ci: update release actions and use published design tokens

.github/workflows/build.yml

@@ -67,14 +67,10 @@ jobs:
         run: npm run test:ui && npm run build
 
       # The offline half of this guard runs in test:ui above. This half needs
-      # the network: it fails when openadapt-web moves the canonical palette and
+      # the network: it fails when openadapt-web publishes the canonical palette and
       # the vendored copy here does not follow, which is how the installed app
       # and the marketing site drift into looking like two products.
       - name: Check the vendored design tokens against openadapt-web
-        env:
-          # github.token cannot read private OpenAdaptAI/openadapt-web.
-          # ADMIN_TOKEN can; fall back so local/fork runs still try github.token.
-          GITHUB_TOKEN: ${{ secrets.ADMIN_TOKEN || github.token }}
         run: npm run tokens:check
 
   python-distribution:

.github/workflows/native-release.yml

@@ -630,7 +630,7 @@ jobs:
         run: python scripts/native_release.py validate-set --directory release-assets
 
       - name: Generate a machine-readable SBOM from the exact installer set
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           path: release-assets
           format: cyclonedx-json

.github/workflows/release.yml

@@ -141,7 +141,7 @@ jobs:
       - name: Python Semantic Release
         if: steps.check_skip.outputs.skip != 'true'
         id: release
-        uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1
+        uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2
         with:
           github_token: ${{ secrets.ADMIN_TOKEN }}
 
@@ -151,7 +151,7 @@ jobs:
 
       - name: Publish to GitHub Releases
         if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'
-        uses: python-semantic-release/publish-action@5a5718ce47b892ef699f2972dae122297771d641 # v10.6.1
+        uses: python-semantic-release/publish-action@6d89e2de8d40ecb3717316ecbbf15a6fa8ea9039 # v10.6.2
         with:
           github_token: ${{ secrets.ADMIN_TOKEN }}
 

pyproject.toml

@@ -120,7 +120,7 @@ packages = ["engine"]
 
 # python-semantic-release 10.6.2 still accepts click 8.1.8, which pip-audit
 # reports as PYSEC-2026-2132 (fix: 8.3.3). The GitHub Action is SHA-pinned at
-# v10.6.1 and does not use this lock; the constraint keeps the local extra
+# v10.6.2 and does not use this lock; the constraint keeps the local extra
 # from regressing the audited tree.
 [tool.uv]
 constraint-dependencies = ["click>=8.3.3"]

scripts/vendor-design-tokens.mjs

@@ -26,28 +26,19 @@ const write = process.argv.includes('--write');
 const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
 
 async function fetchCanonical(entry) {
-  // openadapt-web is private, so raw.githubusercontent.com 404s. CI already
-  // passes GITHUB_TOKEN; use the Contents API the same way --write does.
-  const token = process.env.GITHUB_TOKEN;
-  if (token) {
-    const url =
-      `https://api.github.com/repos/${provenance.canonical_repository}` +
-      `/contents/${entry.canonical_path}` +
-      `?ref=${encodeURIComponent(provenance.canonical_branch)}`;
-    const response = await fetch(url, {
-      headers: {
-        accept: 'application/vnd.github.raw',
-        authorization: `Bearer ${token}`,
-      },
-    });
-    if (!response.ok) {
-      throw new Error(`GET ${url} -> HTTP ${response.status}`);
-    }
-    return Buffer.from(await response.arrayBuffer());
+  // Web publishes byte-identical canonical files during its build. Public
+  // reads also work for Dependabot and fork PRs without private-repo tokens.
+  const url = write
+    ? `https://api.github.com/repos/${provenance.canonical_repository}` +
+      `/contents/${entry.canonical_path}?ref=${encodeURIComponent(provenance.canonical_branch)}`
+    : `https://openadapt.ai/${entry.canonical_path}`;
+  const headers = { accept: write ? 'application/vnd.github.raw' : 'text/plain' };
+  if (write && process.env.GITHUB_TOKEN) {
+    headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
   }
-  const response = await fetch(entry.raw_url, { headers: { accept: 'text/plain' } });
+  const response = await fetch(url, { headers });
   if (!response.ok) {
-    throw new Error(`GET ${entry.raw_url} -> HTTP ${response.status}`);
+    throw new Error(`GET ${url} -> HTTP ${response.status}`);
   }
   return Buffer.from(await response.arrayBuffer());
 }
@@ -90,7 +81,7 @@ for (const [name, entry] of Object.entries(provenance.files)) {
 
   if (canonicalSha !== vendoredSha) {
     failures.push(
-      `${name}: drifted from ${provenance.canonical_repository}@${provenance.canonical_branch}.\n` +
+      `${name}: drifted from the published ${provenance.canonical_repository} palette.\n` +
         `  canonical ${entry.canonical_path} is ${canonicalSha}\n` +
         `  the vendored copy is      ${vendoredSha}\n` +
         `  Run: node scripts/vendor-design-tokens.mjs --write`,
@@ -113,4 +104,4 @@ if (failures.length > 0) {
   process.exit(1);
 }
 
-console.log(`\nVendored design tokens match ${provenance.canonical_repository}@${provenance.canonical_branch}.`);
+console.log(`\nVendored design tokens match the published ${provenance.canonical_repository} palette.`);

tests/test_public_metadata.py

@@ -180,7 +180,7 @@ def test_release_workflow_uses_matching_pinned_actions() -> None:
 
     assert uses
     assert all(re.fullmatch(r"[0-9a-f]{40}", revision) for revision in uses)
-    assert "# v10.6.1" in workflow
+    assert "# v10.6.2" in workflow
     assert "# v9.15.2" not in workflow
     assert "token: ${{ secrets.ADMIN_TOKEN }}" in workflow
     assert workflow.count("github_token: ${{ secrets.ADMIN_TOKEN }}") == 2
@@ -223,7 +223,7 @@ def test_dev_semantic_release_floor_matches_the_pinned_v10_action() -> None:
         lock,
         flags=re.MULTILINE,
     )
-    assert "# v10.6.1" in workflow
+    assert "# v10.6.2" in workflow
     assert "python-semantic-release>=9" not in "\n".join(dev)
     assert "  push:" not in workflow[workflow.index("\non:\n") : workflow.index("\njobs:\n")]
     uv = pyproject["tool"]["uv"]