Workflow changes affect every consuming repository and are treated as production infrastructure changes.
- Create or claim a bead.
- Add or change the reusable workflow.
- Update
catalog.json, documentation, and starters when the public contract changes. - Keep all new inputs typed and give safe deterministic defaults.
- Pin external actions to full commit SHAs with a release comment.
- Run the complete validation suite from the README.
- Review the full diff for permission expansion, secret exposure, untrusted shell interpolation, runner placement, release provenance, and architecture expansion.
- Merge, then update callers to the new immutable commit SHA.
Breaking input/output changes require a migration note and a coordinated caller rollout. Prefer adding a new input with a safe default over silently changing an existing contract.