From ef5bda0cd4bd0b3df4e0ca41efe52b55b6af3638 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 4 Oct 2026 12:33:22 +0000
Subject: [PATCH] chore(sync): synced file(s) with cplieger/ci

---
 .editorconfig               | 1 +
 .gitattributes              | 5 ++---
 .golangci.yaml              | 1 +
 .gremlins.yaml              | 5 ++---
 cliff.toml                  | 1 +
 scripts/collect-licenses.sh | 3 +--
 scripts/repin-sha.sh        | 3 +--
 tests/image-smoke.sh        | 3 +--
 8 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/.editorconfig b/.editorconfig
index d6dc913..a50646b 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/.editorconfig. Change it there.
 root = true
 
 [*]
diff --git a/.gitattributes b/.gitattributes
index 20a7a32..077177a 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/.gitattributes. Change it there.
 # Canonical line-ending + diff policy for all cplieger repos.
 #
 # Normalize every text file to LF in the repository and force LF on checkout,
@@ -7,9 +8,7 @@
 # LF-committed blobs. `text=auto` lets git detect binary files and leave them
 # untouched; `eol=lf` pins text checkouts to LF on every platform.
 #
-# Distributed to all releaseable + python repos via cplieger/ci's sync
-# workflow (see scripts/classify-repos.py). Keep this uniform across repos;
-# repos with extra needs (e.g. age-encrypted secret blobs) maintain their
+# Repos with extra needs (e.g. age-encrypted secret blobs) maintain their
 # own superset and are excluded from the sync.
 
 # Force LF for all text; auto-detect and leave binary files untouched.
diff --git a/.golangci.yaml b/.golangci.yaml
index b5b6b8e..dd77c94 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/.golangci.yaml. Change it there.
 version: "2"
 
 run:
diff --git a/.gremlins.yaml b/.gremlins.yaml
index e2d9351..15e75b1 100644
--- a/.gremlins.yaml
+++ b/.gremlins.yaml
@@ -1,6 +1,5 @@
-# Central Gremlins (Go mutation testing) config — synced into every Go-having
-# consumer repo as `.gremlins.yaml`. Edit this file in cplieger/ci to change
-# the policy org-wide.
+# Synced from cplieger/ci/configs/gremlins.yaml. Change it there.
+# Central Gremlins (Go mutation testing) config for every Go-having repo.
 #
 # Source: distilled from per-repo analysis (cplieger/ci subagent research,
 # 2026-06-04). Patterns capture the common "unkillable without integration"
diff --git a/cliff.toml b/cliff.toml
index 361a985..8eda21d 100644
--- a/cliff.toml
+++ b/cliff.toml
@@ -1,3 +1,4 @@
+# Synced from cplieger/ci/configs/cliff-stable.toml. Change it there.
 # Version-bump policy. Stable (1.x+): standard semver.
 # feat -> minor; breaking -> major.
 # Fresh/untagged repos start at v1.0.0 (matches "0.x is the exception" policy).
diff --git a/scripts/collect-licenses.sh b/scripts/collect-licenses.sh
index 7b2ac6f..2111a0a 100755
--- a/scripts/collect-licenses.sh
+++ b/scripts/collect-licenses.sh
@@ -1,8 +1,7 @@
 #!/bin/sh
+# Synced from cplieger/ci/configs/collect-licenses.sh. Change it there.
 # Copy every linked Go module's license files into the /usr/share/licenses tree of
 # attribution.md section 4. usage: collect-licenses.sh --name IMAGE [--out DIR] [--src DIR] [PACKAGE ...]
-# CANONICAL COPY in cplieger/ci (configs/collect-licenses.sh), synced to each
-# root-Dockerfile repo's scripts/collect-licenses.sh: edit it there, never here.
 # A module with no license file fails the build rather than being skipped, because a
 # missing text is a section 4(a) breach and the fix is a human decision.
 set -eu
diff --git a/scripts/repin-sha.sh b/scripts/repin-sha.sh
index 0a6c64b..3fc8659 100644
--- a/scripts/repin-sha.sh
+++ b/scripts/repin-sha.sh
@@ -1,9 +1,8 @@
 #!/bin/sh
+# Synced from cplieger/ci/configs/repin-sha.sh. Change it there.
 # Recompute a Dockerfile sha256 integrity pin after Renovate moved its version
 # literal, run from postUpgradeTasks because no datasource publishes a sha256.
 # Marker convention and enrollment: ci-renovate.md, "Automated sha-pin recompute".
-# CANONICAL COPY in cplieger/ci (configs/repin-sha.sh), synced to every repo with a
-# root Dockerfile: edit it there, never here.
 # A marker it cannot honour exits non-zero rather than skipping, because a silent
 # miss reproduces the stale-pin build failure the pin exists to catch.
 set -eu
diff --git a/tests/image-smoke.sh b/tests/image-smoke.sh
index b883a2a..242b585 100644
--- a/tests/image-smoke.sh
+++ b/tests/image-smoke.sh
@@ -1,11 +1,10 @@
 #!/bin/sh
+# Synced from cplieger/ci/configs/image-smoke.sh. Change it there.
 # Runtime image smoke-test harness: start the assembled image, wait for the
 # container's own HEALTHCHECK to report healthy, fail fast on an early exit, dump the
 # container log tail only on failure. Per-app knobs and hooks come from
 # tests/image-smoke.conf beside this script; smoke-tests.md "Pattern B" documents
 # every knob, every hook and what each tier proves.
-# CANONICAL COPY in cplieger/ci (configs/image-smoke.sh), synced to each enrolled
-# app's tests/image-smoke.sh: edit it there, never here.
 set -eu
 
 IMG="${1:?usage: image-smoke.sh <image-ref>}"