Add check-dependency-graph reusable workflow

[d-morrison]

Important

Stacked on gha#1126, which adds the script this workflow runs. Merge #1126 first, with a merge commit, not a squash.

Before: notes repos that vendor build_dependency_graph.py have its self-test in tools/tests/, but nothing runs it, so reviews of win#130 and rme#1390 flag it as unwired.

After: a repo adds a one-job caller of check-dependency-graph.yml. It runs the vendored self-test, then builds the graph and fails on a cycle. Closes #1129.

What it does: two python3 steps in the caller's checkout, reading script-dir, pages-dir, site and fail-on-cycle. It uses no composite, so it has no @v3 bootstrap gap of its own. Callers pin @v3, which resolves once the tag slides past this merge.

How: I added the workflow, its example stub, reference page and sidebar entry, README and website table rows, the six versioning lists that audit_capability_versioning_docs.py checks, and a changelog fragment.

Checked locally: that audit reports no findings, and the self-test and --fail build pass on lds (353 nodes, 0 cycles). I did not run the workflow itself, because a reusable workflow cannot be called from this repo until the tag slides.

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

This review covers the three unreviewed commits since the last round, up to 26d6974. It finds no new issues, and the prior verdict still stands. I read the diffs and the merge results but did not run any test suites or the permissions-docs audit.

The prior round (comment from 2026-10-19, commit c352616) gave Ready for merge. That verdict still stands.

What changed since then

• 26d6974 only rewraps the versioning lists in website/versioning.qmd and website/workflows.qmd. The same entries are present before and after.
• d247e23 and ed84c57 are merges of main. Because they were conflict-resolved by hand, I read them with git show --remerge-diff.
  • The conflicts were in CLAUDE.md, README.md, preview/action.yml, website/_quarto.yml, website/permissions.qmd, website/versioning.qmd and website/workflows.qmd.
  • Every conflict kept both sides. check-paired-file-change and check-write-idiom from main now sit beside check-dependency-graph.
  • preview/action.yml takes main's version, which logs the skip-docx note as a plain line instead of an annotation (gha#1130). The PR's older ::notice:: form is gone.
  • In both the README and website/permissions.qmd, the marked read-only list contains all three names (check-dependency-graph, check-paired-file-change, check-write-idiom).
• Net diff against main: git diff 53e1e81 5aefd94 --stat shows 10 files and 146 insertions, all of them the check-dependency-graph additions. Nothing from main was dropped or reverted.

Verdict

Ready for merge. The earlier blocking finding is fixed, and the merge commits and the wrap commit introduce nothing new. The optional _selftest.yml job for the new workflow remains a non-blocking suggestion.

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "26d6974cd57a282e690cbed7fd155e1e3f76f45f",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "Commit 26d6974 only rewraps versioning list entries, and the two merge commits keep both sides of every conflict, with the readonly-workflows lists in README.md and website/permissions.qmd still naming check-dependency-graph.",
  "holistic_assessment": "The net diff against main is limited to the check-dependency-graph additions, nothing from main was dropped, and the prior Ready for merge verdict remains valid with the selftest job as an optional follow-up."
}

Reviewed commit: 26d6974

[github-actions]

💰 Cost: $0.7486 (review) — run

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.

_{2026-10-19 11:06 UTC}

[d-morrison]

Merge note: merged as bf1f93d at head 26d6974 under Ezra's typed "mwc all". The cross-harness adversarial review and check-pr-fully-clean.py were not run before this merge, and no non-Claude reviewer was probed. The Claude review of 26d6974 was clean and all 103 check runs finished green or skipped.

---

Generated by Claude Code