Update exclusion list

CI-SYSTEM.md

@@ -25,6 +25,7 @@ Callers run on pushes to `main`/`master` and on pull requests targeting `main`,
 Tooling:
 
 - `tools/package-tiers.tsv` — the tier registry (source of truth for `tier`).
+- `tools/excluded-repos.sh` — shared exclude registry (sandboxes/templates), sourced by `sync-ci.sh`, `rollout-fledge-automation.sh`, and `set-fledge-branch-protection.sh`.
 - `tools/sync-ci.sh` — renders callers from the registry + auto-detection and opens routed PRs.
 
 ## Classification

tools/excluded-repos.sh

@@ -0,0 +1,16 @@
+# Shared exclude registry, sourced (not executed) by the fledge/CI sweep tools:
+#   tools/rollout-fledge-automation.sh, tools/sync-ci.sh, tools/set-fledge-branch-protection.sh
+#
+# Each tool excludes these repos even when a repo would otherwise qualify (e.g. has a
+# Package: DESCRIPTION and a fledge-managed NEWS.md)
+# One variable per tool below, since their exclude lists aren't (currently) identical;
+# edit the relevant one by hand and it takes effect immediately.
+
+# tools/rollout-fledge-automation.sh
+ROLLOUT_EXCLUDE="dksandbox chktemplate"
+
+# tools/sync-ci.sh
+SYNC_CI_EXCLUDE="dksandbox chktemplate"
+
+# tools/set-fledge-branch-protection.sh
+BRANCH_PROTECTION_EXCLUDE="dksandbox chktemplate poissontemplate"

tools/rollout-fledge-automation.sh

@@ -32,14 +32,17 @@ ORG=poissonconsulting
 ENGINE_REF=v1                  # version the caller workflows pin
 BRANCH=f-fledge-automation     # branch created in each target repo
 
-# Repos to exclude even when fledge-managed (sandboxes and templates).
-EXCLUDE="dksandbox chktemplate"
-
 APPLY=false
 [ "${1:-}" = "--apply" ] && { APPLY=true; shift; }
 NAMES=("$@")
 
 repo_root=$(git rev-parse --show-toplevel)
+
+# Repos to exclude even when fledge-managed (sandboxes and templates); shared with
+# tools/sync-ci.sh and tools/set-fledge-branch-protection.sh.
+source "$repo_root/tools/excluded-repos.sh"
+EXCLUDE="$ROLLOUT_EXCLUDE"
+
 bump_tpl="$repo_root/workflow-templates/fledge-bump.yaml"
 tag_tpl="$repo_root/workflow-templates/fledge-tag-on-merge.yaml"
 for f in "$bump_tpl" "$tag_tpl"; do

tools/set-fledge-branch-protection.sh

@@ -20,18 +20,24 @@
 #   tools/set-fledge-branch-protection.sh           # dry run: report current vs desired
 #   tools/set-fledge-branch-protection.sh --apply   # apply changes
 #
-# Requires: gh (admin on the target repos), jq.
+# Requires: gh (admin on the target repos), jq, git (to locate the shared exclude registry).
 
 set -euo pipefail
 
 ORG=poissonconsulting
 APP_SLUG=poisson-fledge-bot
-EXCLUDE="dksandbox chktemplate poissontemplate"
 
 APPLY=false
 [ "${1:-}" = "--apply" ] && APPLY=true
 command -v jq >/dev/null || { echo "jq is required (brew install jq)" >&2; exit 1; }
 
+repo_root=$(git rev-parse --show-toplevel)
+
+# Repos to exclude even when otherwise eligible (sandboxes and templates); shared with
+# tools/rollout-fledge-automation.sh and tools/sync-ci.sh.
+source "$repo_root/tools/excluded-repos.sh"
+EXCLUDE="$BRANCH_PROTECTION_EXCLUDE"
+
 $APPLY || echo "DRY RUN (pass --apply to change branch protection)"
 echo
 

tools/sync-ci.sh

@@ -42,16 +42,20 @@ ORG=poissonconsulting
 BRANCH=f-ci
 OLD_BRANCH=f-standardize-actions
 ENGINE_REF="${ENGINE_REF:-v1}"
-EXCLUDE="dksandbox chktemplate"
 # Fledge callers are migrated, not preserved: a package with a fledge caller under either
 # extension gets the current .yaml templates and any .yml copy is dropped.
 KEEP_FLEDGE="fledge-bump.yaml fledge-tag-on-merge.yaml fledge-bump.yml fledge-tag-on-merge.yml"
 # Bespoke per-package workflows preserved across standardization (not replaced by a
 # reusable caller): JOSS paper build and the Slack package-check notifier.
 KEEP_PRESERVE="paper.yaml slack-check-package.yaml"
-root=$(git rev-parse --show-toplevel)
-REGISTRY="$root/tools/package-tiers.tsv"
-RHUB_TPL="$root/workflow-templates/rhub.yaml"
+repo_root=$(git rev-parse --show-toplevel)
+REGISTRY="$repo_root/tools/package-tiers.tsv"
+RHUB_TPL="$repo_root/workflow-templates/rhub.yaml"
+
+# Repos to exclude even when fledge-managed (sandboxes and templates); shared with
+# tools/rollout-fledge-automation.sh and tools/set-fledge-branch-protection.sh.
+source "$repo_root/tools/excluded-repos.sh"
+EXCLUDE="$SYNC_CI_EXCLUDE"
 
 MODE=dry
 case "${1:-}" in
@@ -392,7 +396,7 @@ while IFS= read -r repo <&3; do
     # Migrate fledge callers: any package that had one (either extension) gets the
     # current .yaml templates; stale .yml copies are not restored.
     for f in fledge-bump fledge-tag-on-merge; do
-      { [ -f "$kp/$f.yaml" ] || [ -f "$kp/$f.yml" ]; } && cp "$root/workflow-templates/$f.yaml" .github/workflows/
+      { [ -f "$kp/$f.yaml" ] || [ -f "$kp/$f.yml" ]; } && cp "$repo_root/workflow-templates/$f.yaml" .github/workflows/
     done
     git add -A
     git commit -q -m "Standardize CI via reusable workflows (tier: $tier)