chore: align files according to platform standards

.github/workflows/zz_generated.add-team-labels.yaml

@@ -16,12 +16,13 @@ jobs:
         GH_TOKEN: ${{ secrets.ISSUE_AUTOMATION }}
       run: |
         mkdir -p artifacts
-        gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
+        # The raw media type returns the file itself. No pipe after gh api, so
+        # a 404 fails the step under bash -e instead of writing garbage.
+        gh api -H "Accept: application/vnd.github.raw" -H "X-GitHub-Api-Version: 2022-11-28" \
           /repos/giantswarm/github/contents/tools/issue-automation/user-mapping.yaml \
-          | jq -r '.content' \
-          | base64 -d > artifacts/users.yaml
+          > artifacts/users.yaml
     - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: users
         path: artifacts/users.yaml
@@ -32,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build_user_list
     steps:
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
       id: download-users
       with:
         name: users

.github/workflows/zz_generated.add-to-project-board.yaml

@@ -3,13 +3,15 @@ name: Add Issue to Project when assigned
 on:
   issues:
     types:
+    - opened
     - assigned
     - labeled
 
 jobs:
   build_user_list:
     name: Get yaml config of GS users
     runs-on: ubuntu-latest
+    if: github.event.action != 'opened'
     permissions:
       contents: read
     steps:
@@ -18,12 +20,13 @@ jobs:
         GH_TOKEN: ${{ secrets.ISSUE_AUTOMATION }}
       run: |
         mkdir -p artifacts
-        gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
+        # The raw media type returns the file itself. No pipe after gh api, so
+        # a 404 fails the step under bash -e instead of writing garbage.
+        gh api -H "Accept: application/vnd.github.raw" -H "X-GitHub-Api-Version: 2022-11-28" \
           /repos/giantswarm/github/contents/tools/issue-automation/user-mapping.yaml \
-          | jq -r '.content' \
-          | base64 -d > artifacts/users.yaml
+          > artifacts/users.yaml
     - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: users
         path: artifacts/users.yaml
@@ -33,12 +36,11 @@ jobs:
         GH_TOKEN: ${{ secrets.ISSUE_AUTOMATION }}
       run: |
         mkdir -p artifacts
-        gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
+        gh api -H "Accept: application/vnd.github.raw" -H "X-GitHub-Api-Version: 2022-11-28" \
           /repos/giantswarm/github/contents/tools/issue-automation/label-mapping.yaml \
-          | jq -r '.content' \
-          | base64 -d > artifacts/labels.yaml
+          > artifacts/labels.yaml
     - name: Upload Artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: labels
         path: artifacts/labels.yaml
@@ -50,7 +52,7 @@ jobs:
     needs: build_user_list
     if: github.event.action == 'assigned'
     steps:
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
       id: download-users
       with:
         name: users
@@ -76,7 +78,7 @@ jobs:
     needs: build_user_list
     if: github.event.action == 'labeled'
     steps:
-    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
       id: download-labels
       with:
         name: labels
@@ -95,3 +97,19 @@ jobs:
       with:
         project-url: ${{ env.BOARD }}
         github-token: ${{ secrets.ISSUE_AUTOMATION }}
+
+  # An issue opened with a label or an assignee also fires `labeled` or
+  # `assigned`, which add it above; only a bare one is added here.
+  add_unlabelled_to_roadmap_board:
+    name: Add unlabelled, unassigned issue to roadmap board
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.action == 'opened' &&
+      join(github.event.issue.labels.*.name, '') == '' &&
+      join(github.event.issue.assignees.*.login, '') == ''
+    steps:
+    - name: Add issue to roadmap board
+      uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
+      with:
+        project-url: https://github.com/orgs/giantswarm/projects/273
+        github-token: ${{ secrets.ISSUE_AUTOMATION }}

.github/workflows/zz_generated.chart_tests.yaml

@@ -0,0 +1,23 @@
+# DO NOT EDIT. Generated with:
+#
+#    devctl
+#
+#    https://github.com/giantswarm/devctl/blob/04334ff66e688e6562a10436ad17ea55631ac849/pkg/gen/input/workflows/internal/file/chart_tests.yaml.template
+#
+
+name: chart-tests
+
+on:
+  pull_request:
+    branches:
+      - master
+      - main
+  merge_group: {}
+
+permissions: {}
+
+jobs:
+  chart-tests:
+    uses: giantswarm/github-workflows/.github/workflows/chart-tests.yaml@main
+    permissions:
+      contents: read

