AGENTS.md@.github/actions · diff
git:20261013.03dda1a to git:20261016.06941a5
1 added, 0 removed. Audit A to A.
# `.github/actions/` — technical reference
Repository-local composite actions for the CI pipeline. See
[`README.md`](README.md) for the purpose and conventions.
## Contract
- Each subdirectory is one composite action defined by an `action.yml`
(`runs.using: composite`).
- Referenced from workflows as `uses: ./.github/actions/<name>`. The caller
**must** run `actions/checkout` before the reference resolves; a local action
is read from the checked-out workspace, not fetched.
- Third-party `uses:` inside an action are SHA-pinned with a `# vX.Y.Z` comment,
identical to the policy in [`../workflows/ci.yml`](../workflows/ci.yml).
## Files
| Path | Role |
| --- | --- |
| [`setup-python-env/action.yml`](setup-python-env/action.yml) | uv + Python provisioning (see its [`AGENTS.md`](setup-python-env/AGENTS.md)). |
| [`setup-docs-lint/action.yml`](setup-docs-lint/action.yml) | Shared Node + Mermaid + Chrome provisioning for both blocking documentation-lint callers. |
| [`setup-meta-provider/action.yml`](setup-meta-provider/action.yml) | Genuine noneditable Meta wheel for Advanced and literature lifecycle tests. |
+ | [`setup-ci-execution-user/`](setup-ci-execution-user/README.md) | Fresh unprivileged Linux account, scoped pre-custody handoff and byte-identical readiness transport. |
| [`setup-native-installed-readiness/`](setup-native-installed-readiness/README.md) | Prepare Source-locked native tools and cached inputs before the installed original/reader/handoff operation. |
| [`upload-readiness-shards/`](upload-readiness-shards/README.md) | Check and upload exact bounded native/candidate transport or separately named failed diagnostics. |
## Editing
- Bump a shared action SHA here once; every calling job inherits it.
- After any change, run `actionlint` (CI parity: the `actionlint` job).
- Adding a new action directory requires its own `README.md` + `AGENTS.md`
(the doc-pair invariant — `infrastructure/validation/docs/doc_pair_lint.py`).
The complete hosted acceptance workflow also uses
[`setup-acceptance-documents`](setup-acceptance-documents/README.md) and
[`setup-acceptance-model`](setup-acceptance-model/README.md) to prepare its
source-declared tools and one owned pinned local model before observations.
[`setup-acceptance-fixtures`](setup-acceptance-fixtures/README.md) materializes
identical pinned source inputs for all complete acceptance and release readers.