From 83f8cfe0c3048ea52f1b2abdb70256b20222495a Mon Sep 17 00:00:00 2001
From: Bill Freeman <billfreeman44@yahoo.com>
Date: Wed, 26 Aug 2026 13:37:13 -0500
Subject: [PATCH 1/2] Harden the deploy workflows against silent wrong-thing
 failures

- publish.yml: publish step name now names the package (1)
- publish.yml: added run-name
- publish.yml: added timeout-minutes to 1 job(s)
- version.yml: dispatch input moved out of the shell line
- version.yml: added run-name

Part of the fleet sweep planned in igl-gotv docs/plans/workflow_hardening_sweep.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 4 +++-
 .github/workflows/version.yml | 4 +++-
 CHANGELOG.md                  | 2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 172b93a..956093b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,6 @@
 ---
 name: publish
+run-name: Publish ${{ github.ref_name }}
 
 on:
   push:
@@ -74,6 +75,7 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.GH_TOKEN }}
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -96,7 +98,7 @@ jobs:
         run: npm run build
         env:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
-      - name: Publish
+      - name: Publish ${{ steps.version.outputs.name }}@${{ steps.version.outputs.current }}
         uses: peaceiris/actions-gh-pages@v4
         with:
           personal_token: ${{ secrets.GH_TOKEN }}
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 0debc49..3814045 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -1,5 +1,6 @@
 ---
 name: version
+run-name: Cut ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}
 
 on:
   workflow_dispatch:
@@ -42,6 +43,7 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
       - name: Cut ${{ github.event.inputs.version }}${{ github.event.client_payload.version }} version
-        run: npm version --sign-git-tag=true ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}
+        run: npm version --sign-git-tag=true "$VERSION"
         env:
+          VERSION: ${{ github.event.inputs.version }}${{ github.event.client_payload.version }}
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 005c273..baa8a02 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+- Harden the deploy workflows: pass the version input through `env:` instead of interpolating it into the shell line; give the dispatch and tag workflows readable run titles; serialize deploys with a concurrency group and give every job a timeout.
+
 - GitHub Actions updated to Node 24 runtimes: `actions/checkout` v5 to v7; `actions/setup-node` v5 to v6.
 
 ## 0.8.2 / 2026-07-05

From ae31b79d48965ed13877852f6e3bb5abdef3aff7 Mon Sep 17 00:00:00 2001
From: Bill Freeman <billfreeman44@yahoo.com>
Date: Wed, 26 Aug 2026 13:47:26 -0500
Subject: [PATCH 2/2] Act on the Copilot review

- reverted the publish.yml step-name rename
- corrected the CHANGELOG bullet

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 2 +-
 CHANGELOG.md                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 956093b..5b5d551 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -98,7 +98,7 @@ jobs:
         run: npm run build
         env:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
-      - name: Publish ${{ steps.version.outputs.name }}@${{ steps.version.outputs.current }}
+      - name: Publish
         uses: peaceiris/actions-gh-pages@v4
         with:
           personal_token: ${{ secrets.GH_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index baa8a02..782572b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
-- Harden the deploy workflows: pass the version input through `env:` instead of interpolating it into the shell line; give the dispatch and tag workflows readable run titles; serialize deploys with a concurrency group and give every job a timeout.
+- Harden the deploy workflows: pass the version input through `env:` instead of interpolating it into the shell line; give the dispatch and tag workflows readable run titles; give every job a timeout.
 
 - GitHub Actions updated to Node 24 runtimes: `actions/checkout` v5 to v7; `actions/setup-node` v5 to v6.