From 566a7d883c3c25a1437078f0630e92478d5d7852 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 1 Sep 2026 07:39:56 +0000
Subject: [PATCH] chore(sync): synced file(s) with cplieger/ci

---
 .github/workflows/codeql.yml   | 7 +++++++
 .github/workflows/coverage.yml | 7 ++++++-
 .github/workflows/security.yml | 6 ++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f1c1c95..a6711d3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,3 +1,10 @@
+# Synced from cplieger/ci/.github/workflow-templates/codeql.yml — DO NOT EDIT.
+# CodeQL static analysis. Uploads SARIF to the repo's Security tab and backs the
+# code-scanning branch-protection gate.
+#
+# This template predates the sync-header convention (2026-06-02) and was one of
+# two that never got one backfilled, so nothing warned an editor that the next
+# chore(sync) would clobber a local change. Edit it HERE.
 name: CodeQL
 
 on:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 0c3516b..4558791 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -26,5 +26,10 @@ jobs:
       contents: write
     # NOTE: pin this @SHA to the ci release tag that first contains
     # coverage.yaml when cutting that tag (see ci.md "Updating and propagating").
-    # Renovate then tracks the `# v2` comment and bumps the digest thereafter.
+    # Thereafter repo-sync is the SINGLE WRITER of this digest in every consumer:
+    # each ci release propagates as an auto-merging chore(sync) PR with the new
+    # digest already baked in. Renovate does NOT bump it there — cplieger/.github's
+    # preset disables the github-actions manager on all six synced workflow
+    # filenames, so sync cannot be raced. Only in cplieger/ci itself (and two other
+    # named exclusions) does Renovate track this pin.
     uses: cplieger/ci/.github/workflows/coverage.yaml@5ba93f366541ece117eaed5d1490e0d4c4bc5fd0 # v2
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 5689266..62d6857 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -1,3 +1,9 @@
+# Synced from cplieger/ci/.github/workflow-templates/security.yml — DO NOT EDIT.
+# Dependency and vulnerability review on Go dependency changes.
+#
+# This template predates the sync-header convention (2026-06-02) and was one of
+# two that never got one backfilled, so nothing warned an editor that the next
+# chore(sync) would clobber a local change. Edit it HERE.
 name: Security
 
 on: