AGENTS.md@.github/actions git:20261018.0fb97d8A

Immutable. This exact content never changes and is served at /api/v1/blob/c9f084926241e4aa.

# `.github/actions/` — technical reference

Repository-local composite actions for the CI pipeline. See
[`README.md`](README.md) for the purpose and conventions.

## Contract

- Each subdirectory is one composite action defined by an `action.yml`
  (`runs.using: composite`).
- Referenced from workflows as `uses: ./.github/actions/<name>`. The caller
  **must** run `actions/checkout` before the reference resolves; a local action
  is read from the checked-out workspace, not fetched.
- Third-party `uses:` inside an action are SHA-pinned with a `# vX.Y.Z` comment,
  identical to the policy in [`../workflows/ci.yml`](../workflows/ci.yml).

## Files

| Path | Role |
| --- | --- |
| [`setup-python-env/action.yml`](setup-python-env/action.yml) | uv + Python provisioning (see its [`AGENTS.md`](setup-python-env/AGENTS.md)). |
| [`setup-docs-lint/action.yml`](setup-docs-lint/action.yml) | Shared Node + Mermaid + Chrome provisioning for both blocking documentation-lint callers. |
| [`setup-meta-provider/action.yml`](setup-meta-provider/action.yml) | Genuine noneditable Meta wheel for Advanced and literature lifecycle tests. |
| [`setup-ci-execution-user/`](setup-ci-execution-user/README.md) | Fresh unprivileged Linux account, scoped pre-custody handoff and byte-identical readiness transport. |
| [`setup-native-installed-readiness/`](setup-native-installed-readiness/README.md) | Prepare Source-locked native tools and cached inputs before the installed original/reader/handoff operation. |
| [`upload-readiness-shards/`](upload-readiness-shards/README.md) | Check and upload exact bounded native/candidate transport or separately named failed diagnostics. |

## Editing

- Bump a shared action SHA here once; every calling job inherits it.
- After any change, run `actionlint` (CI parity: the `actionlint` job).
- Adding a new action directory requires its own `README.md` + `AGENTS.md`
  (the doc-pair invariant — `infrastructure/validation/docs/doc_pair_lint.py`).

The complete hosted acceptance workflow also uses
[`setup-acceptance-documents`](setup-acceptance-documents/README.md) and
[`setup-acceptance-model`](setup-acceptance-model/README.md) to prepare its
source-declared tools and one owned pinned local model before observations.

[`setup-acceptance-fixtures`](setup-acceptance-fixtures/README.md) materializes
identical pinned source inputs for all complete acceptance and release readers.

[`setup-native-offline-cache`](setup-native-offline-cache/README.md) shares the
Source-locked hash-required cache preparation between functional installed
contracts and complete native readiness.