repomatic init no longer writes the running version's workflow content beside a pin the cooldown held back

Author: kdeldycke

changelog.md

@@ -8,6 +8,7 @@
 - Teach the `repomatic-ship` skill to reconcile bundled skills and agents as a third pass, judge a false-positive autofix PR against current `main` before writing a lint rule for it, and tell a superseded intra-cycle measurement from a genuine contradiction.
 - The tool runner now retries a download up to 3 times on transient network failures, instead of failing the job on a one-off TLS or truncation error.
 - Standalone binary tests now run for every healthy target when a sibling build fails, instead of being skipped wholesale.
+- `repomatic init` no longer writes the running version's workflow content beside a pin the cooldown held back. A repository that already carries workflows keeps them untouched until the release is adopted, instead of receiving the new triggers, `concurrency` groups and `env:` blocks against the pinned release's reusable-workflow surface.
 
 ## [`7.9.0` (2026-08-10)](https://github.com/kdeldycke/repomatic/compare/v7.8.0...v7.9.0)
 

repomatic/init_project.py

@@ -609,9 +609,12 @@ def resolve_default_pin(
     from the running version, so a ref naming an older release ships that
     content against an older reusable-workflow surface, which GitHub rejects as
     soon as the two disagree (see
-    `test_thin_caller_workflow_call_inputs_stay_minimal`). Confining the
-    step-back to a first-time adoption keeps that skew where no alternative
-    exists.
+    `test_thin_caller_workflow_call_inputs_stay_minimal`). Returning such a pin
+    is therefore only half a decision: {func}`run_init` reads it back and, when
+    the repository already carries workflows, skips regenerating them so the
+    tree stays coherent at the pin it keeps. A first-time adoption has no tree
+    to keep, so there the skew stands as the only alternative to writing no
+    workflows at all.
     ```
 
     :param config: Repomatic config supplying the `minimum-release-age` window.
@@ -1059,12 +1062,42 @@ def run_init(
             for name in selected
         )
         if cooldown and workflows_selected:
+            floor = _highest_upstream_pin(output_dir, repo)
             version, commit_sha = resolve_default_pin(
                 config,
                 repo=repo,
                 warnings=result.warnings,
-                floor=_highest_upstream_pin(output_dir, repo),
+                floor=floor,
             )
+            # A pin the cooldown held below the running version cannot carry
+            # this version's caller content. `init` renders bodies from the
+            # running wheel and substitutes only the ref, so writing them
+            # beside an older `uses:` pin ships half an adoption: the trigger
+            # blocks, `concurrency` groups and `env:` of the new release,
+            # against the reusable-workflow surface of the old one. Declining
+            # the pin has to decline the content with it, or the cooldown buys
+            # nothing while the caller half lands anyway, silently.
+            #
+            # Gated on *floor*, because only a repository that already carries
+            # workflows has somewhere to stand: leaving them untouched keeps a
+            # coherent tree at *floor*. A first-time adoption has no such
+            # fallback, since skipping would write no workflows at all, and is
+            # the one case `resolve_default_pin` documents the skew as
+            # unavoidable.
+            if floor is not None and is_newer(
+                _base_version(), version.removeprefix("v")
+            ):
+                _note_cooldown(
+                    result.warnings,
+                    f"Leaving the workflows at {version}: their content belongs "
+                    f"to repomatic {_base_version()}, which the pin above "
+                    "declines. Pass --no-cooldown to adopt both together.",
+                )
+                selected -= {
+                    name
+                    for name in selected
+                    if isinstance(COMPONENTS_BY_NAME.get(name), WorkflowComponent)
+                }
         else:
             version = default_version_pin()
 

tests/test_init_project.py

@@ -694,6 +694,15 @@ def test_default_version_pin():
     Candidate("7.4.2", "2026-07-31", "v7.4.2"),
 ]
 
+# The same three releases, dated so the verdict holds whatever the real clock
+# says: 7.4.1 is always aged, 7.4.2 always fresh. Required by any test driving
+# `run_init`, which owns the cooldown comparison internally and exposes no
+# `today` hook to freeze, unlike `resolve_default_pin`.
+_CLOCK_ROBUST_CANDIDATES = [
+    Candidate("7.4.1", "2020-01-01", "v7.4.1"),
+    Candidate("7.4.2", "2999-01-01", "v7.4.2"),
+]
+
 
 @pytest.mark.parametrize(
     ("base", "expected"),
@@ -965,6 +974,51 @@ def test_resolve_default_pin_held_at_floor_warns(pin_build):
     assert "7.4.2" in warnings[0] and "v7.4.1" in warnings[0]
 
 
+def test_run_init_held_at_floor_leaves_workflows_untouched(tmp_path, pin_build):
+    """Declining the pin declines the caller content with it.
+
+    `init` renders workflow bodies from the running wheel and substitutes only
+    the `uses:` ref, so regenerating them under a held-back pin ships the new
+    release's triggers, `concurrency` groups and `env:` against the old
+    release's reusable-workflow surface. Half an adoption is worse than none:
+    the caller half lands with nothing pinned to serve it.
+    """
+    pin_build(version="7.4.1", sha="c" * 40)
+    run_init(output_dir=tmp_path, components=("workflows",), cooldown=False)
+
+    # Running version moves inside the cooldown window; the repo stays at 7.4.1.
+    pin_build(version="7.4.2", candidates=_CLOCK_ROBUST_CANDIDATES)
+    result = run_init(output_dir=tmp_path, components=("workflows",))
+
+    touched = [path for path in result.created + result.updated if "workflows/" in path]
+    assert not touched, f"held-back pin still rewrote {touched}"
+    autofix = (tmp_path / ".github" / "workflows" / "autofix.yaml").read_text(
+        encoding="UTF-8"
+    )
+    assert f"autofix.yaml@{'c' * 40} # v7.4.1" in autofix
+    assert any("Leaving the workflows" in warning for warning in result.warnings)
+
+
+def test_run_init_first_adoption_writes_workflows_despite_step_back(
+    tmp_path, pin_build
+):
+    """A repository with no pin yet still gets workflows when the cooldown bites.
+
+    The counterpart carve-out: holding the content back needs somewhere to
+    stand, and a first-time adoption has no prior tree to keep. Skipping here
+    would leave the repository with no workflows at all, so the pin/content
+    skew stands as the lesser outcome.
+    """
+    pin_build(candidates=_CLOCK_ROBUST_CANDIDATES, tag_sha="b" * 40)
+    result = run_init(output_dir=tmp_path, components=("workflows",))
+
+    assert any("workflows/" in path for path in result.created)
+    autofix = (tmp_path / ".github" / "workflows" / "autofix.yaml").read_text(
+        encoding="UTF-8"
+    )
+    assert f"autofix.yaml@{'b' * 40} # v7.4.1" in autofix
+
+
 def test_run_init_keeps_a_fresh_pin_already_on_disk(tmp_path, monkeypatch, pin_build):
     """Re-running `init` at the pinned version regenerates without downgrading.