ci: sync workflows from main

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/auto-update-sha.yml

@@ -1,147 +1,144 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-# FILE INFORMATION
-# DEFGROUP: GitHub.Workflow
-# INGROUP: MokoCassiopeia.Automation
-# REPO: https://github.com/mokoconsulting-tech/MokoCassiopeia
-# PATH: /.github/workflows/auto-update-sha.yml
-# VERSION: 01.00.00
-# BRIEF: Automatically update SHA-256 hash in updates.xml after release
-# NOTE: Ensures updates.xml stays synchronized with release packages
-
-name: Auto-Update SHA Hash
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag to update SHA for (e.g., 03.08.03)'
-        required: true
-        type: string
-
-permissions:
-  contents: write
-
-jobs:
-  update-sha:
-    name: Update SHA-256 Hash in updates.xml
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: main
-
-      - name: Get release tag
-        id: tag
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
-          else
-            TAG="${{ github.event.release.tag_name }}"
-          fi
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          echo "Processing release: ${TAG}"
-
-      - name: Download release package
-        run: |
-          TAG="${{ steps.tag.outputs.tag }}"
-          PACKAGE_NAME="mokocassiopeia-src-${TAG}.zip"
-          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${PACKAGE_NAME}"
-          
-          echo "Downloading: ${DOWNLOAD_URL}"
-          curl -L -o "${PACKAGE_NAME}" "${DOWNLOAD_URL}"
-          
-          if [ ! -f "${PACKAGE_NAME}" ]; then
-            echo "Error: Failed to download package"
-            exit 1
-          fi
-          
-          echo "PACKAGE_NAME=${PACKAGE_NAME}" >> $GITHUB_ENV
-
-      - name: Calculate SHA-256 hash
-        id: sha
-        run: |
-          SHA256_HASH=$(sha256sum "${PACKAGE_NAME}" | cut -d' ' -f1)
-          echo "sha256=${SHA256_HASH}" >> $GITHUB_OUTPUT
-          echo "SHA-256 Hash: ${SHA256_HASH}"
-
-      - name: Update updates.xml
-        run: |
-          TAG="${{ steps.tag.outputs.tag }}"
-          SHA256="${{ steps.sha.outputs.sha256 }}"
-          DATE=$(date +%Y-%m-%d)
-          
-          # Update version
-          sed -i "s|<version>.*</version>|<version>${TAG}</version>|" updates.xml
-          
-          # Update creation date
-          sed -i "s|<creationDate>.*</creationDate>|<creationDate>${DATE}</creationDate>|" updates.xml
-          
-          # Update download URL
-          sed -i "s|<downloadurl type='full' format='zip'>.*</downloadurl>|<downloadurl type='full' format='zip'>https://github.com/${{ github.repository }}/releases/download/${TAG}/mokocassiopeia-src-${TAG}.zip</downloadurl>|" updates.xml
-          
-          # Update or add SHA-256 hash
-          if grep -q "<sha256>" updates.xml; then
-            sed -i "s|<sha256>.*</sha256>|<sha256>sha256:${SHA256}</sha256>|" updates.xml
-          else
-            # Add SHA-256 after downloadurl
-            sed -i "/<\/downloadurl>/a\      <sha256>sha256:${SHA256}<\/sha256>" updates.xml
-          fi
-          
-          echo "Updated updates.xml with:"
-          echo "  Version: ${TAG}"
-          echo "  Date: ${DATE}"
-          echo "  SHA-256: ${SHA256}"
-
-      - name: Check for changes
-        id: changes
-        run: |
-          if git diff --quiet updates.xml; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-            echo "No changes to updates.xml"
-          else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-            echo "Changes detected in updates.xml"
-            git diff updates.xml
-          fi
-
-      - name: Commit and push changes
-        if: steps.changes.outputs.has_changes == 'true'
-        run: |
-          TAG="${{ steps.tag.outputs.tag }}"
-          
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-          
-          git add updates.xml
-          git commit -m "chore: Update SHA-256 hash for release ${TAG}
-
-Auto-generated by auto-update-sha workflow
-SHA-256: ${{ steps.sha.outputs.sha256 }}"
-          
-          git push origin main
-          
-          echo "Successfully updated updates.xml with SHA-256 hash for release ${TAG}"
-
-      - name: Summary
-        if: steps.changes.outputs.has_changes == 'true'
-        run: |
-          echo "### SHA-256 Hash Updated Successfully" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- Release: ${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
-          echo "- SHA-256: \`${{ steps.sha.outputs.sha256 }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "- File: updates.xml" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "The Joomla update server will now provide the correct package hash." >> $GITHUB_STEP_SUMMARY
-
-      - name: Summary (no changes)
-        if: steps.changes.outputs.has_changes == 'false'
-        run: |
-          echo "### No Updates Needed" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "updates.xml already contains the correct SHA-256 hash for release ${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# FILE INFORMATION
