `tools-ref` | `v1` | Tag eller gren i `TirSystem/github-action`, hvorfra scriptet `tools/quality-checks-csharp.sh` hentes |
+| `tools-ref` | `v2` | Tag eller gren i `TirSystem/github-action`, hvorfra scriptet `tools/quality-checks-csharp.sh` hentes |

 Henvis til workflowet ved major-tagget (`@v1`) eller et præcist tag, aldrig ved `main`. Et kald ved et præcist tag er kun fuldt fastlåst, når `tools-ref` angiver samme tag. Se opgraderingsvejledningen. SDK-versionen er præcis: at hæve standardværdien er en ny udgivelse af dette repository, ikke en stille ændring.

@@ -36,7 +36,7 @@ jobs:
 | `working-directory` | `.` | Directory, relative to the repository root, whose files are checked |
 | `project` | empty | Solution or project file, relative to `working-directory`; empty uses the single `*.sln` or `*.slnx`, else the single `*.csproj`, that is tracked there |
 | `dotnet-sdk-version` | `10.0.401` | Exact version of the .NET SDK, 10 or later; a channel such as `10.0`, a range and a version below 10 are refused |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-csharp.sh` is fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-csharp.sh` is fetched |

 Reference the workflow at the major tag (`@v1`) or at an exact tag, never at
 `main`. A call at an exact tag is pinned completely only when `tools-ref` names
@@ -1,4 +1,4 @@
-<!-- translation of QualityChecksCSharp.md, source sha256 36e34031e0b9 -->
+<!-- translation of QualityChecksCSharp.md, source sha256 a024fde8d1b3 -->

 > Ini ialah terjemahan [`QualityChecksCSharp`](QualityChecksCSharp). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.

@@ -32,7 +32,7 @@ jobs:
 | `working-directory` | `.` | Direktori, relatif kepada akar repositori, yang failnya disemak |
 | `project` | kosong | Fail solution atau projek, relatif kepada `working-directory`; kosong menggunakan satu-satunya `*.sln` atau `*.slnx` yang dijejaki, jika tiada maka satu-satunya `*.csproj` yang dijejaki di situ |
 | `dotnet-sdk-version` | `10.0.401` | Versi tepat .NET SDK, 10 atau lebih baharu; saluran seperti `10.0`, julat dan versi di bawah 10 ditolak |
-| `tools-ref` | `v1` | Tag atau cabang `TirSystem/github-action` tempat skrip `tools/quality-checks-csharp.sh` diambil |
+| `tools-ref` | `v2` | Tag atau cabang `TirSystem/github-action` tempat skrip `tools/quality-checks-csharp.sh` diambil |

 Rujuk aliran kerja pada tag major (`@v1`) atau pada tag tepat, jangan sekali-kali pada `main`. Panggilan pada tag tepat hanya disematkan sepenuhnya apabila `tools-ref` menamakan tag yang sama. Lihat panduan naik taraf. Versi SDK adalah tepat: menaikkan nilai lalai ialah keluaran baharu repositori ini, bukan perubahan senyap.

@@ -1,4 +1,4 @@
-<!-- translation of QualityChecksCpp.md, source sha256 6faa57183a11 -->
+<!-- translation of QualityChecksCpp.md, source sha256 29d1e1390494 -->

 > Dette er en oversættelse af [`QualityChecksCpp`](QualityChecksCpp). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.

@@ -34,7 +34,7 @@ jobs:
 | `compile-commands-dir` | tom | Mappe, relativt til repositoryets rod, med en `compile_commands.json`, som din pipeline har bygget før kaldet; når den er sat, bruger clang-tidy den og ignorerer `std` |
 | `clang-format-version` | `23.1.3` | Præcis version af pakken clang-format |
 | `clang-tidy-version` | `22.1.8` | Præcis version af pakken clang-tidy |
-| `tools-ref` | `v1` | Tag eller gren i `TirSystem/github-action`, hvorfra scriptet `tools/quality-checks-cpp.sh` hentes |
+| `tools-ref` | `v2` | Tag eller gren i `TirSystem/github-action`, hvorfra scriptet `tools/quality-checks-cpp.sh` hentes |

 Henvis til workflowet ved major-tagget (`@v1`) eller et præcist tag, aldrig ved `main`. Et kald ved et præcist tag er kun fuldt fastlåst, når `tools-ref` angiver samme tag. Se opgraderingsvejledningen. Værktøjsversionerne er præcise: en nyere version af et værktøj er en ny udgivelse af dette repository, ikke en stille ændring.

@@ -37,7 +37,7 @@ jobs:
 | `compile-commands-dir` | empty | Directory, relative to the repository root, with a `compile_commands.json` that your pipeline built before the call; when set, clang-tidy uses it and ignores `std` |
 | `clang-format-version` | `23.1.3` | Exact version of the clang-format package |
 | `clang-tidy-version` | `22.1.8` | Exact version of the clang-tidy package |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-cpp.sh` is fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-cpp.sh` is fetched |

 Reference the workflow at the major tag (`@v1`) or at an exact tag, never at
 `main`. A call at an exact tag is pinned completely only when `tools-ref` names
@@ -1,4 +1,4 @@
-<!-- translation of QualityChecksCpp.md, source sha256 6faa57183a11 -->
+<!-- translation of QualityChecksCpp.md, source sha256 29d1e1390494 -->

 > Ini ialah terjemahan [`QualityChecksCpp`](QualityChecksCpp). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.

@@ -34,7 +34,7 @@ jobs:
 | `compile-commands-dir` | kosong | Direktori, relatif kepada akar repositori, dengan `compile_commands.json` yang dibina oleh saluran paip anda sebelum panggilan; apabila ditetapkan, clang-tidy menggunakannya dan mengabaikan `std` |
 | `clang-format-version` | `23.1.3` | Versi tepat pakej clang-format |
 | `clang-tidy-version` | `22.1.8` | Versi tepat pakej clang-tidy |
-| `tools-ref` | `v1` | Tag atau cabang `TirSystem/github-action` tempat skrip `tools/quality-checks-cpp.sh` diambil |
+| `tools-ref` | `v2` | Tag atau cabang `TirSystem/github-action` tempat skrip `tools/quality-checks-cpp.sh` diambil |

 Rujuk aliran kerja pada tag major (`@v1`) atau pada tag tepat, jangan sekali-kali pada `main`. Panggilan pada tag tepat hanya disematkan sepenuhnya apabila `tools-ref` menamakan tag yang sama. Lihat panduan naik taraf. Versi alat adalah tepat: versi alat yang lebih baharu ialah keluaran baharu repositori ini, bukan perubahan senyap.

@@ -1,4 +1,4 @@
-<!-- translation of QualityChecksPythonShell.md, source sha256 2a0c9d43c77d -->
+<!-- translation of QualityChecksPythonShell.md, source sha256 ef64b44b88ad -->

 > Dette er en oversættelse af [`QualityChecksPythonShell`](QualityChecksPythonShell). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.

@@ -35,7 +35,7 @@ jobs:
 | `mypy-version` | `1.11.2` | Version af mypy |
 | `shellcheck-py-version` | `0.10.0.1` | Version af pakken shellcheck-py (ShellCheck 0.10.0) |
 | `shfmt-py-version` | `3.11.0.2` | Version af pakken shfmt-py (shfmt 3.11.0) |
-| `tools-ref` | `v1` | Tag eller gren i `TirSystem/github-action`, hvorfra scriptet `tools/quality-checks.sh` hentes |
+| `tools-ref` | `v2` | Tag eller gren i `TirSystem/github-action`, hvorfra scriptet `tools/quality-checks.sh` hentes |

 Henvis til workflowet ved major-tagget (`@v1`) eller et præcist tag (`@v1.0.0`), aldrig ved `main` og aldrig ved en pull requests gren: den gren slettes, når pull requesten flettes, og henvisningen holder op med at virke. Se opgraderingsvejledningen for, hvad hvert valg modtager.

