[dependabot]

Bumps Icaro0310/devin-powerups/.github/workflows/verify-wheel-version.yml from 7db127668a6b5c3fa396a4853dcf25865e3a4d2c to 41ac6d43b44e6bb1984c95f63f69ce18abfe1329.

Changelog

Sourced from Icaro0310/devin-powerups/.github/workflows/verify-wheel-version.yml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• scripts/check-internal-paths.py: personal-machine-paths diff sensor — fails a staged or PR diff when the lines it adds to a text file (.json .yaml .yml .txt .md .env .cfg .ini .toml .csv .log) carry the owner's home dir (/home/<owner>, deliberately not /home/* — CI runners legitimately show /home/runner and docs /home/user), a macOS user-home path, or a Windows profile path. Only added lines are scanned, so a pre-existing doc example of a banned shape never blocks an unrelated edit; findings report file:line: rule without echoing the matched line (the match is the leak — it must not re-enter CI logs). Modes: staged index blob (default, pre-commit gate), --pr-base <ref> (CI diff <ref>...HEAD), --all (whole-tree no-merge-base fallback). Wired as a step in secrets-scan.yml — the checkout copy runs only for writer-producible heads (same-repo PRs, pushes); fork PRs and repos that do not ship the script run the pinned v1 fetch into .powerups-sensor — so the next v1 retag propagates the gate to every ci.yml caller with zero caller-side changes. Covers the git add -A machine-state-snapshot incident class secrets-scan cannot see: a path is not a token shape.

• tools/check_required_checks.py (#64): orphaned required-check detector — for every public registry repo (plus --repo/--extra-repo extras like Icaro0310/Icaro0310.github.io), diffs the required status-check contexts from branch protection + active rulesets against the contexts actually produced (check-runs/commit statuses on the default head and the last --prs PR heads, plus job names declared by the local .github/workflows/*.yml, resolving uses: reusable calls into their real caller / callee names; workflow_call-only files contribute no bare names, which is what keeps the renamed-job ghost visible). A required context with no producer leaves PRs green-but-BLOCKED forever — the incident class that hit 15 repos in Oct 2026. Also verifies actions/permissions/workflow.can_approve_pull_request_reviews. Every leg reads public data, so plain GITHUB_TOKEN suffices; --json supported; exit 1 on findings, 2 when nothing audited. Wired into registry-drift.yml; tools/test_check_required_checks.py covers parsing, matching, API shapes and exit codes. ci.yml gains a tools-tests job running the whole tools/ pytest suite (pinned pytest~=9.0) — previously only test_weekly_repo_report.py ran in CI.

• pr-approve.yml v1.5 gate fallback extensions (D-2026-10-20b): qualified replies may clear a blocking thread by citing a landed same-owner upstream fix — owner/repo@<sha> or github.com/owner/repo/commit/<sha> verify the sha is an ancestor of the upstream repo's default branch, github.com/owner/repo/pull/<n> verifies merged_at non-null — closing the canary failure where a finding on a caller's auto-approve.yml can only be fixed in devin-powerups (assure#89). Anchors naming the PR's own repo keep the v1.4 ancestor+postdate proof (own-repo pulls require the merge commit in the head AND postdating the finding). The gate-resolved-via: fallback audit comment is now idempotent: a gate-fallback-pairs: line records the resolved thread|anchor set + head sha; an identical github-actions[bot]-posted set suppresses duplicates while a new thread or new head posts fresh, and a per-PR/head concurrency group serializes same-key re-triggers. Test suite grows to 34 covering the anchors, org-scope rail, landedness checks and the dedupe.

• pr-approve.yml v1.4 gate fallback (D-2026-10-20): a blocking Devin Review thread stops counting when a reply by the PR author or a repo collaborator cites a commit verified as an ancestor of the reviewed head (compare ahead/identical) AND strictly postdating the finding's commit AND the head carries a Devin Review status success. Threads stay unresolved (veto stays visible); fallback-resolved: log lines, fallback_resolutions/fallback_threads step outputs, and a gate-resolved-via: fallback PR comment on approval make every use auditable. pull_request_review_comment[created] re-triggers the gate so late fix replies re-evaluate (caller auto-approve.yml files need the same trigger at pin-bump time). Closes the repeat failure class where the bot never self-resolves verified findings (devin-explore#104, devin-state#74 — admin merges). tools/test_pr_approve_gate_fallback.py executes the workflow's real run: blocks against a stubbed gh.

