chore: automated sync of local changes

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -3,32 +3,46 @@
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
 # It is a no-op if BOJ_SERVER_URL is not set or the server is unreachable.
-# To enable: set the BOJ_SERVER_URL repository secret (e.g., http://boj-server.local:7700)
-# To disable: delete this file or leave the secret unset.
-#
+# To enable: set BOJ_SERVER_URL as a repository secret or variable.
+# To disable: delete this file or leave BOJ_SERVER_URL unset.
 name: BoJ Server Build Trigger
+
 on:
   push:
     branches: [main, master]
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:
           BOJ_URL: ${{ secrets.BOJ_SERVER_URL || vars.BOJ_SERVER_URL }}
+          REPO_NAME: ${{ github.repository }}
+          BRANCH_NAME: ${{ github.ref_name }}
         run: |
+          set -euo pipefail
+
           if [ -z "$BOJ_URL" ]; then
-            echo "BOJ_SERVER_URL not configured — skipping"
+            echo "BOJ_SERVER_URL not configured - skipping"
             exit 0
           fi
+
+          payload="$(jq -cn \
+            --arg repo "$REPO_NAME" \
+            --arg branch "$BRANCH_NAME" \
+            --arg engine "casket" \
+            '{repo:$repo, branch:$branch, engine:$engine}')"
+
           curl -sf -X POST "${BOJ_URL}/cartridges/ssg-mcp/invoke" \
             -H "Content-Type: application/json" \
-            -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\"}" \
-            || echo "BoJ server unreachable — skipping (non-fatal)"
-permissions:
-  contents: read
+            --data "$payload" \
+            || echo "BoJ server unreachable - skipping (non-fatal)"

.github/workflows/dogfood-gate.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@main
+        uses: hyperpolymath/a2ml-validate-action@cb3c1e298169dc5ac2b42e257068b0fb5920cd5e # main
         with:
           path: '.'
           strict: 'false'
@@ -86,7 +86,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@main
+        uses: hyperpolymath/k9-validate-action@236f0035cc159051c8dd5dc7cd8af1e8cf961462 # main
         with:
           path: '.'
           strict: 'false'

.github/workflows/instant-sync.yml

@@ -30,4 +30,6 @@ jobs:
             }
 
       - name: Confirm
-        run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: echo "::notice::Propagation triggered for ${REPO_NAME}"