Carry the Markdown Config, Scope the Publisher Group, and Fix README Shields

.github/workflows/deploy-site.yml

@@ -11,7 +11,7 @@ on:
           - staging
           - production
 
-# Runs queue rather than cancel, because a cancelled deploy leaves a release uploaded and unflipped.
+# GOVERNANCE.md "Workflow YAML Conventions" Concurrency exception (3).
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.environment }}
   cancel-in-progress: false

.github/workflows/merge-bot-pull-request.yml

@@ -6,8 +6,7 @@ on:
   pull_request_target:
     types: [opened, reopened, synchronize]
 
-# Concurrency keys on the PR number rather than on github.ref, which under pull_request_target is the base branch and would serialize every bot PR against it, so each PR queues independently.
-# The cancel-in-progress setting is false so a follow-up synchronize does not cancel an in-flight opened run before it enables auto-merge.
+# GOVERNANCE.md "Workflow YAML Conventions" Concurrency exception (1).
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: false

.github/workflows/publish-release.yml

@@ -3,10 +3,9 @@ name: Publish project release action
 on:
   workflow_dispatch:
 
-# A publish is a deliberate dispatch, so runs serialize on one group and queue rather than cancel.
-# That keeps a run from being left with a half-created GitHub release.
+# GOVERNANCE.md "Workflow YAML Conventions" Concurrency exception (2).
 concurrency:
-  group: ${{ github.workflow }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
 permissions: {}

.markdownlint-cli2.jsonc

@@ -16,11 +16,17 @@
         "MD060": false
     },
     "gitignore": true,
-    // Declared here rather than only as the CI action's globs input, because the ignores entry below only subtracts, so without a positive glob a run lints nothing and exits clean.
+    // Declared here rather than only as the CI action's globs input.
+    // It is declared because the ignores entry below only subtracts, so without a positive glob a run lints nothing and exits clean.
     "globs": ["**/*.md"],
     // Third-party Markdown under node_modules is not authored prose, and a repository's .gitignore does not reliably exclude it.
     // A bare `node_modules` entry would match the root copy only.
-    // This list is fleet-wide. A repository excluding a subtree of its own adds no entry here, and puts a `.markdownlint-cli2.jsonc` carrying its own `ignores` beside that content instead, which a bare local run and CI both honor.
-    // Those `ignores` patterns resolve against the directory holding that file rather than against the repository root, so each entry names its target as seen from that directory and a repository-root path matches nothing there, reporting no error saying so.
+    // This list is fleet-wide.
+    // A repository excluding a subtree of its own adds no entry here.
+    // It puts a `.markdownlint-cli2.jsonc` carrying its own `ignores` beside that content instead.
+    // A bare local run and CI both honor that file.
+    // Those `ignores` patterns resolve against the directory holding that file rather than against the repository root.
+    // Each entry names its target as seen from that directory.
+    // A repository-root path matches nothing there, and the run reports no error saying so.
     "ignores": ["**/node_modules/**"]
 }

README.md

@@ -226,7 +226,7 @@ Licensed under the [MIT License][license]\
 
 [last-commit-shield]: https://img.shields.io/github/last-commit/ptr727/Blog?logo=github&label=Last%20Commit
 [license-shield]: https://img.shields.io/github/license/ptr727/Blog?label=License
-[pre-release-version-shield]: https://img.shields.io/github/v/release/ptr727/Blog?include_prereleases&label=GitHub%20Pre-Release&logo=github
+[pre-release-version-shield]: https://img.shields.io/github/v/release/ptr727/Blog?include_prereleases&filter=*-g*&label=GitHub%20Pre-Release&logo=github
 [release-status-shield]: https://img.shields.io/github/actions/workflow/status/ptr727/Blog/publish-release.yml?event=workflow_dispatch&logo=github&label=Release%20Status
 [release-version-shield]: https://img.shields.io/github/v/release/ptr727/Blog?logo=github&label=GitHub%20Release
 
@@ -243,9 +243,6 @@ Licensed under the [MIT License][license]\
 
 [capture]: ./capture/
 [capture-readme]: ./capture/README.md
-[media-metadata-gate]: ./checks/media_metadata_gate.py
-[media-redactions-gate]: ./checks/media_redactions_gate.py
-[text-pii-gate]: ./checks/text_pii_gate.py
 [checks]: ./checks/
 [content]: ./CONTENT.md
 [deploy]: ./deploy/
@@ -258,11 +255,14 @@ Licensed under the [MIT License][license]\
 [history]: ./HISTORY.md
 [hugo-config]: ./hugo.yaml
 [license]: ./LICENSE
+[media-metadata-gate]: ./checks/media_metadata_gate.py
 [media-redactions]: ./checks/media-redactions.json
+[media-redactions-gate]: ./checks/media_redactions_gate.py
 [migration-post]: ./content/posts/2026/08/01/moving-this-blog-from-wordpress-to-hugo.md
 [normalize-media]: ./scripts/normalize_media.py
 [operations]: ./OPERATIONS.md
 [operations-family]: ./OPERATIONS.md#the-family-site
+[text-pii-gate]: ./checks/text_pii_gate.py
 [workflow]: ./WORKFLOW.md
 
 <!-- External -->