• tools/dev-deps-pin-check.py: dev-dep drift sensor — fails when a lint/test/build tool (ruff, pytest, mypy, bandit, black, coverage, hatch/hatchling, setuptools, wheel, build, twine; overridable via --tools) carries a floating specifier (bare >=/*/latest/@main) in pyproject.toml (optional-deps, dependency-groups, tool.uv, build-system.requires, hatch envs), requirements*.txt, or workflow install lines (pip/pipx/uvx/uv tool), including astral-sh/ruff-action steps without a version: input. Wired into ci.yml against the repo + template/; tools/test_dev_deps_pin_check.py + --selftest fixtures cover every site.

• GOVERNANCE.md + BACKLOG.md: central rules (measurement-window scope, merge evidence rule, @v1 caller pinning, named-file staging) and the parked-work tracker. tools/fork_visibility.py measures the upstream awesome-list PR funnel. .github/workflows/baseline-snapshot.yml automates weekly P5 collection (Mon 08:15 UTC, commits snapshots, opens an issue on failure).

• tools/snapshot_baseline.py + BASELINE.md: P5 adoption/reliability baseline — per-repo GitHub stats and traffic (14d), PyPI/npm downloads for published tools, day-1 snapshot at snapshots/2026-10-08.json. Collection window 2026-10-08 → 2026-12-03.

• scorecard.yml drops top-level permissions: read-all: a called workflow's requested scopes must be a subset of what the caller grants, and read-all demanded every scope (caused startup_failure in callers). The job now declares exactly contents: read, security-events: write, id-token: write; VARIANTS.md caller templates grant permissions at job level explicitly.

• Reusable workflows for cross-repo consolidation (P3b): labeler.yml, scorecard.yml and the new codeql.yml (with language input) now accept workflow_call, and the new secrets-scan.yml carries the shared secret-shaped-string scan. Callers pin the @v1 major tag; .github/workflows/VARIANTS.md documents the tagging convention, caller templates, migration gates and the intentionally non-consolidated ci.yml variants (devin-bridge, devin-evals, devin-memory, devin-qa-pack).

• Registry v17 classifies every entry with track, role, nature, mode, maturity, public, official_overlap and overlap_note, and marks devin-powerups as the control plane (is_control_plane). The structural kind is unchanged. Rules in registry.schema.json reject contradictory combinations and name the broken rule.

• tools/test_validate_registry.py and tools/test_registry_classification.py check every validator keyword, the vocabulary, the consistency rules, the approved track membership and agreement with the jsonschema reference implementation (skipped when it is not installed).

• tools/new-repo.py accepts --track, --role, --nature, --mode and --maturity and registers new entries with the least-claiming classification.

• tools/render_surfaces.py: renders the semantic layer as derivable surfaces — intent map (track -> tools), browse-by-audience, browse-by-interface, per-repo ecosystem blocks, and headline counts. Editorial copy stays manual.

• DECISIONS.md + GOVERNANCE.md lifecycle section: creation/consolidation/archival/reclassification criteria and the six-field decision-record format; the merge rule is now a criterion (technical + product signals), not a prohibition.

Changed

• P5 reframed from a work freeze to a measurement window: product/discoverability work (READMEs, site, topics, awesome-devin rewrites, backlog graders, package publication) is allowed — it is what the baseline measures. Only structural changes that would invalidate the series remain gated: physical merges, new/deleted repos, registry taxonomy changes, renames. (GOVERNANCE.md, BASELINE.md, BACKLOG.md)
• Registry v8 describes the DevKit install sources, Windows/Linux support, user profiles, and the separate devin-devkit distribution. export_devkit_manifest.py emits a pinned manifest; private/system entries are rejected.
• render_catalog.py produces the profile README catalog and exact counts from registry.json.
• migrate_platform_docs.py previews and refreshes Windows/Linux guides from the same registry; --apply removes the retired Portuguese README files.
• tools/validate_registry.py enforces the whole schema vocabulary ($ref, allOf, if/then/else, const, anyOf, not), rejects a schema that uses a keyword it cannot check or malformed keyword operands, and requires exactly one control plane. The old validator silently skipped those keywords. registry_errors is now the single validation entry point (schema first, cross-entry rules on valid documents only) used by new-repo.py and export_devkit_manifest.py.
• tools/new-repo.py --kind system now requires --visibility private.
• The starter template now uses one shared README with separate Windows and Linux guides; macOS is marked planned/unverified.
• Package metadata in 11 Python projects now references the published devin-internals-spec version range instead of a direct Git URL, making the distributions eligible for PyPI upload.
• template/pyproject.toml dev deps are pinned (pytest~=9.0, ruff~=0.17.0, setuptools>=77,<82) — a bare >= floats to every new release, which is how ruff 0.17 broke generated repos' main.
• verify-wheel-version.yml installs build==1.2.2/twine==6.1.0 instead of floating latest on the publish path.

