chore(deps): bump tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml from 2.13.0 to 3.1.0

[dependabot]

Bumps tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml from 2.13.0 to 3.1.0.

Release notes

Sourced from tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml's releases.

v3.1.0

[3.1.0] — 2026-08-19

This section releases as v3.1.0 (MINOR) per RELEASING.md: a new optional input, with the default preserving today's behaviour byte-for-byte. No existing caller changes, and no repo that passes CI today starts failing.

This bump silently upgrades gitleaks 8.21.2 → 8.30.1 for every spoke-ci.yml consumer (via the @v2→@v3 internal-ref bump below) — spokes with [[allowlists]] will see them honored for the first time.

Added

• TIN-3815: allowed_repo_roles input on spoke-ci.yml — makes the repo-manifest role census caller-configurable, so a repo whose ratified taxonomy.primary_role is not a static-spoke variant can run this lane without a template edit. Accepts a comma-separated list or a JSON array; both normalize identically (surrounding brackets, quotes, and whitespace are stripped before the comma split, so there is no second code path).

  Where the normalization runs is part of the contract. The JSON→comma conversion is done by the workflow (startsWith/fromJSON/join), not by the composite action. A uses: step resolves the action at its own ref, so an action-side rule ships only when a release moves that ref — and never for the restricted variant, whose closure is pinned to an exact release by contract. Verified against the real tags before choosing: git show v2:.github/actions/repo-manifest-validate/action.yml and its v3 equivalent both comma-split with no stripping, so an action-side normalization would have been a JSON promise the shipped artifact did not keep. The workflow file is what a consumer pins, so the rule lives there and holds at every action ref. repo-role-census-contract.rb pins that expression byte-for-byte and refuses to render any other shape.

  The defect was two hardcoded sites, not one. spoke-ci.yml pinned required_roles: static-spoke,static-spoke-scaffold at the repo-manifest job and again at the cache_backed lane's manifest gate inside flywheel-build — independently. A spoke could satisfy one and fail the other, and a fix applied to either would have looked complete. Both are threaded now, and so are the matching pair in spoke-ci-restricted.yml.

  New just repo-role-census-contract-check (+ -selftest, 9 negative oracles) therefore asserts a site census first and values second: the set of repo-manifest-validate invocations is pinned, and every one must route through the input — add a third census site without threading it and the build fails. It then proves allowed_repo_roles unset renders the pinned pre-TIN-3815 literal byte-for-byte, set threads the caller's value verbatim, and spoke-ci-restricted.yml matches site for site. The oracles reject each site left hardcoded (separately), a silently widened or narrowed default, an undeclared input, a dropped required_roles, an untreaded new site, and restricted-variant drift.

... (truncated)

Changelog

Sourced from tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml's changelog.

[3.1.0] — 2026-08-19

This section releases as v3.1.0 (MINOR) per RELEASING.md: a new optional input, with the default preserving today's behaviour byte-for-byte. No existing caller changes, and no repo that passes CI today starts failing.

This bump silently upgrades gitleaks 8.21.2 → 8.30.1 for every spoke-ci.yml consumer (via the @v2→@v3 internal-ref bump below) — spokes with [[allowlists]] will see them honored for the first time.

Added

• TIN-3815: allowed_repo_roles input on spoke-ci.yml — makes the repo-manifest role census caller-configurable, so a repo whose ratified taxonomy.primary_role is not a static-spoke variant can run this lane without a template edit. Accepts a comma-separated list or a JSON array; both normalize identically (surrounding brackets, quotes, and whitespace are stripped before the comma split, so there is no second code path).

  Where the normalization runs is part of the contract. The JSON→comma conversion is done by the workflow (startsWith/fromJSON/join), not by the composite action. A uses: step resolves the action at its own ref, so an action-side rule ships only when a release moves that ref — and never for the restricted variant, whose closure is pinned to an exact release by contract. Verified against the real tags before choosing: git show v2:.github/actions/repo-manifest-validate/action.yml and its v3 equivalent both comma-split with no stripping, so an action-side normalization would have been a JSON promise the shipped artifact did not keep. The workflow file is what a consumer pins, so the rule lives there and holds at every action ref. repo-role-census-contract.rb pins that expression byte-for-byte and refuses to render any other shape.

  The defect was two hardcoded sites, not one. spoke-ci.yml pinned required_roles: static-spoke,static-spoke-scaffold at the repo-manifest job and again at the cache_backed lane's manifest gate inside flywheel-build — independently. A spoke could satisfy one and fail the other, and a fix applied to either would have looked complete. Both are threaded now, and so are the matching pair in spoke-ci-restricted.yml.

  New just repo-role-census-contract-check (+ -selftest, 9 negative oracles) therefore asserts a site census first and values second: the set of repo-manifest-validate invocations is pinned, and every one must route through the input — add a third census site without threading it and the build fails. It then proves allowed_repo_roles unset renders the pinned pre-TIN-3815 literal byte-for-byte, set threads the caller's value verbatim, and spoke-ci-restricted.yml matches site for site. The oracles reject each site left hardcoded (separately), a silently widened or narrowed default, an undeclared input, a dropped required_roles, an untreaded new site, and restricted-variant drift.

... (truncated)

Commits

• d8d178c Merge pull request #143 from tinyland-inc/feature/v3.1.0-release-20260819
• 24e134b release: v3.1.0
• 28d6777 Merge pull request #142 from tinyland-inc/feat/tin-3815-repo-role-input
• 00e64ce fix(ci): name TIN-3914 as the internal-ref debt ledger owner (TIN-3815 review)
• afc2220 fix(spoke-ci): normalize allowed_repo_roles in the workflow; unfreeze the v2-...
• c82235a feat(spoke-ci): make the repo-role census configurable; admit app-stateful-sp...
• 8a0e2d3 Merge pull request #141 from tinyland-inc/feature/v3.0.0-release-20260819
• 4fc4870 release: v3.0.0
• a550e4b Merge pull request #140 from tinyland-inc/feat/tin-3914-no-hosted-runners
• 1679a56 fix(ci): close the two hosted escapes the fail-closed claim missed (TIN-3914 ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)