@@ -38,7 +38,7 @@ jobs:
 | `mypy-version` | `1.11.2` | Version of mypy |
 | `shellcheck-py-version` | `0.10.0.1` | Version of the shellcheck-py package (ShellCheck 0.10.0) |
 | `shfmt-py-version` | `3.11.0.2` | Version of the shfmt-py package (shfmt 3.11.0) |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks.sh` is fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks.sh` is fetched |

 Reference the workflow at the major tag (`@v1`) or at an exact tag
 (`@v1.0.0`), never at `main` and never at the branch of a pull request: that
@@ -1,4 +1,4 @@
-<!-- translation of QualityChecksPythonShell.md, source sha256 2a0c9d43c77d -->
+<!-- translation of QualityChecksPythonShell.md, source sha256 ef64b44b88ad -->

 > Ini ialah terjemahan [`QualityChecksPythonShell`](QualityChecksPythonShell). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.

@@ -35,7 +35,7 @@ jobs:
 | `mypy-version` | `1.11.2` | Versi mypy |
 | `shellcheck-py-version` | `0.10.0.1` | Versi pakej shellcheck-py (ShellCheck 0.10.0) |
 | `shfmt-py-version` | `3.11.0.2` | Versi pakej shfmt-py (shfmt 3.11.0) |
-| `tools-ref` | `v1` | Tag atau cabang `TirSystem/github-action` tempat skrip `tools/quality-checks.sh` diambil |
+| `tools-ref` | `v2` | Tag atau cabang `TirSystem/github-action` tempat skrip `tools/quality-checks.sh` diambil |

 Rujuk aliran kerja pada tag major (`@v1`) atau pada tag tepat (`@v1.0.0`), jangan sekali-kali pada `main` dan jangan pada cabang pull request: cabang itu dipadam apabila pull request digabungkan dan rujukan itu berhenti berfungsi. Lihat panduan naik taraf untuk apa yang diterima oleh setiap pilihan.

@@ -1,4 +1,4 @@
-<!-- translation of Upgrading.md, source sha256 3233fa5bdab6 -->
+<!-- translation of Upgrading.md, source sha256 29086c9fa3a7 -->

 > Dette er en oversættelse af [`Upgrading`](Upgrading). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.

@@ -18,7 +18,7 @@ Sådan tager en softwareudvikler en ny udgivelse af de fælles workflows i brug

 En udgivelse, der bryder kompatibiliteten, får en ny major-version (`v2`), så en pipeline på `@v1` aldrig modtager den, før du selv ændrer linjen.

-Kvalitetskontrol-workflowene (`quality-checks.yml`, `quality-checks-cpp.yml` og `quality-checks-csharp.yml`) og kodemålings-workflowet (`code-metrics.yml`) henter deres scripts ved deres input `tools-ref`, som som standard er `v1`. For at fastlåse et helt skal du kalde det ved et præcist tag og sætte `tools-ref` til samme tag; ellers følger scriptet major-tagget.
+Kvalitetskontrol-workflowene (`quality-checks.yml`, `quality-checks-cpp.yml` og `quality-checks-csharp.yml`) og kodemålings-workflowet (`code-metrics.yml`) henter deres scripts ved deres input `tools-ref`, som som standard er det aktuelle major-tag (`v2`). For at fastlåse et helt skal du kalde det ved et præcist tag og sætte `tools-ref` til samme tag; ellers følger scriptet major-tagget.

 Det scoped workflow **Sync GitHub mirror metadata** leveres af instansen og står ikke i dine `uses:`-linjer; du kan ikke fastlåse det, men det henter sit script ved major-tagget. Publicering af wiki er et genbrugeligt workflow, du kalder (`publish-wiki-pages.yml`); det scoped workflow **Publish wiki** og dets markør `wiki/.publish` blev fjernet i 2.0.0, så et repository, der stadig har markøren, publicerer ikke mere, før det kalder det genbrugelige workflow (se introduktionsguiden).

@@ -24,7 +24,7 @@ never receives it until you change the line yourself.

