chore: bump the actions group across 1 directory with 2 updates

[dependabot]

Bumps the actions group with 2 updates in the / directory: Glyndor/.github/.github/workflows/empty-diff.yml and Glyndor/.github/.github/workflows/python-ci.yml.

Updates Glyndor/.github/.github/workflows/empty-diff.yml from 1.14.1 to 1.15.0

Release notes

Sourced from Glyndor/.github/.github/workflows/empty-diff.yml's releases.

v1.15.0

ci(pin-policy): validate the trailing comment against a real tag on .github

v1.14.2

ci(main-guard): only run on pull requests into main

The fix is a guard adding if: github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' to the develop-only job in main-guard.yml. The reusable previously fired on every pull_request in the caller, regardless of the base ref, and rejected PRs to develop with HEAD_REF != develop. A PR to develop (the standard pattern in repos that go develop -> main) was rejected by the reusable with the wrong reason.

Other files touched in this release (no semantic change for consumers):

• .github/workflows/ci.yml, .github/workflows/dependabot-freshness.yml, .github/workflows/pin-policy-reusable.yml: the .github repo's own CI caller (PRs #119, #120, #121, #123). These are the source-of-truth reusables, only the .github repo's own ci.yml references them.
• scripts/pin-policy.py: the per-repo guard script invoked transitively by pin-policy-reusable.yml (PRs #119, #121, #123). The reusable's emitted surface changes only when a consumer reads pin-policy-reusable.yml's surface OR the script's bytes change.
• docs/reusables/README.md, docs/reusables/dependabot-freshness.md: README updates for the new reusable.

The reusable-surface diff for callers (apt, homebrew-tap, scoop-bucket, klyradb, template-repository, .github) is on main-guard.yml only. Dependabot bumps in those consumers will only touch the main-guard pin.

Commits

• fadfbeb ci: bump pin-policy-reusable to v1.15.0 (script now validates comment) (#127)
• baaf5ee ci(pin-policy): validate the trailing comment against a real tag on .github (...
• 5f91e01 ci: correct pin-policy-reusable SHA and comment to v1.14.2 (#125)
• 925d55b ci(main-guard): only run on pull requests into main (#124)
• eee4c4e ci(pin-policy): accept a comma-separated list of self-reusables (#123)
• 6535f51 ci(pin-policy): skip the reusable's own self-reference; bump caller SHA (#121)
• 0795ea8 ci: bump pin-policy-reusable caller to the merged PR #119 SHA (#120)
• 59d6af4 ci(pin-policy): per-repo reusable, retire the cross-repo central job (#119)
• c7f8c63 ci(pin-policy): fail closed when a consumer or surface is unreadable (#118)
• 3c63365 ci(pin-policy): fail when a consumer pin's surface differs from the latest ta...
• Additional commits viewable in compare view

Updates Glyndor/.github/.github/workflows/python-ci.yml from 1.10.1 to 1.15.0

Release notes

Sourced from Glyndor/.github/.github/workflows/python-ci.yml's releases.

v1.15.0

ci(pin-policy): validate the trailing comment against a real tag on .github

v1.14.2

ci(main-guard): only run on pull requests into main

The fix is a guard adding if: github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' to the develop-only job in main-guard.yml. The reusable previously fired on every pull_request in the caller, regardless of the base ref, and rejected PRs to develop with HEAD_REF != develop. A PR to develop (the standard pattern in repos that go develop -> main) was rejected by the reusable with the wrong reason.

Other files touched in this release (no semantic change for consumers):

• .github/workflows/ci.yml, .github/workflows/dependabot-freshness.yml, .github/workflows/pin-policy-reusable.yml: the .github repo's own CI caller (PRs #119, #120, #121, #123). These are the source-of-truth reusables, only the .github repo's own ci.yml references them.
• scripts/pin-policy.py: the per-repo guard script invoked transitively by pin-policy-reusable.yml (PRs #119, #121, #123). The reusable's emitted surface changes only when a consumer reads pin-policy-reusable.yml's surface OR the script's bytes change.
• docs/reusables/README.md, docs/reusables/dependabot-freshness.md: README updates for the new reusable.

The reusable-surface diff for callers (apt, homebrew-tap, scoop-bucket, klyradb, template-repository, .github) is on main-guard.yml only. Dependabot bumps in those consumers will only touch the main-guard pin.

v1.14.1 — empty-diff pull-request guard

Moves the pull-request-only guard inside the empty-diff reusable, so calling it on a non-pull_request event skips instead of failing on a missing base ref.

What changed

• empty-diff is now conditional (PR #114). The inner job carries if: github.event_name == 'pull_request'. Called from a push or schedule workflow it no longer fails closed on an absent base ref — it emits no check at all.
• This repository gained its own thin caller (PRs #112, #113). ci.yml here calls the reusable against itself. No consumer-facing surface; it is why the tag range spans three commits rather than one.

Why

The reusable reads the base ref from github.event.pull_request.base.ref. On any other event that is empty, and the guard I wrote for it exits 1 with "could not determine the pull request base ref". Correct as a fail-closed default, wrong as the experience for someone who wires the reusable into a workflow that also runs on push: they get a red check for the trigger, not for the diff. The four consumers all carry if: github.event_name == 'pull_request' on the calling job, so none of them ever hit it — but that puts the burden on every future caller remembering a line I can just as easily enforce here.

What this does not do

The guard turns a hard failure into a skip. It does not make empty-diff meaningful on push — there is no base ref to diff against there. If you require <job id> / empty diff in a ruleset and call the reusable on push, the skipped job resolves as passing. Require it on pull request only.

Upgrading

... (truncated)

Commits

• fadfbeb ci: bump pin-policy-reusable to v1.15.0 (script now validates comment) (#127)
• baaf5ee ci(pin-policy): validate the trailing comment against a real tag on .github (...
• 5f91e01 ci: correct pin-policy-reusable SHA and comment to v1.14.2 (#125)
• 925d55b ci(main-guard): only run on pull requests into main (#124)
• eee4c4e ci(pin-policy): accept a comma-separated list of self-reusables (#123)
• 6535f51 ci(pin-policy): skip the reusable's own self-reference; bump caller SHA (#121)
• 0795ea8 ci: bump pin-policy-reusable caller to the merged PR #119 SHA (#120)
• 59d6af4 ci(pin-policy): per-repo reusable, retire the cross-repo central job (#119)
• c7f8c63 ci(pin-policy): fail closed when a consumer or surface is unreadable (#118)
• 3c63365 ci(pin-policy): fail when a consumer pin's surface differs from the latest ta...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions