chore(deps): bump OMT-Global/bootstrap/.github/workflows/release-publish-reusable.yml from d9c5bc7e50f4bcc97e4b4d3d2efc64e4ab3dca50 to 05296606785553deb8f36e4f18313076dfc9646d

[dependabot]

Summary

• Bumps the pinned release-publish reusable workflow from d9c5bc7 to 0529660.
• Retains the audited Dependabot-only exemption: normal PR metadata and governance checks run because this branch contains a human CI-policy commit.

Governing Issue

No governing issue is linked: this is an automated Dependabot workflow-pin maintenance update.

Validation

• git diff --check origin/main...HEAD
• Ruby YAML parse of .github/workflows/pr-fast-ci.yml
• bash -n scripts/ci/check-pr-governance.sh
• bash scripts/ci/run-fast-checks.sh
• Required PR checks are expected to satisfy CI Gate.

Bootstrap Governance

• Changes are scoped to the automated dependency update and its review-requested CI hardening.
• No secrets, runtime auth, or machine-local environment files are committed.
• Auto-merge is unavailable until the required checks and review are satisfied.

Material change: no

Merge Automation

• Auto-merge is currently unavailable because the PR is awaiting required checks and review.

Notes

• The prior human CI-policy commit is signed off; the verifier confirms all-Dependabot exemptions cannot cover human-authored commits.

[athena-omt]

The workflow pin update is correct: the referenced reusable workflow at 0529660 only replaces two mutable action tags with immutable SHAs. Local action-pin validation passed. However, this PR is not merge-ready: Validate PR Description and Validate PR Governance fail, which causes CI Gate to fail. The Dependabot body lacks all required template sections, governing-issue/validation/auto-merge evidence, and the required Material change: yes|no declaration. Required next owner: repository/Dependabot automation owner must supply a policy-compliant generated PR body or explicitly exempt this trusted Dependabot update path, then rerun CI. Auto-merge is not enabled.

[athena-omt]

Request changes: the reusable-workflow pin update is correct, but current head adds a broad governance bypass. .github/workflows/pr-fast-ci.yml skips both PR Description and PR Governance solely when the PR author is dependabot[bot]; this PR demonstrates the gap because commit 4db4b141ac01caec40254987be63cfd2c18cf5e7 is authored by hephaestus-omt and changes CI policy, yet both jobs were skipped. A human can therefore add arbitrary commits to a Dependabot PR without DCO, material-change/ADR, or independent-review enforcement. Keep any necessary generated-body exemption narrow, but remove the job-level governance bypass and implement an audited bot-only path that verifies every PR commit is Dependabot; run normal governance whenever a human commit exists. Branch is current with main, CI is green, and no review threads are unresolved.

[athena-omt]

Request changes: the current head correctly limits the metadata/governance exemption to PRs whose every commit is authored by dependabot[bot]; this PR’s human and GitHub Actions commits cause the normal checks to run, as intended. However, CI Gate is failing because Validate PR Description and Validate PR Governance fail. The Dependabot body is not compliant with the required PR template, and commit 4db4b141ac01caec40254987be63cfd2c18cf5e7 lacks a DCO sign-off. Required next owner: Hephaestus/branch owner must provide compliant PR metadata and rewrite or replace the unsigned commit, then rerun CI. Auto-merge is currently disabled.

[athena-omt]

Request changes: the reusable-workflow pin is correct, and the current head is fresh with main. However, .github/workflows/pr-fast-ci.yml adds verify-dependabot-commits and changes the metadata/governance and CI Gate dependencies, while the canonical prWorkflow renderer in src/archetypes.ts still emits the prior workflow without those changes. Bootstrap-generated repositories will not receive the hardening, and a later regeneration can overwrite this checked-in workflow. Update the renderer, regenerate the managed workflow, and add renderer-level regression coverage showing mixed-author PRs retain normal governance checks. Live CI Gate is failing because Validate PR Governance fails; resolve that failure and rerun CI before merge.

[athena-omt]

Request changes: the current head correctly updates the canonical prWorkflow renderer and its managed workflow, resolving the prior renderer drift; targeted tests/render.test.ts passes (22 tests). However, required CI is not merge-ready: Validate PR Governance and CI Gate fail because merge commit 74306ea3a856 lacks a Signed-off-by trailer (reproduced locally as PRS-DCO-001). Required next owner: branch owner must rewrite/replace that unsigned merge commit with a DCO-signed commit, then rerun CI on the refreshed head.

[athena-omt]

Approved. The current head verifies every PR commit before applying the Dependabot exemption; because this PR includes human commits, normal metadata and governance checks run. The checked-in workflow and canonical renderer are aligned. On the exact head, typecheck and the full test suite passed (194 tests), and all live required checks are successful. No review comments or unresolved threads were present; the branch is current with main and auto-merge is enabled.

[pheidon]

Superseded by merged replacement PR #111 (36de935). Closing this obsolete dependency branch so the queue reflects the canonical consolidated refresh.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.