 The quality-checks workflows (`quality-checks.yml`, `quality-checks-cpp.yml` and
 `quality-checks-csharp.yml`) and the code-metrics workflow (`code-metrics.yml`)
-fetch their scripts at their input `tools-ref`, which defaults to `v1`. To pin one completely, call it at an exact tag and set
+fetch their scripts at their input `tools-ref`, which defaults to the current major tag (`v2`). To pin one completely, call it at an exact tag and set
 `tools-ref` to the same tag; otherwise the script follows the major tag.

 The scoped workflow **Sync GitHub mirror metadata** is delivered by the
@@ -1,4 +1,4 @@
-<!-- translation of Upgrading.md, source sha256 3233fa5bdab6 -->
+<!-- translation of Upgrading.md, source sha256 29086c9fa3a7 -->

 > Ini ialah terjemahan [`Upgrading`](Upgrading). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.

@@ -18,7 +18,7 @@ Cara seorang jurutera perisian menerima keluaran baharu aliran kerja bersama den

 Keluaran yang memecahkan keserasian mendapat versi major baharu (`v2`), jadi saluran paip pada `@v1` tidak menerimanya sehingga anda sendiri menukar baris itu.

-Aliran kerja semakan kualiti (`quality-checks.yml`, `quality-checks-cpp.yml` dan `quality-checks-csharp.yml`) dan aliran kerja metrik kod (`code-metrics.yml`) mengambil skripnya pada inputnya `tools-ref`, yang lalai ialah `v1`. Untuk menyematkan satu sepenuhnya, panggil pada tag tepat dan tetapkan `tools-ref` kepada tag yang sama; jika tidak, skrip mengikuti tag major.
+Aliran kerja semakan kualiti (`quality-checks.yml`, `quality-checks-cpp.yml` dan `quality-checks-csharp.yml`) dan aliran kerja metrik kod (`code-metrics.yml`) mengambil skripnya pada inputnya `tools-ref`, yang lalai ialah tag major semasa (`v2`). Untuk menyematkan satu sepenuhnya, panggil pada tag tepat dan tetapkan `tools-ref` kepada tag yang sama; jika tidak, skrip mengikuti tag major.

 Aliran kerja scoped **Sync GitHub mirror metadata** dihantar oleh instans dan tidak terdapat dalam baris `uses:` anda; anda tidak boleh menyematkannya, tetapi ia mengambil skripnya pada tag major. Penerbitan wiki ialah aliran kerja boleh guna semula yang anda panggil (`publish-wiki-pages.yml`); aliran kerja scoped **Publish wiki** dan penanda `wiki/.publish` telah dibuang dalam 2.0.0, jadi repositori yang masih mempunyai penanda itu tidak lagi menerbitkan sehingga ia memanggil aliran kerja boleh guna semula (lihat panduan permulaan).

@@ -34,7 +34,7 @@ jobs:
    needs: tests
    permissions:
      contents: write
-    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v1
+    uses: TirSystem/github-action/.gitea/workflows/code-metrics.yml@v2
    with:
      coverage-artifact: coverage
      coverage-report: coverage.xml
@@ -49,9 +49,9 @@ jobs:
 | `coverage-warn` | `60` | Coverage in percent below which the badge is red |
 | `coverage-good` | `80` | Coverage in percent from which the badge is green; in between it is yellow |
 | `badges-branch` | `badges` | Branch that holds the badge files; it is created when it does not exist |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the scripts in `tools/` are fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the scripts in `tools/` are fetched |

-Reference the workflow at the major tag (`@v1`) or at an exact tag, never at
+Reference the workflow at the major tag (`@v2`) or at an exact tag, never at
 `main`. A call at an exact tag is pinned completely only when `tools-ref` names
 the same tag. See the upgrade guide. Start the workflow on pushes to your
 default branch only: the badge commit carries `[skip ci]` and is made with the
@@ -31,7 +31,7 @@ jobs:
 | `compile-commands-dir` | empty | Directory, relative to the repository root, with a `compile_commands.json` that your pipeline built before the call; when set, clang-tidy uses it and ignores `std` |
 | `clang-format-version` | `23.1.3` | Exact version of the clang-format package |
 | `clang-tidy-version` | `22.1.8` | Exact version of the clang-tidy package |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-cpp.sh` is fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-cpp.sh` is fetched |

 Reference the workflow at the major tag (`@v1`) or at an exact tag, never at
 `main`. A call at an exact tag is pinned completely only when `tools-ref` names
@@ -30,7 +30,7 @@ jobs:
 | `working-directory` | `.` | Directory, relative to the repository root, whose files are checked |
 | `project` | empty | Solution or project file, relative to `working-directory`; empty uses the single `*.sln` or `*.slnx`, else the single `*.csproj`, that is tracked there |
 | `dotnet-sdk-version` | `10.0.401` | Exact version of the .NET SDK, 10 or later; a channel such as `10.0`, a range and a version below 10 are refused |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-csharp.sh` is fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks-csharp.sh` is fetched |

 Reference the workflow at the major tag (`@v1`) or at an exact tag, never at
 `main`. A call at an exact tag is pinned completely only when `tools-ref` names
@@ -32,7 +32,7 @@ jobs:
 | `mypy-version` | `1.11.2` | Version of mypy |
 | `shellcheck-py-version` | `0.10.0.1` | Version of the shellcheck-py package (ShellCheck 0.10.0) |
 | `shfmt-py-version` | `3.11.0.2` | Version of the shfmt-py package (shfmt 3.11.0) |
-| `tools-ref` | `v1` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks.sh` is fetched |
+| `tools-ref` | `v2` | Tag or branch of `TirSystem/github-action` from which the script `tools/quality-checks.sh` is fetched |

 Reference the workflow at the major tag (`@v1`) or at an exact tag
 (`@v1.0.0`), never at `main` and never at the branch of a pull request: that
@@ -18,7 +18,7 @@ never receives it until you change the line yourself.

 The quality-checks workflows (`quality-checks.yml`, `quality-checks-cpp.yml` and
 `quality-checks-csharp.yml`) and the code-metrics workflow (`code-metrics.yml`)
-fetch their scripts at their input `tools-ref`, which defaults to `v1`. To pin one completely, call it at an exact tag and set
+fetch their scripts at their input `tools-ref`, which defaults to the current major tag (`v2`). To pin one completely, call it at an exact tag and set
 `tools-ref` to the same tag; otherwise the script follows the major tag.

 The scoped workflow **Sync GitHub mirror metadata** is delivered by the
@@ -44,7 +44,7 @@ class TestDefinition:
            "coverage-warn": "60",
            "coverage-good": "80",
            "badges-branch": "badges",
-            "tools-ref": "v1",
+            "tools-ref": (WORKFLOW.parent.parent.parent / "MAJOR_TAG").read_text(encoding="utf-8").strip(),
        }

    def test_asks_for_contents_write_and_nothing_else_and_needs_no_secret(self, document):
@@ -46,7 +46,7 @@ class TestDefinition:
        }
        assert inputs["languages"]["default"] == "python,shell"
        assert inputs["working-directory"]["default"] == "."
-        assert inputs["tools-ref"]["default"] == "v1"
+        assert inputs["tools-ref"]["default"] == (REPO_ROOT / "MAJOR_TAG").read_text(encoding="utf-8").strip()

    def test_tool_versions_are_pinned_to_the_adr(self, document):
        inputs = document[True]["workflow_call"]["inputs"]
@@ -68,7 +68,7 @@ class TestDefinition:
            "ref": "${{ inputs.tools-ref }}",
            "path": "shared-scripts",
        }
-        assert inputs_of(workflow)["tools-ref"]["default"] == "v1"
+        assert inputs_of(workflow)["tools-ref"]["default"] == (REPO_ROOT / "MAJOR_TAG").read_text(encoding="utf-8").strip()

