fix: stabilise pinned regeneration and Dependabot checks; gate exact hover prose

[4Luke4]

Summary

This PR fixes the red CI / Verify on main, unsticks the Dependabot pull requests, removes the Dependabot rebase workflow, and makes the declared-feature gate prove that hover text matches the published documentation exactly.

Why main is red

On 7d79211 (run 35747215532), suite / Pinned API regeneration failed:

Error: Failed to fetch https://api.github.com/repos/Bubb13/EEex-Docs/git/commits/35445db…: 403 rate limit exceeded

ingest-docs.ts called the GitHub REST API anonymously. The limit is 60 requests per hour per address, and hosted runners share addresses, so the job failed at random. CI / Verify then failed correctly, because it requires the whole suite. The same job passed on the previous commit and on every Dependabot PR.

Fix: a new composite action, .github/actions/upstream-docs, fetches every regeneration input without the API:

• EEex-Docs and LuaJIT are checked out at pinned commits with persist-credentials: false.
• The Lua 5.2.4 archive is accepted only if its SHA-256 matches lua.org's published value.

The generator reads these inputs from disk, checks each checkout's HEAD against its pin, refuses symbolic links, and never receives a token. update-eeex-api.yml uses the same action.

Why Dependabot checks fail

1. Cancelled required check (chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.69.0 to 8.70.0 #69 BLOCKED, ci(deps): bump the codeql group across 1 directory with 2 updates #77). Dependabot pushes (synchronize) and edits the PR (edited) in the same second. The concurrency … cancel-in-progress group in conventional-commits.yml cancelled one of the two runs after its check run already existed. The required context Validate commit messages then carried a CANCELLED entry next to the SUCCESS one, so the GraphQL statusCheckRollup reports FAILURE. On chore(deps-dev): bump @typescript-eslint/parser from 8.69.0 to 8.70.0 #72, chore(deps-dev): bump eslint from 10.10.0 to 10.11.0 #74 and chore(deps-dev): bump @vscode/vsce from 3.9.2 to 4.0.0 #76 the cancelled run never created a check run, so they are CLEAN.
2. ci(deps): bump the codeql group across 1 directory with 2 updates #77 Merge verified patch update failed. The auto-merge wait step ran gh run list … --limit 1, which returned the cancelled Conventional Commits run. gh run watch --exit-status then exited 1 with "has already completed with 'cancelled'".
3. CI / maintenance = SKIPPED is expected. It only runs on workflow_dispatch.

Fixes:

• Conventional Commits no longer cancels runs, and it validates the PR's current title rather than the title in the event payload.
• Auto-merge waits for every run for the head. It requires at least one success, and tolerates a cancelled run only when a success sits beside it.

Dependabot rebase workflow removed

.github/workflows/dependabot-rebase.yml and its unreleased changelog entry are deleted, and the auto-merge comment no longer refers to it. No other references existed. The DEPENDABOT_REBASE_TOKEN repository secret is deleted separately; please revoke the personal access token behind it.

Exact hover fidelity

The declared-feature gate only checked that a hover contained hello, so it missed these defects in shipped hovers:

Source	Defect	Now
EE Game	23 signatures showed invented arg1/arg2; 59 lost their published spacing	Verbatim, including ... and ???
EE Game	138 hovers showed two rules, because the upstream ---- entry separator was kept	Trailing transitions dropped
EE/EEex	About 230 :ref: links rendered as [x](#anchor), which leads nowhere	All 4,930 upstream refs resolve unambiguously to their pinned line, across the whole checkout
Lua 5.2	·, §, – and similar were flattened to ASCII: ··· became ..., § became "section"	Exact Unicode; unknown entities now fail generation
Lua 5.2	math.frexp read x = m2e	m2<sup>e</sup>
Lua 5.2	Keyword help used hardcoded wording	Rendered from the manual ("The following keywords are reserved")
Lua/LuaJIT	Every <a href> was dropped	Absolute links
LuaJIT	ffi.abi's table was flattened; <br>-separated call forms ran together; source links had no anchor	GFM table; one call form per line; #heading anchors
VS Code	The client never enabled markdown.supportHtml, so <br/>, <sup>, <u> and <pre> were stripped	Enabled; still sanitised, command links still off

Lua 5.2 and LuaJIT were fetched from the live sites and never regenerated in CI. They are now pinned in packages/tools/upstream-pins.json:

• Lua 5.2: the lua-5.2.4.tar.gz release. Its manual body is identical to the online manual.
• LuaJIT: repository commit c6ffc141. Its doc/ matches luajit.org apart from site chrome.

Hover source links still point at the rendered pages.

Gate:

• tests/hover-fidelity.json holds 16 byte-exact hovers covering all six sources and every construct listed above. Each expectation is written from the pinned upstream text.
• The Declared feature coverage job compares them over stdio on all three operating systems. It also audits every shipped hover for Markdown that would render differently from its source: RST leftovers, dead or relative links, HTML that editors strip, undecoded entities, doubled rules, and the final source link.
• The installed-extension suite adds a hover-fidelity scenario that checks the same text as VS Code receives it, together with supportHtml and the disabled command links.

EEex baseclass_<n>

The 728 baseclass_<n> rows record which structure a usertype extends; they are not readable members. Completion, hover, chained resolution and typed method aliases now follow the documented lineage. For example, sprite.m_objectType resolves through CGameSprite → CGameAIBase → CGameObject, nearest declaration first and cycle-safe. The rows themselves are never offered as members. The 62 bases that name undocumented template instantiations contribute nothing; no members are guessed.

Found by the new gates while this PR was open

• Nested :ref: targets. Four :ref: links point at targets that themselves contain angle brackets (uiItem::bam<uiItem::<unnamed_type_bam>>). They now resolve, so all 4,930 upstream refs resolve to pinned lines.
• Findings from the shipped-hover audit:
  • collectgarbage's code block inside a list item collapsed onto the bullet's line.
  • <b>opt: </b> became **opt: **, which CommonMark does not close.
  • Literal brackets in prose were being read as HTML tags and stripped: the range [0, <max id in .IDS>] in EEex_Resource_LoadIDS, and Array<byte,16> in several EEex symbols.
• CodeQL js/incomplete-sanitization (3 alerts). The escaping in the new converters did not handle backslashes. Literal < is now written as <, and table cells escape \ and | together. CodeQL now reports 0 open alerts for this PR.

Validation

All executable verification runs in GitHub Actions. Nothing was built or tested locally.

• Final run: 35854072833 is green on every job:

  • policy, lint and format;
  • unit and stdio on 3 OSes;
  • declared-feature coverage on 3 OSes, with all 16 exact hovers and the audit of all 8,515 hoverable symbols;
  • pinned regeneration, reproducible byte for byte;
  • packaging, responsiveness, and all 12 editor combinations.

  CodeQL, dependency review and Conventional Commits also pass.

• Generated data comes from the Pinned API regeneration job's reviewable generated-data-patch artifact, applied in chore(data) commits. Formatting comes from the CI maintenance patch.

• Regression coverage: unit tests for pins, local tree, HEAD checks, anchors, HTML conversion, verbatim signatures, inheritance and label offsets; a stdio test for offsets and inheritance; the declared-feature hover gate; the editor hover-fidelity scenario; and a policy check that local composite actions pin third-party actions by SHA.

Recovery for the open Dependabot PRs

After this merges, comment @dependabot rebase on #69, #72, #74, #76 and #77. The branch-protection rule requires branches to be up to date, and no workflow requests rebases any more. The new runs will not produce cancelled duplicates. #77's auto-merge will re-run on the rebased head.

🤖 Generated with Claude Code