chore(standards): resolve repo-standards drift (CI, pnpm, changelog, ignores)

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Code ownership for infrahub-sync.
+# The Solutions Architecture team owns the repository by default; PRs request
+# their review automatically. See https://docs.github.com/articles/about-code-owners
+* @opsmill/sa

.github/build-docs.sh

@@ -1,3 +1,3 @@
 #!/bin/sh
 
-cd docs && npm install && npm run build
+cd docs && pnpm install --frozen-lockfile && pnpm run build

.github/file-filters.yml

@@ -9,7 +9,10 @@ markdown_all: &markdown_all
   - "**/*.{md,mdx}"
 
 sync_files: &sync_files
-  - "sync/**"
+  - "infrahub_sync/**"
+
+test_files: &test_files
+  - "tests/**"
 
 yaml_all: &yaml_all
   - "**/*.{yml,yaml}"
@@ -26,7 +29,9 @@ uv_files: &uv_files
 
 sync_all:
   - *sync_files
+  - *test_files
   - *development_files
+  - *uv_files
 
 documentation_all:
   - *doc_files

.github/workflows/update-infrahub-sdk.yml

@@ -0,0 +1,87 @@
+---
+# yamllint disable rule:truthy rule:line-length
+name: "Update infrahub-sdk-python Version"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "infrahub-sdk version to test"
+        required: true
+
+  repository_dispatch:
+    types: [trigger-infrahub-sdk-python-update]
+
+jobs:
+  update-dependencies:
+    strategy:
+      matrix:
+        branch-name:
+          - develop
+
+    runs-on: ubuntu-22.04
+    concurrency:
+      group: update-infrahub-sdk-${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version || github.event.inputs.version }}-${{ matrix.branch-name }}
+      cancel-in-progress: false
+
+    env:
+      INFRAHUB_SDK_VERSION: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version || github.event.inputs.version }}
+      BRANCH_NAME: ${{ matrix.branch-name }}-infrahub-sdk-${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version || github.event.inputs.version }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        run: |
+          pip install uv
+          uv sync
+
+      # infrahub-sync pins `infrahub-sdk[all]`; keep the `[all]` extras so the
+      # bracket syntax activates the SDK's own extras (not this project's
+      # optional-dependency groups, which the `--extra` flag would touch).
+      - name: Update infrahub-sdk to version ${{ env.INFRAHUB_SDK_VERSION }}
+        run: |
+          uv add "infrahub-sdk[all]==${INFRAHUB_SDK_VERSION}"
+
+      - name: Prepare the branch for the update
+        id: prepare-branch
+        run: |
+          echo "Checking if branch ${BRANCH_NAME} exists..."
+          BRANCH_EXISTS=$(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l)
+          echo "BRANCH_EXISTS=$BRANCH_EXISTS" >> "$GITHUB_ENV"
+
+      - name: Commit and push changes
+        uses: github-actions-x/commit@v2.9
+        with:
+          github-token: ${{ secrets.GH_UPDATE_PACKAGE_OTTO }}
+          push-branch: ${{ env.BRANCH_NAME }}
+          commit-message: "chore: update infrahub-sdk to version ${{ env.INFRAHUB_SDK_VERSION }}"
+          files: |
+            pyproject.toml
+            uv.lock
+          name: opsmill-bot
+          email: github-bot@opsmill.com
+          rebase: ${{ env.BRANCH_EXISTS == 1 }}
+
+      - name: Create a pull request
+        env:
+          GH_TOKEN: ${{ secrets.GH_UPDATE_PACKAGE_OTTO }}
+          MATRIX_BRANCH: ${{ matrix.branch-name }}
+        run: |
+          # Skip create if a PR already exists for this head branch (re-runs against the same version).
+          if [ -n "$(gh pr list --head "${BRANCH_NAME}" --state open --json number --jq '.[0].number')" ]; then
+            echo "PR for ${BRANCH_NAME} already open, skipping create"
+            exit 0
+          fi
+          gh pr create \
+            --title "update infrahub-sdk to version ${INFRAHUB_SDK_VERSION} against ${MATRIX_BRANCH}" \
+            --body "This PR updates infrahub-sdk to version ${INFRAHUB_SDK_VERSION}." \
+            --base "${MATRIX_BRANCH}" \
+            --head "${BRANCH_NAME}"

.github/workflows/workflow-linter.yml

@@ -15,7 +15,10 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  VALE_VERSION: "3.7.1"
+  VALE_VERSION: "3.13.0"
+
+permissions:
+  contents: read
 
 jobs:
   files-changed:
@@ -32,7 +35,7 @@ jobs:
       - name: "Check out repository code"
         uses: "actions/checkout@v5"
       - name: Check for file changes
-        uses: dorny/paths-filter@v3
+        uses: opsmill/paths-filter@v3.0.2
         id: changes
         with:
           token: ${{ github.token }}
@@ -99,23 +102,16 @@ jobs:
     steps:
       - name: "Check out repository code"
         uses: "actions/checkout@v5"
-      # The globs below exclude vendored/agentic tooling trees (spec-kit engine,
-      # agent source-of-truth, adapters, constitution). Those are managed by
-      # spec-kit / the agentic structure, not hand-authored here, so they follow
-      # their own formatting conventions. Note: markdownlint-cli2 globs do not
-      # support inline "#" comments, so this rationale lives here instead.
-      - name: "Linting: markdownlint"
-        uses: DavidAnson/markdownlint-cli2-action@v19
+      - name: "Install uv"
+        uses: "astral-sh/setup-uv@v4"
         with:
-          config: .markdownlint.yml
-          globs: |
-            **/*.{md,mdx}
-            !changelog/*.md
-            !.specify/**
-            !.agents/**
-            !.claude/**
-            !.codex/**
-            !dev/constitution.md
+          version: "latest"
+      - name: "Install dependencies"
+        run: uv sync --frozen --extra dev
+      # Exclusions (vendored/agentic trees + generated cli.mdx) live in
+      # [tool.rumdl] in pyproject.toml.
+      - name: "Linting: rumdl"
+        run: "uv run rumdl check ."
 
   action-lint:
     if: needs.files-changed.outputs.github_workflows == 'true'
@@ -150,14 +146,18 @@ jobs:
         uses: "actions/checkout@v5"
         with:
           submodules: true
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: docs/package.json
       - name: Install NodeJS
         uses: actions/setup-node@v4
         with:
-          node-version: 20
-          cache: 'npm'
-          cache-dependency-path: docs/package-lock.json
+          node-version: 22
+          cache: 'pnpm'
+          cache-dependency-path: docs/pnpm-lock.yaml
       - name: "Install dependencies"
-        run: npm install
+        run: pnpm install --frozen-lockfile
       - name: "Setup Python environment"
         run: "pip install invoke toml"
       - name: "Build docs website"

.github/workflows/workflow-tests.yml

@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   files-changed:
     name: Detect which file has changed
@@ -25,7 +28,7 @@ jobs:
       - name: "Check out repository code"
         uses: "actions/checkout@v5"
       - name: Check for file changes
-        uses: dorny/paths-filter@v3
+        uses: opsmill/paths-filter@v3.0.2
         id: changes
         with:
           token: ${{ github.token }}

.github/workflows/workflow-uv-check.yml

@@ -8,6 +8,10 @@ on:
         type: "string"
         description: "Directory in which uv check will be executed"
         default: "./"
+
+permissions:
+  contents: read
+
 jobs:
   files-changed:
     name: Detect which file has changed
@@ -19,7 +23,7 @@ jobs:
       - name: "Check out repository code"
         uses: "actions/checkout@v5"
       - name: Check for file changes
-        uses: dorny/paths-filter@v3
+        uses: opsmill/paths-filter@v3.0.2
         id: changes
         with:
           token: ${{ github.token }}

