[dependabot]

Bumps the shared-ci group with 3 updates in the / directory: nix-forge/ci/actions/setup-nix, nix-forge/ci/actions/queue-completion and nix-forge/ci/actions/reconcile-queue.

Updates nix-forge/ci/actions/setup-nix from 2.12.0 to 2.13.0

Release notes

Sourced from nix-forge/ci/actions/setup-nix's releases.

nix-forge CI v2.13.0

Nix Forge CI v2.13.0

Changelog

• Reconcile all eligible package-source heads on a completion notification. This recovers ready heads when workflow concurrency replaces a pending callback.
• Read current PR identity, source refs and latest statuses in a GraphQL batch. Use a bounded native check-suite projection to defer healthy partial producers and recognize unchanged already-admitted results without writes.
• Preserve full immutable source, workflow, current-run and actual-job proofs for every new result or admission. Real failures retain their actual job URLs when another producer is running or absent. Changed attempts invalidate old source results. Truncated, missing and approval-only projections take the complete validation path.
• Replace callback workflow-name lookup with one direct dispatch request. Preserve legacy queue callback inputs and bounded visible notification retries.
• Pace opted-in package reconciliation content writes four seconds apart, including status, enqueue and validation dispatch requests. Package-source callers must allow 15 minutes in their own reconciler jobs for a paced six-head sweep.

A finite six-package fixture executes the actual reconciler for source notifications and all 30 queue completion callbacks. It preserves all 19 queue results and includes notification and candidate-dispatch requests. That fixture uses 831 REST requests. A separate 99-request source-inspection allowance brings the normal automation-layer accounting model to 930 requests. Live read-only GraphQL queries for the PR snapshot and six distinct native source heads each cost one point.

GitHub's standard repository token allows 1,000 REST requests per hour. Updater publication, native validation tools, repeated reruns and delayed producer completion consume additional requests. Completion callbacks retain their bounded wait when the producer is still running. The six native queue candidates execute serially, so these measured calls need not share one hour. These counts do not guarantee capacity for arbitrary bursts. The production rollout must verify the current single-package update through native validation and the protected queue.

Existing source start notifications remain asynchronous. They do not acknowledge that the reconciler has completed its status writes. Source completion notifications remain blocking after all actual validation jobs.

No token permissions or required native job gates change. The independently reviewed release-builder and repository-checks pins remain separate. Consumers without package-source reconciliation retain their existing callback contract.

The 192 repository regression tests passed locally. Required hosted validation and the protected normal merge queue must pass before publication. The signed

... (truncated)

Commits

• 1a6dfe0 Keep package-source reconciliation within the repository API budget (#84)
• e838f2c ci: advance automated merge queues after validation (#83)
• See full diff in compare view

Updates nix-forge/ci/actions/queue-completion from 2.12.0 to 2.13.0

Release notes

Sourced from nix-forge/ci/actions/queue-completion's releases.

nix-forge CI v2.13.0

Nix Forge CI v2.13.0

Changelog

• Reconcile all eligible package-source heads on a completion notification. This recovers ready heads when workflow concurrency replaces a pending callback.
• Read current PR identity, source refs and latest statuses in a GraphQL batch. Use a bounded native check-suite projection to defer healthy partial producers and recognize unchanged already-admitted results without writes.
• Preserve full immutable source, workflow, current-run and actual-job proofs for every new result or admission. Real failures retain their actual job URLs when another producer is running or absent. Changed attempts invalidate old source results. Truncated, missing and approval-only projections take the complete validation path.
• Replace callback workflow-name lookup with one direct dispatch request. Preserve legacy queue callback inputs and bounded visible notification retries.
• Pace opted-in package reconciliation content writes four seconds apart, including status, enqueue and validation dispatch requests. Package-source callers must allow 15 minutes in their own reconciler jobs for a paced six-head sweep.

A finite six-package fixture executes the actual reconciler for source notifications and all 30 queue completion callbacks. It preserves all 19 queue results and includes notification and candidate-dispatch requests. That fixture uses 831 REST requests. A separate 99-request source-inspection allowance brings the normal automation-layer accounting model to 930 requests. Live read-only GraphQL queries for the PR snapshot and six distinct native source heads each cost one point.

GitHub's standard repository token allows 1,000 REST requests per hour. Updater publication, native validation tools, repeated reruns and delayed producer completion consume additional requests. Completion callbacks retain their bounded wait when the producer is still running. The six native queue candidates execute serially, so these measured calls need not share one hour. These counts do not guarantee capacity for arbitrary bursts. The production rollout must verify the current single-package update through native validation and the protected queue.

Existing source start notifications remain asynchronous. They do not acknowledge that the reconciler has completed its status writes. Source completion notifications remain blocking after all actual validation jobs.

No token permissions or required native job gates change. The independently reviewed release-builder and repository-checks pins remain separate. Consumers without package-source reconciliation retain their existing callback contract.

The 192 repository regression tests passed locally. Required hosted validation and the protected normal merge queue must pass before publication. The signed

... (truncated)

Commits

• 1a6dfe0 Keep package-source reconciliation within the repository API budget (#84)
• e838f2c ci: advance automated merge queues after validation (#83)
• See full diff in compare view

Updates nix-forge/ci/actions/reconcile-queue from 2.12.0 to 2.13.0

Release notes

Sourced from nix-forge/ci/actions/reconcile-queue's releases.

nix-forge CI v2.13.0

Nix Forge CI v2.13.0

Changelog

• Reconcile all eligible package-source heads on a completion notification. This recovers ready heads when workflow concurrency replaces a pending callback.
• Read current PR identity, source refs and latest statuses in a GraphQL batch. Use a bounded native check-suite projection to defer healthy partial producers and recognize unchanged already-admitted results without writes.
• Preserve full immutable source, workflow, current-run and actual-job proofs for every new result or admission. Real failures retain their actual job URLs when another producer is running or absent. Changed attempts invalidate old source results. Truncated, missing and approval-only projections take the complete validation path.
• Replace callback workflow-name lookup with one direct dispatch request. Preserve legacy queue callback inputs and bounded visible notification retries.
• Pace opted-in package reconciliation content writes four seconds apart, including status, enqueue and validation dispatch requests. Package-source callers must allow 15 minutes in their own reconciler jobs for a paced six-head sweep.

A finite six-package fixture executes the actual reconciler for source notifications and all 30 queue completion callbacks. It preserves all 19 queue results and includes notification and candidate-dispatch requests. That fixture uses 831 REST requests. A separate 99-request source-inspection allowance brings the normal automation-layer accounting model to 930 requests. Live read-only GraphQL queries for the PR snapshot and six distinct native source heads each cost one point.

GitHub's standard repository token allows 1,000 REST requests per hour. Updater publication, native validation tools, repeated reruns and delayed producer completion consume additional requests. Completion callbacks retain their bounded wait when the producer is still running. The six native queue candidates execute serially, so these measured calls need not share one hour. These counts do not guarantee capacity for arbitrary bursts. The production rollout must verify the current single-package update through native validation and the protected queue.

Existing source start notifications remain asynchronous. They do not acknowledge that the reconciler has completed its status writes. Source completion notifications remain blocking after all actual validation jobs.

No token permissions or required native job gates change. The independently reviewed release-builder and repository-checks pins remain separate. Consumers without package-source reconciliation retain their existing callback contract.

The 192 repository regression tests passed locally. Required hosted validation and the protected normal merge queue must pass before publication. The signed

... (truncated)

Commits

• 1a6dfe0 Keep package-source reconciliation within the repository API budget (#84)
• e838f2c ci: advance automated merge queues after validation (#83)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions