AGENTS.md@.github/actions git:20261028.b7cb304A

Immutable. This exact content never changes and is served at /api/v1/blob/0434f46da97b3b9c.

# `.github/actions/` — technical reference

Repository-local composite actions for the CI pipeline. See
[`README.md`](README.md) for the purpose and conventions.

## Contract

- Each subdirectory is one composite action defined by an `action.yml`
  (`runs.using: composite`).
- Referenced from workflows as `uses: ./.github/actions/<name>`. The caller
  **must** run `actions/checkout` before the reference resolves; a local action
  is read from the checked-out workspace, not fetched.
- Third-party `uses:` inside an action are SHA-pinned with a `# vX.Y.Z` comment,
  identical to the policy in [`../workflows/ci.yml`](../workflows/ci.yml).

## Files

| Path | Role |
| --- | --- |
| [`setup-python-env/action.yml`](setup-python-env/action.yml) | uv + Python provisioning (see its [`AGENTS.md`](setup-python-env/AGENTS.md)). |
| [`setup-docs-lint/action.yml`](setup-docs-lint/action.yml) | Shared Node + Mermaid + Chrome provisioning for both blocking documentation-lint callers. |
| [`setup-actionlint/action.yml`](setup-actionlint/AGENTS.md) | Single `actionlint` pin, installer SHA-256 verification, and run. |
| [`run-public-lint/action.yml`](run-public-lint/AGENTS.md) | Public-scope Ruff/type gates, concurrently, with one aggregated status. |
| [`run-tracked-guards/action.yml`](run-tracked-guards/AGENTS.md) | Sequential tracked-tree guards (resources, secrets, generated artifacts). |
| [`run-safety-scan/action.yml`](run-safety-scan/AGENTS.md) | Bandit MEDIUM+ and no-mocks, shared by both workflows. |
| [`check-browser/action.yml`](check-browser/AGENTS.md) | Installed-Chrome selection for native consumer controls. |
| [`setup-tex-toolchain/action.yml`](setup-tex-toolchain/AGENTS.md) | Cached xelatex/bibtex provisioning for the slow and rehearsal lanes. |
| [`setup-meta-provider/action.yml`](setup-meta-provider/action.yml) | Genuine noneditable Meta wheel for Advanced and literature lifecycle tests. |
| [`setup-ci-execution-user/`](setup-ci-execution-user/README.md) | Fresh unprivileged Linux account, scoped pre-custody handoff and byte-identical readiness transport. |
| [`setup-native-installed-readiness/`](setup-native-installed-readiness/README.md) | Prepare Source-locked native tools and cached inputs before the installed original/reader/handoff operation. |
| [`upload-readiness-shards/`](upload-readiness-shards/README.md) | Check and upload exact bounded native/candidate transport or separately named failed diagnostics. |

## Editing

- Bump a shared action SHA here once; every calling job inherits it.
- After any change, run `actionlint` (CI parity: the `actionlint` job).
- Adding a new action directory requires its own `README.md` + `AGENTS.md`
  (the doc-pair invariant — `infrastructure/validation/docs/doc_pair_lint.py`).

The complete hosted acceptance workflow also uses
[`setup-acceptance-documents`](setup-acceptance-documents/README.md) and
[`setup-acceptance-model`](setup-acceptance-model/README.md) to prepare its
source-declared tools and one owned pinned local model before observations.

[`setup-acceptance-fixtures`](setup-acceptance-fixtures/README.md) materializes
identical pinned source inputs for all complete acceptance and release readers.

[`setup-native-offline-cache`](setup-native-offline-cache/README.md) shares the
Source-locked hash-required cache preparation between functional installed
contracts and complete native readiness.