.gitignore

@@ -19,4 +19,11 @@ dist/
 bench-results.csv
 .bench-filtered-config.yml
 # spec-kit transient download cache (extensions/presets)
-.specify/**/.cache/
+.specify/**/.cache/
+# Virtual environments
+.venv/
+venv/
+# Secrets (never commit)
+*.pem
+*.key
+credentials.json

.pre-commit-config.yaml

@@ -0,0 +1,32 @@
+---
+# Run locally with `uv run pre-commit install` then on each commit, or
+# `uv run pre-commit run --all-files`. Mirrors the CI ruff gate so formatting
+# and lint issues are caught before push. Keep the ruff rev in sync with the
+# pinned `ruff` version in pyproject.toml.
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-toml
+      - id: check-merge-conflict
+      - id: check-added-large-files
+      - id: detect-private-key
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.5
+    hooks:
+      - id: ruff-format
+      - id: ruff-check
+        args: [--fix]
+
+  - repo: local
+    hooks:
+      - id: rumdl
+        name: rumdl
+        entry: uv run rumdl check
+        language: system
+        pass_filenames: false
+        files: \.(md|mdx)$

.yamllint.yml

@@ -5,6 +5,7 @@ ignore: |
   /.venv
   /examples
   /docs/node_modules
+  /docs/pnpm-lock.yaml
   # Vendored/agentic tooling trees (spec-kit engine + agent source-of-truth +
   # adapters). Managed by spec-kit / the agentic structure, not hand-authored
   # here, so they follow their own formatting conventions.
@@ -16,6 +17,8 @@ ignore: |
 rules:
   new-lines: disable
   comments-indentation: disable
+  truthy:
+    check-keys: false
   line-length:
     max: 120
     allow-non-breakable-words: true

AGENTS.md

@@ -123,12 +123,12 @@ uv run pytest -q
 
 - Update `docs/` for any user-visible changes (flags, config, adapters). Keep examples minimal, accurate, and redacted.
 - Generate CLI docs: `uv run invoke docs.generate`
-- Build site (run `cd docs && npm install` once): `uv run invoke docs.docusaurus`
-- Lint Markdown/MDX with `markdownlint-cli2` (also via `uv run invoke docs.markdownlint`):
+- Build site (run `cd docs && pnpm install` once): `uv run invoke docs.docusaurus`
+- Lint Markdown/MDX with `rumdl` (config in `pyproject.toml`; also via `uv run invoke docs.rumdl`):
 
 ```bash
-markdownlint-cli2 "docs/docs/**/*.{md,mdx}"        # check
-markdownlint-cli2 "docs/docs/**/*.{md,mdx}" --fix  # fix
+uv run rumdl check .   # check
+uv run rumdl fmt .     # fix
 ```
 
 ## Invoke Tasks (reference)
@@ -137,7 +137,7 @@ markdownlint-cli2 "docs/docs/**/*.{md,mdx}" --fix  # fix
 
 - `format` / `lint` — run all formatters / linters.
 - `linter.format-ruff`, `linter.lint-ruff`, `linter.lint-pylint`, `linter.lint-yaml`, `linter.lint-ty`.
-- `docs.generate`, `docs.docusaurus`, `docs.markdownlint`, `docs.format-markdownlint`, `docs.format`, `docs.lint`.
+- `docs.generate`, `docs.docusaurus`, `docs.rumdl`, `docs.format-rumdl`, `docs.format`, `docs.lint`.
 - `tests.tests-unit`, `tests.tests-integration`.
 
 ## Known Issues and Limitations

README.md

@@ -1,6 +1,6 @@
-<!-- markdownlint-disable -->
+<!-- rumdl-disable MD041 -->
 ![Infrahub Logo](https://assets-global.website-files.com/657aff4a26dd8afbab24944b/657b0e0678f7fd35ce130776_Logo%20INFRAHUB.svg)
-<!-- markdownlint-restore -->
+<!-- rumdl-enable MD041 -->
 
 # Infrahub Sync
 

changelog/.gitignore

@@ -0,0 +1 @@
+!.gitignore