Fixed

• devin-powerups no longer declares an external dependency on Corporate Windows; the schema rule that forbids it was not being enforced.
• tools/new-repo.py marks an unsupported environment as delegation=forbidden, as the schema requires.

... (truncated)

Commits

• 41ac6d4 retire lane A + stale vendored fallback
• 9249702 feat(sync): repo-settings check — auto-merge coverage per repo (#268)
• bd81c92 docs(platform): sync OS guides with registry render (#267)
• 7596f2f feat(sync): --remediate — sensor dispatches the agent, not just the Owner (#266)
• e458a24 test(gate): fixture carries devin-judge/review status + pin judge-blocked pat...
• f396212 fix(ecosystem_sync): n/a (not DAEMON-DOWN) on platforms without POSIX probes ...
• 7e75acb fix(verify-wheel-version): pin packaging==26.3 — twine 7 fails Metadata-Versi...
• 098f56e docs(decisions): formal close of governance freeze (D-2026-10-30) (#262)
• 442b02f feat(silence): monitor judge-watch liveness (<=30m) (#261)
• 6120c2e feat(approve): hard judge gate before approving (v1.12) (#260)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

[github-actions]

Static scan (advisory) — result: EXECUTED

Deterministic scan of 1 changed file(s) — gitleaks 8.30.1 · semgrep 1.182.1 · ruff 0.17.3. Findings are advisory evidence for the judge, not a lane verdict.

gitleaks — 0 finding(s)

semgrep — 0 finding(s)

ruff — skipped (no Python files changed)

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Publishing verifier upgrade lacks changelog entry

Repinning verify-wheel-version leaves the publishing gate change out of the root changelog, contrary to the changelog rule.

Learn more

The reusable verifier now installs different wheel-checking tools, but this PR changes only its pin. The contribution checklist requires a semver changelog update before a PR. The root Unreleased section has no entry for this upgrade.

Example: A maintainer reviewing the Unreleased notes sees the previous publish workflow changes but cannot identify when the verifier switched to Twine 7 and pinned packaging 26.3.

Recommended fix: Add a concise CI or Publish entry to the root CHANGELOG.md Unreleased section describing the verifier pin update and its publishing-gate effect.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[Icaro0310]

Fixed in 1c8ae12 — Unreleased CI entry added for the verifier pin update.

[Icaro0310]

devin-judge (ACP, high model): approve — {"samples": 1, "blocks": 0, "probs": [{"secrets": 0.04, "unsafe_code": 0.08, "deception": 0.05}]}

[github-actions]

Static scan (advisory) — result: EXECUTED

Deterministic scan of 2 changed file(s) — gitleaks 8.30.1 · semgrep 1.182.1 · ruff 0.17.3. Findings are advisory evidence for the judge, not a lane verdict.

gitleaks — 0 finding(s)

semgrep — 0 finding(s)

ruff — skipped (no Python files changed)

[github-actions]

Merge automático bloqueado: o Judge não aprovou esta alteração. Requer revisão humana.

devin-judge/review on 1c8ae12: pending (approve requires success). Quando o Judge aprovar, este gate re-corre sozinho e libera a aprovação. Um humano pode sobrepor na UI do GitHub assumindo a responsabilidade.
judge-blocked head:1c8ae12cee71967aff42c527449a15ded2a452ca

[Icaro0310]

devin-judge (ACP, high model): approve — {"samples": 1, "blocks": 0, "probs": [{"secrets": 0.01, "unsafe_code": 0.03, "deception": 0.02}]}

[github-actions]

gate-resolved-via: fallback — 1 blocking thread(s) cleared by replies citing verified fix commits, with the Devin Review status on 1c8ae12 re-verified clean:

• thread PRRT_kwDOUzxHgc61EpnC via commit 1c8ae12

Threads left unresolved — the findings stay visible.
gate-fallback-pairs: PRRT_kwDOUzxHgc61EpnC|commit:1c8ae12 head:1c8ae12cee71967aff42c527449a15ded2a452ca