chore(standards): align repo with OpsMill standards (mechanical drift)

[BeArchiTek]

Repository standards alignment

Comprehensive remediation of the auditing-repo-standards findings. Four commits, each a
self-contained concern:

1. Baseline mechanical fixes (b2f243a)

• common-gitignore — secret patterns (.env, .env.local, *.pem, *.key, credentials.json, secrets.yaml)
• python-project-metadata — readme = "README.md"
• python-testing-pytest — dropped unused asyncio_mode = "auto"
• markdown-linting-markdownlint — [tool.rumdl] config; removed legacy .markdownlint.yaml
• Doc drift — AGENTS.md tech-stack synced to pyproject.toml
• ci-infrahub-sdk-auto-bump / ci-infrahub-auto-bump — update-infrahub-sdk.yml, update-infrahub.yml (target develop; testcontainers via the integration group). Org secret GH_UPDATE_PACKAGE_OTTO is configured. ✓

2. yamllint + asyncio docs (37f7c45)

• yaml-linting-yamllint — truthy.check-keys: false
• Swept stale asyncio_mode from two dev-doc snippets

3. rumdl full adoption (1213d47)

• rumdl fmt applied (34 fixes); rumdl check clean
• CI markdown-lint job + markdown filter output; invoke linter.lint-markdown
• Fixed broken dev/README.md links; reconciled stale markdownlint doc refs → rumdl; fixed a false "Poetry"→uv ref in the constitution
• Scoped rumdl to repo-owned markdown (excludes Docusaurus docs/ [Vale-owned], vendored .agents/, .specify/templates)

4. npm → pnpm docs toolchain (31944f4)

• js-package-manager-pnpm — pnpm-lock.yaml replaces package-lock.json; pnpm/action-setup + --frozen-lockfile in all three docs entry points; file-filters.yml updated
• Security overrides preserved — moved to docs/pnpm-workspace.yaml (pnpm 11's home) and confirmed present in the lock (webpack 5.104.1, postcss 8.5.10, js-yaml 4.2.0, …)
• .gitignore now ignores node_modules + docs build output

Verified locally: pnpm install --frozen-lockfile + docusaurus build succeed; rumdl check, yamllint, and ruff check all clean.

Notes for the reviewer

• rumdl 0.2.x ignores the rule doc's MD013 = false form — this uses the working disable = [...] schema.
• pnpm 11 no longer reads package.json's pnpm field — overrides/build-approval live in pnpm-workspace.yaml.

Still needs a human decision (not in this PR)

• github-branch-protection on stable — currently 0 required reviews + force-push enabled. A
  straight "require 1 review + enforce_admins + restrictions:null" would break the direct
  pushes to stable in workflow-changelog-and-docs.yml and trigger-push-stable.yml. Needs a
  config that keeps the release bot able to push (allowlist) — applied deliberately by an admin.
• python-changelog-towncrier — this is an Ansible collection with a bundled CHANGELOG.rst;
  towncrier (CHANGELOG.md) would compete with it. Pick: keep RST / adopt antsibull-changelog / switch to towncrier.

Generated with assistance from the detecting-repo-drift skill. Review before merging.

[cloudflare-workers-and-pages]

Deploying infrahub-ansible with    Cloudflare Pages

Latest commit:	f3ec15f
Status:	⚡️  Build in progress...

View logs

[cubic-dev-ai]

2 issues found across 7 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/update-infrahub.yml">

<violation number="1" location=".github/workflows/update-infrahub.yml:11">
P3: The manual input `run` is exposed to users but never used, so toggling it has no effect and can mislead operators. Consider removing it or wiring it into a step condition to control integration-test behavior.</violation>

<violation number="2" location=".github/workflows/update-infrahub.yml:53">
P1: Dependency update can execute unexpected shell tokens or fail on malformed version input because the version variable is unquoted in the `uv add` command. Quoting the full requirement string keeps input as data and makes updates deterministic.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Dependency update can execute unexpected shell tokens or fail on malformed version input because the version variable is unquoted in the uv add command. Quoting the full requirement string keeps input as data and makes updates deterministic.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/update-infrahub.yml, line 53:

<comment>Dependency update can execute unexpected shell tokens or fail on malformed version input because the version variable is unquoted in the `uv add` command. Quoting the full requirement string keeps input as data and makes updates deterministic.</comment>

<file context>
@@ -0,0 +1,87 @@
+      # (kept separate from `dev` due to a cachetools transitive-pin conflict).
+      - name: Update testcontainers to workflow version ${{ env.INFRAHUB_VERSION }}
+        run: |
+          uv add --group integration infrahub-testcontainers==${INFRAHUB_VERSION}
+
+      - name: Prepare the branch for the update
</file context>

[cubic-dev-ai]

P3: The manual input run is exposed to users but never used, so toggling it has no effect and can mislead operators. Consider removing it or wiring it into a step condition to control integration-test behavior.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/update-infrahub.yml, line 11:

<comment>The manual input `run` is exposed to users but never used, so toggling it has no effect and can mislead operators. Consider removing it or wiring it into a step condition to control integration-test behavior.</comment>

<file context>
@@ -0,0 +1,87 @@
+      version:
+        description: "Infrahub version to test"
+        required: true
+      run:
+        description: "Whether to run integration tests"
+        required: false
</file context>