+# DEFGROUP: GitHub.Workflow
+# INGROUP: MokoCassiopeia.Automation
+# REPO: https://github.com/mokoconsulting-tech/MokoCassiopeia
+# PATH: /.github/workflows/auto-update-sha.yml
+# VERSION: 01.00.00
+# BRIEF: Automatically update SHA-256 hash in updates.xml after release
+# NOTE: Ensures updates.xml stays synchronized with release packages
+
+name: Auto-Update SHA Hash
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to update SHA for (e.g., 03.08.03)'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  update-sha:
+    name: Update SHA-256 Hash in updates.xml
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Get release tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            TAG="${{ inputs.tag }}"
+          else
+            TAG="${{ github.event.release.tag_name }}"
+          fi
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          echo "Processing release: ${TAG}"
+
+      - name: Download release package
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          PACKAGE_NAME="mokocassiopeia-src-${TAG}.zip"
+          DOWNLOAD_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${PACKAGE_NAME}"
+          
+          echo "Downloading: ${DOWNLOAD_URL}"
+          curl -L -o "${PACKAGE_NAME}" "${DOWNLOAD_URL}"
+          
+          if [ ! -f "${PACKAGE_NAME}" ]; then
+            echo "Error: Failed to download package"
+            exit 1
+          fi
+          
+          echo "PACKAGE_NAME=${PACKAGE_NAME}" >> $GITHUB_ENV
+
+      - name: Calculate SHA-256 hash
+        id: sha
+        run: |
+          SHA256_HASH=$(sha256sum "${PACKAGE_NAME}" | cut -d' ' -f1)
+          echo "sha256=${SHA256_HASH}" >> $GITHUB_OUTPUT
+          echo "SHA-256 Hash: ${SHA256_HASH}"
+
+      - name: Update updates.xml
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          SHA256="${{ steps.sha.outputs.sha256 }}"
+          DATE=$(date +%Y-%m-%d)
+          
+          # Update version
+          sed -i "s|<version>.*</version>|<version>${TAG}</version>|" updates.xml
+          
+          # Update creation date
+          sed -i "s|<creationDate>.*</creationDate>|<creationDate>${DATE}</creationDate>|" updates.xml
+          
+          # Update download URL
+          sed -i "s|<downloadurl type='full' format='zip'>.*</downloadurl>|<downloadurl type='full' format='zip'>https://github.com/${{ github.repository }}/releases/download/${TAG}/mokocassiopeia-src-${TAG}.zip</downloadurl>|" updates.xml
+          
+          # Update or add SHA-256 hash
+          if grep -q "<sha256>" updates.xml; then
+            sed -i "s|<sha256>.*</sha256>|<sha256>sha256:${SHA256}</sha256>|" updates.xml
+          else
+            # Add SHA-256 after downloadurl
+            sed -i "/<\/downloadurl>/a\      <sha256>sha256:${SHA256}<\/sha256>" updates.xml
+          fi
+          
+          echo "Updated updates.xml with:"
+          echo "  Version: ${TAG}"
+          echo "  Date: ${DATE}"
+          echo "  SHA-256: ${SHA256}"
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet updates.xml; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "No changes to updates.xml"
+          else
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+            echo "Changes detected in updates.xml"
+            git diff updates.xml
+          fi
+
+      - name: Commit and push changes
+        if: steps.changes.outputs.has_changes == 'true'
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+          
+          git add updates.xml
+          git commit -m "chore: Update SHA-256 hash for release ${TAG} - SHA: ${{ steps.sha.outputs.sha256 }}"
+          
+          git push origin main
+          
+          echo "Successfully updated updates.xml with SHA-256 hash for release ${TAG}"
+
+      - name: Summary
+        if: steps.changes.outputs.has_changes == 'true'
+        run: |
+          echo "### SHA-256 Hash Updated Successfully" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- Release: ${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
+          echo "- SHA-256: \`${{ steps.sha.outputs.sha256 }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- File: updates.xml" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "The Joomla update server will now provide the correct package hash." >> $GITHUB_STEP_SUMMARY
+
+      - name: Summary (no changes)
+        if: steps.changes.outputs.has_changes == 'false'
+        run: |
+          echo "### No Updates Needed" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "updates.xml already contains the correct SHA-256 hash for release ${{ steps.tag.outputs.tag }}" >> $GITHUB_STEP_SUMMARY

.github/workflows/repo_health.yml

@@ -162,7 +162,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
@@ -257,7 +257,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
@@ -371,7 +371,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0