fix(shaclgen): emit sh:maxCount 0 for zero maximum_cardinality

.github/CODEOWNERS

@@ -1,19 +1,31 @@
 # LinkML CODEOWNERS — DRAFT (see linkml/linkml#3140)
 #
-# Opt-in model: no default (`*`) rule. Paths not listed here have no required
-# CODEOWNER and are reviewed normally. Rules only appear where someone has
-# explicitly volunteered to steward an area.
+# Default model: all paths require core-team approval unless a more specific
+# CODEOWNER rule applies. Later rules override earlier ones (last match wins),
+# so per-subsystem rules below take precedence over the default for their paths.
 #
 # Process for adding rules: docs/maintainers/codeowners.md
-# Later rules override earlier ones for matched paths.
+
+# --- Default: require core-team approval everywhere ---
+*  @linkml/core-team
 
 # --- CODEOWNERS and governance docs ---
 /.github/CODEOWNERS                         @linkml/core-team
 /docs/maintainers/contributor-hierarchy.md  @linkml/core-team
 /docs/maintainers/codeowners.md             @linkml/core-team
 /docs/maintainers/generator-governance.md   @linkml/core-team
 
-# --- Per-subsystem ownership (opt-in) ---
+# --- Per-subsystem ownership (overrides the default for these paths) ---
+
+# javagen
+#
+# EXPERIMENT: delegated self-contained area, see
+# docs/maintainers/codeowners.md#experiment-delegating-self-contained-areas
+
+/docs/generators/java.rst                            @gouttegd @noelmcloughlin
+/packages/linkml/src/linkml/generators/javagen.py    @gouttegd @noelmcloughlin
+/packages/linkml/src/linkml/generators/javagen/      @gouttegd @noelmcloughlin
+/tests/linkml/test_generators/test_javagen.py        @gouttegd @noelmcloughlin
 
 # pydanticgen:
 /packages/linkml/src/linkml/generators/pydanticgen/                  @sneakers-the-rat @kevinschaper
@@ -29,3 +41,22 @@
 /docs/generators/yarrrml.rst                          @Ostrzyciel @lapkinvladimir
 /packages/linkml/src/linkml/generators/yarrrmlgen.py  @Ostrzyciel @lapkinvladimir
 /tests/linkml/test_generators/test_yarrrmlgen.py      @Ostrzyciel @lapkinvladimir
+
+# openapigen:
+#
+# EXPERIMENT: delegated self-contained area, see
+# docs/maintainers/codeowners.md#experiment-delegating-self-contained-areas
+# @Silvanoc and @noelmcloughlin jointly own the OpenAPI generator and can
+# review each other's changes and merge them without core-team approval.
+
+/docs/generators/openapi.rst                             @Silvanoc @noelmcloughlin
+/packages/linkml/src/linkml/generators/openapigen.py     @Silvanoc @noelmcloughlin
+/tests/linkml/test_generators/test_openapigen.py         @Silvanoc @noelmcloughlin
+/tests/linkml/test_generators/input/openapi/             @Silvanoc @noelmcloughlin
+/tests/linkml/test_scripts/test_gen_openapi.py           @Silvanoc @noelmcloughlin
+
+# zodgen:
+/docs/generators/zod.rst                                          @linkml/core-team @noelmcloughlin
+/packages/linkml/src/linkml/generators/zodgen.py                  @linkml/core-team @noelmcloughlin
+/packages/linkml/src/linkml/generators/zod_ifabsent_processor.py  @linkml/core-team @noelmcloughlin
+/tests/linkml/test_generators/test_zodgen.py                      @linkml/core-team @noelmcloughlin

.github/dependabot.yml

@@ -20,9 +20,10 @@ updates:
 
   - package-ecosystem: "uv"
     directory: "/"
+    # Daily refills the three open slots as they drain, rather than once a week.
+    # The limit below, not the interval, is what bounds concurrent CI load.
     schedule:
-      interval: "weekly"
-      day: "sunday"
+      interval: "daily"
     groups:
       # Individual pull requests for major/minor updates and grouped for patch updates
       patch-updates:
@@ -31,7 +32,9 @@ updates:
           - "*"
         update-types:
           - "patch"
-    open-pull-requests-limit: 10
+    # Bounds rebase storms: every open PR runs the full matrix, and dependabot
+    # rebases all of them when main moves.
+    open-pull-requests-limit: 3
     # Wait 7 days after a release before opening an update PR, giving time for
     # malware/CVE advisories to surface (mirrors the uv `exclude-newer` cooldown).
     cooldown:

.github/scripts/check_links.py

@@ -11,6 +11,7 @@
 import random
 import re
 import sys
+import time
 from collections import defaultdict
 from datetime import datetime, timedelta
 from pathlib import Path
@@ -139,24 +140,19 @@ def needs_check(url: str, cache: dict[str, dict], ttl_days: int, jitter_days: in
         return True
 
 
-def check_url(url: str, timeout: int = 10) -> tuple[str, str]:
-    """
-    Check a URL and return (status, error_message).
+TRANSIENT_STATUSES = {"timeout", "connection_error"}
+"""Failures that say the network misbehaved, not that the link is dead.
 
