chore: merge dev into main

.github/workflows/ci.yml

@@ -9,15 +9,17 @@ on:
       - main
       - dev
     types: [opened, synchronize, reopened, ready_for_review]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - LICENSE
+
+# NO `paths-ignore`, AND THAT IS THE POINT OF THE GATE. A change touching only
+# prose cannot break a lint — but a workflow that does not TRIGGER reports no
+# check at all, and a required check that never reports does not pass the merge,
+# it blocks it forever. `CI / Gate` is meant to be a required check, so this
+# workflow has to run on every pull request, including a README-only one.
 
 permissions:
   contents: read
 
 jobs:
   check:
     name: CI
-    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_ci-check.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0

.github/workflows/codeql.yml

@@ -24,4 +24,4 @@ jobs:
       packages: read
       actions: read
       contents: read
-    uses: kirchDev/workflows/.github/workflows/_codeql.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_codeql.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0

.github/workflows/fast-forward-queue.yml

@@ -26,7 +26,7 @@ jobs:
       pull-requests: read
       checks: read
       statuses: read
-    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_fast-forward-queue.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       pr: ${{ inputs.pr }}
     secrets:

.github/workflows/promotion-pr.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   promotion-pr:
     name: Promotion PR
-    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_promotion-pr.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0

.github/workflows/release-please.yml

@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: kirchDev/workflows/.github/workflows/_release-please.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_release-please.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       # This repo is consumed as `kirchDev/coverage-report@<ref>`, so `@v0` has
       # to keep meaning "the newest v0.x.y".
@@ -41,7 +41,7 @@ jobs:
       # NPM_TOKEN exists in this repo; npm verifies this workflow against the
       # trusted publisher configured on the package.
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       tag-name: ${{ needs.release-please.outputs.tag-name }}
       # The npm artifact is lib/, built by build:npm — not the action bundle in
@@ -63,7 +63,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@f81bbe5fb5e8055b55a1ef5f861cc63a8e253622 # v0.1.3
+    uses: kirchDev/workflows/.github/workflows/_publish-npm.yml@bec834b87a96c8c1dbf2c7cb28f774e9173e32d7 # v0.2.0
     with:
       prerelease: true
       build-script: build:npm