.github/workflows/zz_generated.check_readme_links.yaml

@@ -0,0 +1,42 @@
+# DO NOT EDIT. Generated with:
+#
+#    devctl
+#
+#    https://github.com/giantswarm/devctl/blob/e642529ff98450dc48c8cbe580f4289af155a026/pkg/gen/input/workflows/internal/file/check_readme_links.yaml.template
+#
+
+name: check-readme-links
+
+# Checks the links in README.md: dead URLs, relative paths that do not exist
+# in the repository, reversed link syntax. A pull request that breaks a link
+# goes red. The weekly run catches links whose target moved without the
+# README changing, and files its findings as one issue instead of failing.
+# The issue is filed, updated and closed from the default branch only; a
+# manual run on another branch keeps its report in the job summary.
+# The checker configuration is maintained centrally in
+# giantswarm/github-workflows under link-check/.
+# Switch the check off for this repository with
+# `devctl gen workflows --check-readme-links=false`, in giantswarm/github
+# `gen.checkReadmeLinks: false` on the repository entry.
+
+on:
+  pull_request:
+    branches:
+      - master
+      - main
+    paths:
+      - 'README.md'
+  schedule:
+    - cron: '17 6 * * 1'
+  workflow_dispatch: {}
+
+permissions: {}
+
+jobs:
+  check-readme-links:
+    uses: giantswarm/github-workflows/.github/workflows/check-readme-links.yaml@main
+    with:
+      fail_on_error: ${{ github.event_name == 'pull_request' }}
+    permissions:
+      contents: read
+      issues: write

.github/workflows/zz_generated.create_release.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/c4c2f6f84e7bc84f838669bce868465c16ae53fb/pkg/gen/input/workflows/internal/file/create_release.yaml.template
+#    https://github.com/giantswarm/devctl/blob/0cc103490e0438858949bc6fe67d9cc67f9b967a/pkg/gen/input/workflows/internal/file/create_release.yaml.template
 #
 name: Create Release
 
@@ -24,6 +24,7 @@ jobs:
     with:
       fetch-deep-gitlog-for-build: true
     secrets:
-      TAYLORBOT_GITHUB_ACTION: ${{ secrets.TAYLORBOT_GITHUB_ACTION }}
+      RELEASE_BOT_CLIENT_ID: ${{ secrets.RELEASE_BOT_CLIENT_ID }}
+      RELEASE_BOT_PRIVATE_KEY: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
     permissions:
       contents: write

.github/workflows/zz_generated.create_release_pr.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/9731fd539b9bb5903efde223d34137756dab107f/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template
+#    https://github.com/giantswarm/devctl/blob/0cc103490e0438858949bc6fe67d9cc67f9b967a/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template
 #
 name: Create Release PR
 on:
@@ -55,4 +55,5 @@ jobs:
     with:
       branch: ${{ inputs.branch }}
     secrets:
-      TAYLORBOT_GITHUB_ACTION: ${{ secrets.TAYLORBOT_GITHUB_ACTION }}
+      RELEASE_BOT_CLIENT_ID: ${{ secrets.RELEASE_BOT_CLIENT_ID }}
+      RELEASE_BOT_PRIVATE_KEY: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

.github/workflows/zz_generated.semantic_pull_request.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/1e74e9b34eaee80c19dd433c7c298a67ab812605/pkg/gen/input/workflows/internal/file/semantic_pull_request.yaml.template
+#    https://github.com/giantswarm/devctl/blob/6bd76e24b11b67d6d99715b8f484f454e05abbd9/pkg/gen/input/workflows/internal/file/semantic_pull_request.yaml.template
 #
 name: semantic-pull-request
 
@@ -21,3 +21,25 @@ jobs:
     uses: giantswarm/github-workflows/.github/workflows/semantic-pull-request.yaml@main
     permissions:
       pull-requests: read
+    with:
+      # `types` REPLACES the action's default list rather than extending it, so
+      # all eleven defaults from commitizen/conventional-commit-types are
+      # repeated here, plus the additions below. Entries are regexes the action
+      # wraps in `^ $`.
+      #
+      # `security` is not one of the action's defaults and has to be listed to
+      # be accepted at all. cliff.toml maps it to the Security changelog group,
+      # which no title can reach while the type is rejected.
+      types: |
+        feat
+        fix
+        docs
+        style
+        refactor
+        perf
+        test
+        build
+        ci
+        chore
+        revert
+        security

.github/workflows/zz_generated.validate_changelog.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/validate_changelog.yaml.template
+#    https://github.com/giantswarm/devctl/blob/aea25951ef3cc7fc904759c833f020c04cd88acd/pkg/gen/input/workflows/internal/file/validate_changelog.yaml.template
 #
 name: Validate changelog
 
@@ -11,6 +11,8 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - 'CHANGELOG.md'
+      - '.github/workflows/zz_generated.auto_release.yaml'
+      - 'cliff.toml'
 
 permissions: {}
 
@@ -20,3 +22,29 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+
+  # This repository's declaration in giantswarm/github says the legacy release
+  # workflow, so the next align-files run deletes the Auto Release files again.
+  release-workflow-declaration:
+    name: Release workflow matches the declaration
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/workflows
+      - name: Refuse Auto Release files under a legacy declaration
+        run: |
+          found=""
+          for f in .github/workflows/zz_generated.auto_release.yaml cliff.toml; do
+            if [ -e "$f" ]; then
+              found="$found $f"
+            fi
+          done
+          if [ -n "$found" ]; then
+            echo "::error::This repository is declared on the legacy release workflow, so align-files deletes${found} again. Auto Release is enabled in the repository's entry in giantswarm/github: set gen.ci.releaseWorkflow: auto-release there and let align-files generate the files, instead of adding them in this pull request."
+            exit 1
+          fi