chore(third-party-sync): update actions-template-sync to v2.6.0

third_party/AndreasAugustin/actions-template-sync/.all-contributorsrc

@@ -422,6 +422,15 @@
       "contributions": [
         "doc"
       ]
+    },
+    {
+      "login": "mzglinski",
+      "name": "mzglinski",
+      "avatar_url": "https://avatars.githubusercontent.com/u/23341314?v=4",
+      "profile": "https://github.com/mzglinski",
+      "contributions": [
+        "code"
+      ]
     }
   ],
   "contributorsPerLine": 7,

third_party/AndreasAugustin/actions-template-sync/.github/copilot-instructions.md

@@ -0,0 +1,48 @@
+# Copilot instructions
+
+## Repository overview
+
+- This repository contains the `actions-template-sync` GitHub Action.
+- The action implementation is shell-based and lives in `src/`.
+- Action metadata and environment wiring are defined in `action.yml`.
+- GitHub Actions workflows are stored in `.github/workflows/`.
+- Docker images and local development services are defined in `Dockerfile` and
+  `docker-compose.yml`.
+
+## Making changes
+
+- Keep changes focused and preserve the existing shell and YAML conventions.
+- Update documentation when changing action inputs, outputs, workflows, or
+  user-facing behavior.
+- Release-based syncing is controlled by `is_sync_to_latest_semver`; it selects
+  the latest semantic-version tag from the source remote. The
+  `is_include_prerelease` input only affects this mode and defaults to stable
+  releases.
+- When changing the release-selection logic, keep remote tag handling in
+  `src/sync_common.sh`, preserve support for lightweight and annotated tags,
+  and update `README.md` and `docs/ARCHITECTURE.md`.
+- Do not expose tokens, private keys, or other credentials in source,
+  workflows, logs, or examples.
+- Pin third-party GitHub Actions to full commit SHAs and include a comment
+  naming the released version.
+- Prefer existing Makefile targets and Docker services over adding new tooling.
+
+## Validation
+
+Run the smallest relevant checks for the files changed:
+
+```bash
+make shellcheck
+make markdownlint
+bash tests/sync_common_test.sh
+```
+
+For workflow or action changes, inspect `action.yml`, confirm input-to-
+environment wiring, and run the applicable workflow tests when available.
+
+## Commits and pull requests
+
+- Use Conventional Commits, for example:
+  `fix(sync): handle missing upstream branch`.
+- Follow the repository's pull request template.
+- Summarize behavior changes and validation in the pull request description.

third_party/AndreasAugustin/actions-template-sync/.github/dependabot.yml

@@ -4,9 +4,19 @@ updates:
   directory: "/"
   schedule:
     interval: "weekly"
+  groups:
+    github-actions-minor-and-patch:
+      update-types:
+      - "minor"
+      - "patch"
 - package-ecosystem: docker
   directory: "/"
   schedule:
     interval: weekly
     time: "04:00"
   open-pull-requests-limit: 10
+  groups:
+    docker-minor-and-patch:
+      update-types:
+      - "minor"
+      - "patch"

third_party/AndreasAugustin/actions-template-sync/.github/workflows/actions_template_sync.yml

@@ -7,6 +7,10 @@ on:
   # manual trigger
   workflow_dispatch:
 
+concurrency:
+  group: actions-template-sync-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   repo-sync:
     runs-on: ubuntu-latest
@@ -17,11 +21,11 @@ jobs:
     steps:
       # To use this repository's private action, you must check out the repository
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: actions-template-sync
-        uses: AndreasAugustin/actions-template-sync@v2
+        uses: AndreasAugustin/actions-template-sync@8a0f668b83c32a0f673353086d74f12b8853d4f5 # v2.5.3
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          source_gh_token: ${{ secrets.GITHUB_TOKEN }}
           source_repo_path: AndreasAugustin/template
           upstream_branch: main # defaults to main
           pr_labels: chore,📚 template-sync,example