-    Don't follow redirects - accept 3xx as valid (the redirect itself is the response).
-    This avoids false failures when redirect targets have bot protection.
+A dead link answers with 404. A dropped connection or a timeout is weather, and
+retrying clears it -- so these are retried before being reported.
+"""
+
+RETRY_ATTEMPTS = 3
+RETRY_BACKOFF_SECONDS = 2
 
-    Returns:
-        Tuple of (status_code_or_error, error_message_or_empty)
-    """
-    # Self-referencing repo URLs: verify the file exists locally
-    repo_match = REPO_FILE_PATTERN.match(url)
-    if repo_match:
-        path = Path(repo_match.group(1))
-        if path.exists():
-            return "200", ""
-        return "404", f"Local path not found: {path}"
 
+def _attempt_url(url: str, timeout: int) -> tuple[str, str]:
+    """Make a single request and classify the outcome. See ``check_url``."""
     try:
         response = requests.head(
             url,
@@ -184,6 +180,37 @@ def check_url(url: str, timeout: int = 10) -> tuple[str, str]:
         return "error", str(e)
 
 
+def check_url(url: str, timeout: int = 10) -> tuple[str, str]:
+    """
+    Check a URL and return (status, error_message).
+
+    Don't follow redirects - accept 3xx as valid (the redirect itself is the response).
+    This avoids false failures when redirect targets have bot protection.
+
+    Transient network failures are retried up to ``RETRY_ATTEMPTS`` times with a
+    linear backoff, so a single dropped connection is not reported as a broken link.
+
+    Returns:
+        Tuple of (status_code_or_error, error_message_or_empty)
+    """
+    # Self-referencing repo URLs: verify the file exists locally
+    repo_match = REPO_FILE_PATTERN.match(url)
+    if repo_match:
+        path = Path(repo_match.group(1))
+        if path.exists():
+            return "200", ""
+        return "404", f"Local path not found: {path}"
+
+    for attempt in range(1, RETRY_ATTEMPTS + 1):
+        status, message = _attempt_url(url, timeout)
+        if status not in TRANSIENT_STATUSES or attempt == RETRY_ATTEMPTS:
+            return status, message
+        time.sleep(RETRY_BACKOFF_SECONDS * attempt)
+
+    # Unreachable: the loop always returns on its final attempt.
+    raise AssertionError("retry loop exited without returning")
+
+
 def main():
     parser = argparse.ArgumentParser(description="Check links in documentation with caching and rate limiting.")
     parser.add_argument(

.github/scripts/uv_lock_deps_changed.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Decide whether the resolved ``uv.lock`` dependency set changed between refs.
+
+``uv.lock`` is regenerated non-deterministically: reordering, hashes, and
+metadata can differ between two lockfiles that resolve to exactly the same
+packages. ``uv audit`` only cares about the multiset of ``(name, version)``
+pairs, so this script compares that set between a base ref and ``HEAD`` and
+prints ``true`` only when it actually differs.
+
+Usage:
+    uv_lock_deps_changed.py <base_ref>
+
+Prints ``true`` when the resolved ``(name, version)`` set at ``HEAD`` differs
+from the one at ``<base_ref>`` (or when the lockfile is absent at either ref),
+otherwise ``false``.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+
+import tomllib
+
+
+def package_set(ref: str) -> set[tuple[str, str | None]] | None:
+    """Return the ``{(name, version)}`` set from ``uv.lock`` at ``ref``.
+
+    Args:
+        ref: A git ref (SHA, branch, ``HEAD``) to read ``uv.lock`` from.
+
+    Returns:
+        The set of ``(name, version)`` tuples for every locked package, or
+        ``None`` if ``uv.lock`` does not exist at ``ref``.
+    """
+    result = subprocess.run(
+        ["git", "show", f"{ref}:uv.lock"],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        return None
+    data = tomllib.loads(result.stdout)
+    return {(pkg["name"], pkg.get("version")) for pkg in data.get("package", [])}
+
+
+def resolved_set_changed(base_ref: str) -> bool:
+    """Return whether the resolved dependency set differs between refs.
+
+    Args:
+        base_ref: The ref to compare ``HEAD`` against.
+
+    Returns:
+        ``True`` if the ``(name, version)`` set differs, or if ``uv.lock`` is
+        missing at either ref; ``False`` when the sets are identical.
+    """
+    base = package_set(base_ref)
+    head = package_set("HEAD")
+    return base is None or head is None or base != head
+
+
+def main() -> None:
+    """Print ``true``/``false`` for the base ref given as the sole argument."""
+    print("true" if resolved_set_changed(sys.argv[1]) else "false")
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/check-external-links.yaml