    def test_inputs_reach_the_script_only_through_the_environment(
        self,
@@ -0,0 +1,107 @@
+"""The default `tools-ref` of every reusable workflow names the current major.
+
+A reusable workflow fetches the script it runs from this repository at its
+input `tools-ref`. A default that names a tag without the script makes a call
+with the defaults fail (MIL-011; code-metrics.yml defaulted to `v1`, where
+`tools/code-metrics.sh` does not exist). The current major is defined once, in
+`MAJOR_TAG`, and these tests check the workflows against it.
+"""
+
+import re
+import subprocess
+
+import pytest
+import yaml
+
+from workflow_source import REPO_ROOT, WORKFLOW_DIRS
+
+MAJOR_TAG_FILE = REPO_ROOT / "MAJOR_TAG"
+CHANGELOG = REPO_ROOT / "CHANGELOG.md"
+SCRIPT_PATTERN = re.compile(r"shared-scripts/(tools/[A-Za-z0-9_.-]+)")
+VERSION_HEADING = re.compile(r"^## \[(\d+)\.(\d+)\.(\d+)\]", re.MULTILINE)
+
+
+def reusable_workflows():
+    """Return the workflow files of this repository that a caller can use."""
+    path = WORKFLOW_DIRS[1]
+    found = []
+    for candidate in sorted(path.glob("*.yml")):
+        document = yaml.safe_load(candidate.read_text(encoding="utf-8"))
+        triggers = document.get("on") or document.get(True) or {}
+        if isinstance(triggers, dict) and "workflow_call" in triggers:
+            found.append(candidate)
+    return found
+
+
+def tools_ref_problems(text, major, script_exists):
+    """Return the problems of one workflow's default `tools-ref`, or [].
+
+    `text` is the workflow file, `major` the current major tag, and
+    `script_exists(tag, path)` says whether the tag holds the script.
+    """
+    document = yaml.safe_load(text)
+    triggers = document.get("on") or document.get(True) or {}
+    inputs = (triggers.get("workflow_call") or {}).get("inputs") or {}
+    if "tools-ref" not in inputs:
+        return []
+    problems = []
+    default = inputs["tools-ref"].get("default")
+    if default != major:
+        problems.append(f"default tools-ref is {default!r}, the current major is {major!r}")
+    for script in sorted(set(SCRIPT_PATTERN.findall(text))):
+        if not script_exists(default, script):
+            problems.append(f"{script} is not in tag {default!r}")
+    return problems
+
+
+def current_major():
+    return MAJOR_TAG_FILE.read_text(encoding="utf-8").strip()
+
+
+def script_in_tag(tag, path):
+    """True when the tag holds the file; True when the tag is not in this checkout."""
+    known = subprocess.run(
+        ["git", "-C", str(REPO_ROOT), "rev-parse", "--verify", "--quiet", f"refs/tags/{tag}"],
+        capture_output=True,
+        check=False,
+    )
+    if known.returncode != 0:
+        return True
+    holds = subprocess.run(
+        ["git", "-C", str(REPO_ROOT), "cat-file", "-e", f"{tag}:{path}"],
+        capture_output=True,
+        check=False,
+    )
+    return holds.returncode == 0
+
+
+def test_major_tag_file_names_the_highest_major_of_the_changelog():
+    majors = [int(m.group(1)) for m in VERSION_HEADING.finditer(CHANGELOG.read_text(encoding="utf-8"))]
+    assert majors, "the changelog has no released version"
+    assert current_major() == f"v{max(majors)}"
+
+
+@pytest.mark.parametrize("path", reusable_workflows(), ids=lambda p: p.name)
+def test_default_tools_ref_is_the_current_major_and_holds_the_script(path):
+    problems = tools_ref_problems(path.read_text(encoding="utf-8"), current_major(), script_in_tag)
+    assert problems == []
+
+
+@pytest.mark.parametrize("path", reusable_workflows(), ids=lambda p: p.name)
+def test_every_script_a_workflow_runs_is_in_the_working_tree(path):
+    for script in SCRIPT_PATTERN.findall(path.read_text(encoding="utf-8")):
+        assert (REPO_ROOT / script).is_file(), f"{path.name} runs {script}, which does not exist"
+
+
+def test_a_default_that_names_an_old_major_is_reported():
+    text = (WORKFLOW_DIRS[1] / "code-metrics.yml").read_text(encoding="utf-8")
