Standardize Trunk caller workflows across Z-Shell repos

[ss-o]

Context

The organization-level reusable Trunk workflow was refreshed in #404:

• deprecated Trunk web-app upload wiring was removed from active use
• the reusable workflow now uses current Trunk Code Quality behavior
• callers should use one check job instead of separate check/upload jobs
• callers should declare explicit permissions and concurrency

z-shell/zunit adopted the new caller shape in z-shell/zunit#7 and passed CI after the org workflow was merged.

Scope

Audit and update Z-Shell repositories that still call:

uses: z-shell/.github/.github/workflows/trunk.yml@main

Prioritize repositories with existing Trunk workflows and recent maintenance activity.

Initial rollout candidates

• z-shell/zsh-lint
• z-shell/zsh
• z-shell/z-a-meta-plugins
• z-shell/zsh-fancy-completions
• other repos found by code search using the org reusable workflow

Desired caller shape

• one Trunk Code Quality job
• no deprecated upload job
• no TRUNK_TOKEN / trunk-token upload path unless a future supported Trunk feature requires it
• explicit top-level permissions: contents: read
• explicit job permissions where annotations/checks need them
• concurrency for push/PR workflows
• arguments: --no-progress where useful for readable logs

Suggested tracker fields

• Item type: Task
• Priority: Medium
• Effort: Medium
• Status: Backlog

[ss-o]

Progress update:

• Completed and merged z-shell/zsh-lint#22 for the refreshed single-job Trunk caller shape.
• Opened z-shell/zsh#10 for the same Trunk caller cleanup plus removal of deprecated actions/labeler and sync-labels workflows tracked by z-shell/zsh#9.
• z-shell/zsh#10 remains draft because the current base-branch pull_request_target labeler workflow still fails before this PR can remove it from main; local verification for the branch passes (trunk check --all --no-fix --no-progress).

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/.github, z-shell/zsh-lint, z-shell/zsh
Branch/PR: z-shell/zsh#10 remains draft; z-shell/zsh-lint#22 is merged
Tracker/Issue: #408

Current state

• The org reusable Trunk workflow refresh is complete in ci(trunk): refresh reusable workflow #404.
• z-shell/zunit adopted the refreshed caller in ci(trunk): add code quality checks zunit#7.
• z-shell/zsh-lint adopted the refreshed caller in ci(trunk): refresh caller workflow zsh-lint#22 and that PR is merged.
• ci(trunk): refresh caller workflow zsh#10 is open as a draft for the refreshed Trunk caller and removal of deprecated label/sync-label workflows.

Verification

• ci(trunk): refresh caller workflow zsh#10 local verification reported: YAML parse, git diff --check, and trunk check --all --no-fix --no-progress passed.

Blockers

• ci(trunk): refresh caller workflow zsh#10 is blocked by an existing base-branch pull_request_target labeler workflow that fails before the PR can remove it from main.

Next steps

1. Resolve or bypass the base-branch labeler workflow failure for ci(trunk): refresh caller workflow zsh#10.
2. Mark ci(trunk): refresh caller workflow zsh#10 ready for review once CI can evaluate the branch cleanly.
3. Continue the Standardize Trunk caller workflows across Z-Shell repos #408 rollout to the remaining candidate repositories only after z-shell/zsh is unblocked or explicitly deferred.

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/.github, z-shell/zsh-lint, z-shell/zsh
Branch/PR: z-shell/zsh-lint#22 merged; z-shell/zsh#10 merged
Tracker/Issue: #408

Current state

• The org reusable Trunk workflow refresh is complete in ci(trunk): refresh reusable workflow #404.
• z-shell/zunit adopted the refreshed caller in ci(trunk): add code quality checks zunit#7.
• z-shell/zsh-lint adopted the refreshed caller in ci(trunk): refresh caller workflow zsh-lint#22.
• z-shell/zsh adopted the refreshed caller in ci(trunk): refresh caller workflow zsh#10 and removed the obsolete labeler/sync-labels workflows that were blocking PR evaluation.
• docs(agent-memory): define org handoff protocol #409 merged the org agent-memory protocol used for this handoff format.

Verification

• ci(trunk): refresh caller workflow zsh#10 local verification before merge: YAML parse, git diff --check, and trunk check --all --no-fix --no-progress passed.
• docs(agent-memory): define org handoff protocol #409 CI before merge: Dependency Review and CodeQL passed.

Blockers

• None currently recorded for the completed zunit, zsh-lint, or zsh rollout slices.

Next steps

1. Check post-merge main-branch CI for z-shell/zsh.
2. Continue Standardize Trunk caller workflows across Z-Shell repos #408 rollout to z-shell/z-a-meta-plugins, z-shell/zsh-fancy-completions, or other repos still calling the org Trunk workflow.
3. Close Standardize Trunk caller workflows across Z-Shell repos #408 only after remaining caller candidates are audited or explicitly deferred into separate tracker issues.

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/z-a-meta-plugins
Branch/PR: z-shell/z-a-meta-plugins#31 merged
Tracker/Issue: #408

Current state

• z-shell/z-a-meta-plugins now uses the refreshed single-job Trunk caller shape.
• The deprecated scheduled upload job and TRUNK_TOKEN path were removed from .github/workflows/trunk-check.yml.
• The local workspace checkout for this repo has unrelated dirty work on bug-remove-svn-snippets, so this slice was done through a separate GitHub branch and PR rather than touching the local checkout.

Verification

• Branch comparison against main showed a one-file workflow-only diff.
• YAML shape was reviewed after writing .github/workflows/trunk-check.yml.

Blockers

• None for z-shell/z-a-meta-plugins.

Next steps

1. Check post-merge main-branch CI for z-shell/z-a-meta-plugins if runs appear.
2. Continue Standardize Trunk caller workflows across Z-Shell repos #408 rollout to z-shell/zsh-fancy-completions or other remaining Trunk callers found by org code search.

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/zsh-fancy-completions
Branch/PR: z-shell/zsh-fancy-completions#38 merged
Tracker/Issue: #408

Current state

• z-shell/zsh-fancy-completions now uses the org reusable Trunk workflow instead of direct mutable actions/checkout@v5 and trunk-io/trunk-action@v1 references.
• The caller now declares explicit permissions, concurrency, and arguments: --no-progress.
• The local workspace checkout has unrelated dirty work, so this slice was done through a separate GitHub branch and PR.

Verification

• Branch comparison against main showed a one-file workflow-only diff.
• PR Trunk Code Quality workflow passed.

Blockers

• None for z-shell/zsh-fancy-completions.

Next steps

1. Continue Standardize Trunk caller workflows across Z-Shell repos #408 rollout to remaining org Trunk callers found by code search.
2. Prioritize repos with direct mutable Trunk action usage or deprecated upload-token caller shape.