chore(deps-actions): update github-actions (#266)

* chore(deps-actions): update github-actions

* chore(ci): remove fragile ci-policy test and clarify TDD scope

Delete ci-required.test.cjs and test-ci-policy job that pinned checkout SHA and broke on Renovate bumps. Clean dangling refs in ci-required validator and required gate. Add TDD YES/NO policy to AGENTS.md so config and Actions use light validation only.

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Yuniel Acosta Pérez <33158051+yacosta738@users.noreply.github.com>

Author: renovate[bot]

.agents/AGENTS.md

@@ -117,6 +117,23 @@ completion. Flaky SQLite tests may need an isolated re-run.
 - `just test-integration` — integration tests only
 - `just test-e2e` — Playwright suite (requires `just test-e2e-build` + Docker)
 
+## Testing Policy — TDD Scope
+
+TDD follows explicit project/session configuration, never by default.
+When enabled: failing test first, then RED → GREEN → REFACTOR.
+When disabled: ordinary functional checks only.
+
+- **TDD YES** — pure domain logic: use-cases, classifiers, parsers,
+  wire formats. Example: `issue-labeler.cjs classify()` invariants
+  (no invented product, human preservation, idempotence).
+- **TDD NO** — config / YAML / GitHub Actions / Renovate-pinned SHAs,
+  docs-only changes. Light validation only:
+  `ruby -ryaml YAML.load_file`, `node --check`, smoke run.
+- **Anti-pattern** — asserting implementation details like
+  `actions/checkout@<40-hex>` pinned SHA or path-filter literals.
+  If a policy check is needed, use a non-fragile shape
+  (e.g. `/uses:\s*actions\/checkout@[a-f0-9]{40}/`), never a literal SHA.
+
 ## References
 
 - [Architecture](docs/architecture.md) — layer diagram, data/config flow

.agents/skills/testing/playwright-best-practices/.github/workflows/validate-skill.yml

@@ -11,7 +11,7 @@ jobs:
     name: Agnix Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Validate agent configs
         uses: agent-sh/agnix@12a1917d13e7c804bc91768c30dd4159f536c5c6

.github/scripts/ci-required-run.cjs

@@ -17,7 +17,6 @@ const resultKeys = {
   'gitleaks-pr': 'GITLEAKS_PR',
   'semgrep-pr': 'SEMGREP_PR',
   sonar: 'SONAR',
-  'test-ci-policy': 'TEST_CI_POLICY',
 };
 const outputKeys = {
   backend: 'CHANGES_BACKEND',

.github/scripts/ci-required.cjs

@@ -1,6 +1,5 @@
 const EXPECTED = [
   { job: 'changes', when: () => true },
-  { job: 'test-ci-policy', when: (c) => c.github },
   { job: 'build-dashboard', when: (c) => c.backend || c.frontend || c.github },
   { job: 'fmt', when: (c) => c.backend || c.github },
   { job: 'markdown', when: (c) => c.docs || c.github },

.github/scripts/ci-required.test.cjs

@@ -23,7 +23,7 @@ permissions:
 jobs:
   cleanup:
     name: 🧹 Clean Caches
-    uses: dallay/common-actions/.github/workflows/cache-maintenance.yml@v2.2.1
+    uses: dallay/common-actions/.github/workflows/cache-maintenance.yml@69060250307677655136ca88c70a2f77cb4153b2 # v2.2.4
     with:
       retention-days: 7
       cache-types: ${{ inputs.cache-type || 'all' }}