+    seeded = re.sub(r'(tools-ref:\s*description:[^\n]*\n\s*type: string\n\s*default: )"[^"]*"', r'\1"v1"', text)
+    assert seeded != text, "the seeded default was not applied"
+    problems = tools_ref_problems(seeded, "v2", lambda tag, path: tag != "v1")
+    assert any("current major" in p for p in problems)
+    assert any("is not in tag 'v1'" in p for p in problems)
+
+
+def test_the_fixed_default_has_no_problem():
+    text = (WORKFLOW_DIRS[1] / "code-metrics.yml").read_text(encoding="utf-8")
+    assert tools_ref_problems(text, current_major(), lambda tag, path: True) == []
Author	SHA1	Message	Date
Tirsvad	302346103e	Merge pull request 'Release 2.1.1: changelog entry' (#179 ) from release-2.1.1 into main Validate workflows / validate (push) Successful in 37s Details TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Successful in 8s Details Reviewed-on: #179	2026-10-14 11:20:15 +02:00
Tirsvad	469edab57b	Release 2.1.1: changelog entry TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Skipped Validate workflows / validate (pull_request) Successful in 36s Details	2026-10-14 17:19:27 +08:00
Tirsvad	49af328232	Merge pull request 'MIL-011 tasks 2 to 5: the default tools-ref is the current major' (#178 ) from mil-011-fix into main Publish wiki / publish-wiki (push) Successful in 23s Details Publish own wiki / wiki (push) Successful in 23s Details Publish accepted milestones / publish (push) Successful in 56s Details Validate workflows / validate (push) Successful in 38s Details TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Successful in 6s Details Reviewed-on: #178	2026-10-14 11:17:50 +02:00
Tirsvad	604d4c2d0c	Resolve pending commit links for MIL-011 TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Skipped Validate workflows / validate (pull_request) Successful in 31s Details	2026-10-14 17:13:23 +08:00
Tirsvad	a6892c372a	MIL-011 tasks 5 and 9: results of the run on the instance, RC-078 The fixed workflow at the branch, with every input at its default, ran as run 1509: tools-ref resolved to v2, the scripts were fetched and the badges were committed. RC-078 reviews the deliverables of tasks 2 to 5: Go; criteria 6 to 8 stay open until the release and the framework page.	2026-10-14 17:13:20 +08:00
Tirsvad	eaa0e30bea	MIL-011 tasks 2 to 4: the default tools-ref is the current major TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Skipped code-metrics.yml defaulted tools-ref to v1 and its guide said @v1, but the workflow and its scripts exist only from v2.1.0. The default of the five reusable workflows is now the current major, defined once in MAJOR_TAG, and tests/test_tools_ref.py fails when a default differs from it or names a tag without the script. Guides, README and wiki (en, da, ms) call code-metrics.yml at @v2; ADR-0005, 0008, 0009 and 0010 carry an amendment; RC-077 accepts the milestone's task 1 results. Task: MIL-011#2	2026-10-14 17:09:34 +08:00
Tirsvad	76f6b56f8d	Merge pull request 'MIL-011 task 1: reproduce the defect and list the defaults' (#177 ) from mil-011-task-1 into main Publish accepted milestones / publish (push) Successful in 1m6s Details Validate workflows / validate (push) Successful in 28s Details TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Successful in 5s Details Reviewed-on: #177	2026-10-14 11:02:14 +02:00
Tirsvad	49d27f98db	Resolve pending commit link for MIL-011 TirSystem/github-action: Sync GitHub mirror metadata / sync-metadata (push) Skipped Validate workflows / validate (pull_request) Successful in 31s Details	2026-10-14 16:34:18 +08:00
Tirsvad	e11c43f0a4	MIL-011 task 1: reproduce the defect and list the defaults On a throwaway branch, code-metrics.yml at @v2 with the defaults fails in "Validate the inputs" (tools/code-metrics.sh absent at v1, run 1499), and a call at @v1 creates no run at all. Of the five reusable workflows only code-metrics.yml names a tag without its script.	2026-10-14 16:34:17 +08:00