[dependabot]

Bumps Icaro0310/devin-powerups/.github/workflows/verify-wheel-version.yml from e2612c9e448a366a0539ea4593f70da47b4cec80 to 7db127668a6b5c3fa396a4853dcf25865e3a4d2c.

Changelog

Sourced from Icaro0310/devin-powerups/.github/workflows/verify-wheel-version.yml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• tools/dev-deps-pin-check.py: dev-dep drift sensor — fails when a lint/test/build tool (ruff, pytest, mypy, bandit, black, coverage, hatch/hatchling, setuptools, wheel, build, twine; overridable via --tools) carries a floating specifier (bare >=/*/latest/@main) in pyproject.toml (optional-deps, dependency-groups, tool.uv, build-system.requires, hatch envs), requirements*.txt, or workflow install lines (pip/pipx/uvx/uv tool), including astral-sh/ruff-action steps without a version: input. Wired into ci.yml against the repo + template/; tools/test_dev_deps_pin_check.py + --selftest fixtures cover every site.

• GOVERNANCE.md + BACKLOG.md: central rules (measurement-window scope, merge evidence rule, @v1 caller pinning, named-file staging) and the parked-work tracker. tools/fork_visibility.py measures the upstream awesome-list PR funnel. .github/workflows/baseline-snapshot.yml automates weekly P5 collection (Mon 08:15 UTC, commits snapshots, opens an issue on failure).

• tools/snapshot_baseline.py + BASELINE.md: P5 adoption/reliability baseline — per-repo GitHub stats and traffic (14d), PyPI/npm downloads for published tools, day-1 snapshot at snapshots/2026-10-08.json. Collection window 2026-10-08 → 2026-12-03.

• scorecard.yml drops top-level permissions: read-all: a called workflow's requested scopes must be a subset of what the caller grants, and read-all demanded every scope (caused startup_failure in callers). The job now declares exactly contents: read, security-events: write, id-token: write; VARIANTS.md caller templates grant permissions at job level explicitly.

• Reusable workflows for cross-repo consolidation (P3b): labeler.yml, scorecard.yml and the new codeql.yml (with language input) now accept workflow_call, and the new secrets-scan.yml carries the shared secret-shaped-string scan. Callers pin the @v1 major tag; .github/workflows/VARIANTS.md documents the tagging convention, caller templates, migration gates and the intentionally non-consolidated ci.yml variants (devin-bridge, devin-evals, devin-memory, devin-qa-pack).

• Registry v17 classifies every entry with track, role, nature, mode, maturity, public, official_overlap and overlap_note, and marks devin-powerups as the control plane (is_control_plane). The structural kind is unchanged. Rules in registry.schema.json reject contradictory combinations and name the broken rule.

• tools/test_validate_registry.py and tools/test_registry_classification.py check every validator keyword, the vocabulary, the consistency rules, the approved track membership and agreement with the jsonschema reference implementation (skipped when it is not installed).

• tools/new-repo.py accepts --track, --role, --nature, --mode and --maturity and registers new entries with the least-claiming classification.

• tools/render_surfaces.py: renders the semantic layer as derivable surfaces — intent map (track -> tools), browse-by-audience, browse-by-interface, per-repo ecosystem blocks, and headline counts. Editorial copy stays manual.

• DECISIONS.md + GOVERNANCE.md lifecycle section: creation/consolidation/archival/reclassification criteria and the six-field decision-record format; the merge rule is now a criterion (technical + product signals), not a prohibition.