third_party/AndreasAugustin/actions-template-sync/.github/workflows/ci.yml

@@ -0,0 +1,58 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - "!main"
+  pull_request:
+
+  workflow_call:
+
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: markdownlint
+        run: make markdownlint
+      - name: shell BDD tests
+        run: make shelltest
+      - name: prune
+        run: make prune
+
+  docker:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: build Docker images
+        run: |
+          docker build --target prod --tag actions-template-sync:prod .
+          docker build --target dev --tag actions-template-sync:dev .
+          docker build --target docs --tag actions-template-sync:docs .
+      - name: install container test tools
+        run: |
+          curl -LO https://storage.googleapis.com/container-structure-test/latest/container-structure-test-linux-amd64
+          chmod +x container-structure-test-linux-amd64
+          sudo mv container-structure-test-linux-amd64 /usr/local/bin/container-structure-test
+      - name: test Docker images
+        run: |
+          container-structure-test test \
+            --image actions-template-sync:prod \
+            --config docker-test-config.yml
+          container-structure-test test \
+            --image actions-template-sync:dev \
+            --config docker-test-config.yml
+          container-structure-test test \
+            --image actions-template-sync:docs \
+            --config docker-docs-test-config.yml

third_party/AndreasAugustin/actions-template-sync/.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,23 @@
+name: Copilot Setup Steps
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+concurrency:
+  group: copilot-setup-steps-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

third_party/AndreasAugustin/actions-template-sync/.github/workflows/gh_pages_mk_docs.yml

@@ -5,14 +5,18 @@ on:
       - main
   workflow_dispatch:
 
+concurrency:
+  group: gh-pages-mk-docs-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: write
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.x
       - run: pip install mkdocs-material

third_party/AndreasAugustin/actions-template-sync/.github/workflows/push_docker.yml

@@ -21,6 +21,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: push-docker-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build_and_push:
     runs-on: ubuntu-latest
@@ -35,31 +39,31 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: |
             andyaugustin/${{ matrix.variant }}
             ghcr.io/andreasaugustin/${{ matrix.variant }}
           tags: |
             type=semver,pattern={{raw}},value=${{ inputs.tag }}${{ matrix.target == 'dev' && '-dev' || '' }}
       - name: Build ${{ matrix.variant }}
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: ${{ matrix.target }}
@@ -82,15 +86,15 @@ jobs:
             --image ghcr.io/andreasaugustin/${{ matrix.variant }}:${{ inputs.tag }}${{ matrix.target == 'dev' && '-dev' || '' }}\
             --config docker-test-config.yml
       - name: push ${{ matrix.variant }}
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           target: ${{ matrix.target }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
       - name: Docker Hub Description
-        uses: peter-evans/dockerhub-description@v5
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

third_party/AndreasAugustin/actions-template-sync/.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   call_shellcheck:
     permissions:
@@ -13,7 +17,7 @@ jobs:
   call_lint:
     permissions:
       contents: read
-    uses: ./.github/workflows/lint.yml
+    uses: ./.github/workflows/ci.yml
   call_test_all:
     uses: ./.github/workflows/test_all.yml
     secrets: inherit

third_party/AndreasAugustin/actions-template-sync/.github/workflows/release_please.yml

@@ -12,6 +12,10 @@ on:
 
   workflow_dispatch:
 
+concurrency:
+  group: release-please-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: write
   pull-requests: write
@@ -23,11 +27,11 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
           release-type: simple
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: tag major and minor versions
         if: ${{ steps.release.outputs.release_created }}
         run: |

third_party/AndreasAugustin/actions-template-sync/.github/workflows/release_test_docker_images.yml

@@ -21,6 +21,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: release-test-docker-images-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   packages: read
 
@@ -33,17 +37,17 @@ jobs:
           - andyaugustin/actions-template-sync
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
           fetch-depth: 0
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}