chore: close the remaining immich parity gaps

.github/workflows/adapters.yml

@@ -25,12 +25,15 @@ jobs:
       tier-a: ${{ steps.tiers.outputs.tier-a }}
       tier-b: ${{ steps.tiers.outputs.tier-b }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - id: tiers
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Discover the adapter tiers
+        id: tiers
         env:
           EVENT_NAME: ${{ github.event_name }}
           SCHEDULE_CRON: ${{ github.event.schedule }}
@@ -54,22 +57,28 @@ jobs:
       matrix:
         adapter: ${{ fromJson(needs.discover.outputs.tier-a) }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - id: language
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Detect the adapter language
+        id: language
         env:
           ADAPTER: ${{ matrix.adapter }}
         run: |
           lang="$(grep '^ADAPTER_LANGUAGE=' "adapters/${ADAPTER}/adapter.env" | cut -d'"' -f2)"
           echo "value=${lang}" >> "$GITHUB_OUTPUT"
-      - if: steps.language.outputs.value == 'php'
+      - name: Setup PHP
+        if: steps.language.outputs.value == 'php'
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - env:
+      - name: Run the tier-a smoke test
+        env:
           ADAPTER: ${{ matrix.adapter }}
         run: bats "tests/new-${ADAPTER}.bats"
 
@@ -87,22 +96,28 @@ jobs:
       matrix:
         adapter: ${{ fromJson(needs.discover.outputs.tier-b) }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - id: language
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Detect the adapter language
+        id: language
         env:
           ADAPTER: ${{ matrix.adapter }}
         run: |
           lang="$(grep '^ADAPTER_LANGUAGE=' "adapters/${ADAPTER}/adapter.env" | cut -d'"' -f2)"
           echo "value=${lang}" >> "$GITHUB_OUTPUT"
-      - if: steps.language.outputs.value == 'php'
+      - name: Setup PHP
+        if: steps.language.outputs.value == 'php'
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - env:
+      - name: Run the tier-b smoke test
+        env:
           ADAPTER: ${{ matrix.adapter }}
         run: bats "tests/new-${ADAPTER}.bats"
 
@@ -119,22 +134,28 @@ jobs:
       matrix:
         adapter: ${{ fromJson(needs.discover.outputs.tier-a) }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - id: language
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Detect the adapter language
+        id: language
         env:
           ADAPTER: ${{ matrix.adapter }}
         run: |
           lang="$(grep '^ADAPTER_LANGUAGE=' "adapters/${ADAPTER}/adapter.env" | cut -d'"' -f2)"
           echo "value=${lang}" >> "$GITHUB_OUTPUT"
-      - if: steps.language.outputs.value == 'php'
+      - name: Setup PHP
+        if: steps.language.outputs.value == 'php'
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - env:
+      - name: Run the deploy check
+        env:
           ADAPTER: ${{ matrix.adapter }}
         run: ./scripts/deploy-check.sh "$ADAPTER"
 
@@ -151,22 +172,28 @@ jobs:
       matrix:
         adapter: ${{ fromJson(needs.discover.outputs.tier-b) }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - id: language
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Detect the adapter language
+        id: language
         env:
           ADAPTER: ${{ matrix.adapter }}
         run: |
           lang="$(grep '^ADAPTER_LANGUAGE=' "adapters/${ADAPTER}/adapter.env" | cut -d'"' -f2)"
           echo "value=${lang}" >> "$GITHUB_OUTPUT"
-      - if: steps.language.outputs.value == 'php'
+      - name: Setup PHP
+        if: steps.language.outputs.value == 'php'
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - env:
+      - name: Run the deploy check
+        env:
           ADAPTER: ${{ matrix.adapter }}
         run: ./scripts/deploy-check.sh "$ADAPTER"
 
@@ -180,12 +207,16 @@ jobs:
       contents: read
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - run: ./scripts/deploy-check.sh nextjs nestjs --db postgres
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Run the deploy check for two apps
+        run: ./scripts/deploy-check.sh nextjs nestjs --db postgres
 
   compose:
     # expensive relative to the other checks here, so gated on the weekly
@@ -196,14 +227,18 @@ jobs:
       contents: read
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Setup PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - run: bats tests/compose.bats
+      - name: Run the compose tests
+        run: bats tests/compose.bats
 
   services:
     # Eight combinations per adapter at minutes each, so the full grid is
@@ -220,22 +255,28 @@ jobs:
         db: [mysql, postgres, mongodb, none]
         cache: [none, redis]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - id: language
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Detect the adapter language
+        id: language
         env:
           ADAPTER: ${{ matrix.adapter }}
         run: |
           lang="$(grep '^ADAPTER_LANGUAGE=' "adapters/${ADAPTER}/adapter.env" | cut -d'"' -f2)"
           echo "value=${lang}" >> "$GITHUB_OUTPUT"
-      - if: steps.language.outputs.value == 'php'
+      - name: Setup PHP
+        if: steps.language.outputs.value == 'php'
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - env:
+      - name: Generate the project and run its checklist
+        env:
           ADAPTER: ${{ matrix.adapter }}
           DB: ${{ matrix.db }}
           CACHE: ${{ matrix.cache }}
@@ -266,7 +307,8 @@ jobs:
       issues: write
     timeout-minutes: 5
     steps:
-      - env:
+      - name: Open an issue for the failed run
+        env:
           GH_TOKEN: ${{ github.token }}
         run: >-
           gh issue create --repo "${{ github.repository }}"

.github/workflows/ci.yml

@@ -22,11 +22,14 @@ jobs:
     # on a runner, which is what the timeout below leaves room around.
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: mise run ci-unit
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Run the unit lane
+        run: mise run ci-unit
 
   integration:
     runs-on: ubuntu-latest
@@ -39,36 +42,44 @@ jobs:
     # tests, not these cross-cutting mechanics suites.
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # workflows.bats walks this repository's own history to find the
           # commit that introduced an adapter, then diffs against its parent.
           # A default checkout has one commit and no parent, so the test fails
           # on `unknown revision` rather than on anything it is testing.
           fetch-depth: 0
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
-      - run: corepack enable
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Enable corepack
+        run: corepack enable
+      - name: Setup PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: "8.3"
-      - run: mise run test-integration
+      - name: Run the integration lane
+        run: mise run test-integration
 
   zizmor:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       # Only this repository's own workflows. common/ holds templates whose
       # `uses: you/.github/...` names no real repository, so ref-confusion
       # cannot resolve it and the audit errors out rather than reporting a
       # finding — a failure about the placeholder, not about the pipeline.
       # What a generated project's call sites get instead is structural:
       # tests/workflows.bats asserts sha-pinned actions, closed permission
       # sets and shared-repository-only `uses:`. No audit runs on them.
-      - run: mise exec -- zizmor .github/workflows/
+      - name: Run zizmor
+        run: mise exec -- zizmor .github/workflows/

.github/workflows/provenance.yml

@@ -24,15 +24,19 @@ jobs:
       contents: read
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      - name: Setup mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       # tests/provenance.bats needs a local upstream clone the same as
       # check does below — its own copy here, the way adapters.yml's
       # tier-b matrix legs each do their own generation independently.
-      - run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich"
-      - env:
+      - name: Clone upstream immich
+        run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich"
+      - name: Run the provenance self-test
+        env:
           SCAFFOLD_UPSTREAM_CLONE: ${{ runner.temp }}/immich
         run: bats tests/provenance.bats
 
@@ -44,14 +48,17 @@ jobs:
       issues: write
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # check-provenance.sh has no network fallback of its own (a denied
       # fetch must fail loudly, not read as "everything drifted"); a
       # partial clone gets the full commit graph without every blob.
-      - run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich"
-      - id: check
+      - name: Clone upstream immich
+        run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich"
+      - name: Check for upstream drift
+        id: check
         env:
           SCAFFOLD_UPSTREAM_CLONE: ${{ runner.temp }}/immich
         run: ./scripts/check-provenance.sh | tee "${RUNNER_TEMP}/report.txt"
@@ -60,7 +67,8 @@ jobs:
       # this step would silently never run. failure() first makes the
       # step eligible; steps.check.outcome narrows it to the real check
       # specifically, not some other step failing.
-      - if: failure() && steps.check.outcome == 'failure'
+      - name: Open an issue for upstream drift
+        if: failure() && steps.check.outcome == 'failure'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |

.github/workflows/pull-request.yml

@@ -30,10 +30,12 @@ jobs:
       contents: read
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - env:
+      - name: Check the pull request body against the template
+        env:
           BODY: ${{ github.event.pull_request.body }}
         run: |
           missing=""

.vscode/extensions.json

@@ -0,0 +1,7 @@
+{
+  "recommendations": [
+    "timonwong.shellcheck",
+    "foxundermoon.shell-format",
+    "editorconfig.editorconfig"
+  ]
+}