Changed

• P5 reframed from a work freeze to a measurement window: product/discoverability work (READMEs, site, topics, awesome-devin rewrites, backlog graders, package publication) is allowed — it is what the baseline measures. Only structural changes that would invalidate the series remain gated: physical merges, new/deleted repos, registry taxonomy changes, renames. (GOVERNANCE.md, BASELINE.md, BACKLOG.md)
• Registry v8 describes the DevKit install sources, Windows/Linux support, user profiles, and the separate devin-devkit distribution. export_devkit_manifest.py emits a pinned manifest; private/system entries are rejected.
• render_catalog.py produces the profile README catalog and exact counts from registry.json.
• migrate_platform_docs.py previews and refreshes Windows/Linux guides from the same registry; --apply removes the retired Portuguese README files.
• tools/validate_registry.py enforces the whole schema vocabulary ($ref, allOf, if/then/else, const, anyOf, not), rejects a schema that uses a keyword it cannot check or malformed keyword operands, and requires exactly one control plane. The old validator silently skipped those keywords. registry_errors is now the single validation entry point (schema first, cross-entry rules on valid documents only) used by new-repo.py and export_devkit_manifest.py.
• tools/new-repo.py --kind system now requires --visibility private.
• The starter template now uses one shared README with separate Windows and Linux guides; macOS is marked planned/unverified.
• Package metadata in 11 Python projects now references the published devin-internals-spec version range instead of a direct Git URL, making the distributions eligible for PyPI upload.
• template/pyproject.toml dev deps are pinned (pytest~=9.0, ruff~=0.17.0, setuptools>=77,<82) — a bare >= floats to every new release, which is how ruff 0.17 broke generated repos' main.
• verify-wheel-version.yml installs build==1.2.2/twine==6.1.0 instead of floating latest on the publish path.

Fixed

• devin-powerups no longer declares an external dependency on Corporate Windows; the schema rule that forbids it was not being enforced.
• tools/new-repo.py marks an unsupported environment as delegation=forbidden, as the schema requires.
• test_manifest_uses_pypi_names_and_real_cli_entrypoints no longer freezes which tools install from GitHub, PyPI or npm.
• scripts/check-adapters-hygiene.py: five sensor gaps closed — README names now match whole devin-* tokens (a devin-checker mention no longer validates devin-check); fenced/inline devin-* words only count as invocations in command position, so install lines, comments and quoted launcher specs stop failing valid skills; tilde (~~~) fences are recognized; C:\Users matches one or two backslashes; binary adapter files are scanned for token-shaped values instead of skipped whole. VARIANTS.md now documents the adapters-check.yml reusable and its ci.yml caller wiring.
• agent-sessions VS Code adapter: Open Details accepts both the row-click display key and the context-menu SessionNode; refresh now fires onDidChange for every open details document (ephemeral keys are positional, so a recollect can rebind a URI); details URIs no longer double-decode the key basename; @sessions filtered answers sort newest-first like the tree; overview warning counts show occurrences with ×n per kind; Surfaces table fixed to two columns.
• agent-sessions parsers: non-object JSONL records are skipped as bad lines instead of aborting the Copilot surface; mutation paths containing __proto__/constructor/prototype are rejected (prototype-pollution guard); session.start version must be version-shaped before reaching source_version; a task_started after task_complete re-opens the Codex session (ended_at null + session-open); sessions without stable workspace identity now get id: null + unknown-workspace instead of a canonical-looking native: id, and dedup only collapses records sharing source + workspace hash + native id (cross-workspace collisions are kept and flagged cross-workspace-duplicate).

[0.1.0] - 2026-09-29

Added

... (truncated)

Commits

• 7db1276 registry: bump version to 32 for the office distribution flip (#211)
• 38c914b registry: devin-office source_only → published (PyPI 0.1.0 live) (#210)
• 31565ac Merge pull request #209 from Icaro0310/chore/registry-office-packaged
• a4b0beb registry+snapshot+generator: office CLI interfaces and startup paths (devin r...
• 06c55a9 registry: devin-office packaged (control#73) — drop stale source-only clause
• 3dec134 ci: dev-deps pin sensor + shared template pins (ruff~=0.17.0) (#208)
• 8c72238 docs: re-classify AgentsView per-environment (candidate Personal/Linux) (#207)
• 5177c1f chore: refresh devkit tool pins (search 0.2.1, doctor 0.3.1, qa-pack 0.2.1, j...
• 301616b Merge pull request #204 from Icaro0310/docs/release-signature-verification
• bfa741c docs(security): verify releases in an isolated keyring
• Additional commits viewable in compare view

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[Icaro0310]

@dependabot rebase

[Icaro0310]

@dependabot rebase