@@ -1,6 +1,12 @@
 name: Check Sphinx external links
 env:
   UV_VERSION: "0.11.21"
+concurrency:
+  # Cancel superseded runs on the same PR. github.ref is refs/pull/<n>/merge,
+  # so each PR is its own group and never cancels another's runs.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 on:
   push:
     branches: [main]
@@ -14,23 +20,23 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Set up Python 3.
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           version: ${{ env.UV_VERSION }}
 
       - name: Install dependencies
         run: uv pip install --system requests
 
       - name: Restore link cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .github/link-cache.csv
           key: link-cache-${{ github.run_id }}

.github/workflows/dependency-audit.yaml

@@ -9,6 +9,12 @@ env:
   UV_PREVIEW: "1"          # Enables the preview uv audit and malware engines
   UV_MALWARE_CHECK: "1"    # Automatically blocks malicious installs on sync/run
 
+concurrency:
+  # Cancel superseded runs on the same PR. github.ref is refs/pull/<n>/merge,
+  # so each PR is its own group and never cancels another's runs.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 on:
   push:
     branches:
@@ -24,30 +30,81 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+        with:
+          # Full history so we can diff against a base ref to see whether the
+          # resolved dependency set changed (see "Detect dependency changes").
+          fetch-depth: 0
 
       # Pin uv to a known-good, recent release.
       - name: Install uv and setup uv caching
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           version: ${{ env.UV_VERSION }}
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v7.0.0
         id: setup-python
         with:
           python-version: 3.13
 
-      # Step 1: Run uv audit to check for vulnerabilities (CVEs)
+      # The CVE audit reflects the state of the *upstream advisory database*,
+      # not the change under test: a newly-published advisory against an
+      # already-pinned package would otherwise turn every open PR — and the next
+      # innocent merge to main — red, regardless of whether it touched deps.
       #
-      # GHSA-6w46-j5rx-g56g (pytest predictable tmpdir path) is fixed only in
-      # pytest 9.0.3, but pytest 9 removed the private _pytest.assertion.util
-      # ._diff_text API that tests/conftest.py depends on. We pin pytest <9
-      # (see packages/linkml/pyproject.toml) and ignore this single test-only,
-      # low-risk advisory until conftest is migrated to stdlib difflib.
+      # So gate the audit on whether the change actually altered dependencies,
+      # relative to each event's natural base:
+      #   * pull_request -> the PR base
+      #   * push (main)  -> the commit before the push (github.event.before)
+      #   * merge_group  -> the queue base
+      #   * otherwise (workflow_dispatch, first/force push) -> audit
+      #
+      # A pyproject.toml change is always a real dependency change. uv.lock is
+      # regenerated non-deterministically, so a textual change there is only
+      # treated as real if the resolved (name, version) set actually differs.
+      - name: Detect dependency changes
+        id: deps
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "${{ github.event_name }}" in
+            pull_request) base="${{ github.event.pull_request.base.sha }}" ;;
+            merge_group)  base="${{ github.event.merge_group.base_sha }}" ;;
+            push)         base="${{ github.event.before }}" ;;
+            *)            base="" ;;
+          esac
+
+          zero="0000000000000000000000000000000000000000"
+          if [ -z "$base" ] || [ "$base" = "$zero" ] || ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+            echo "No comparable base ref for '${{ github.event_name }}'; auditing."
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          changed_files="$(git diff --name-only "$base...HEAD")"
+
+          if grep -qE '(^|/)pyproject\.toml$' <<<"$changed_files"; then
+            echo "pyproject.toml changed; auditing."
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          elif grep -qE '(^|/)uv\.lock$' <<<"$changed_files"; then
+            changed="$(python3 .github/scripts/uv_lock_deps_changed.py "$base")"
+            if [ "$changed" = "true" ]; then
+              echo "uv.lock resolved dependency set changed; auditing."
+            else
+              echo "uv.lock changed but the resolved dependency set is identical; skipping audit."
+            fi
+            echo "changed=$changed" >> "$GITHUB_OUTPUT"
+          else
+            echo "No dependency files changed; skipping audit."
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Step 1: Run uv audit to check for vulnerabilities (CVEs)
       - name: Audit lockfile for CVEs
-        run: uv audit --ignore GHSA-6w46-j5rx-g56g
+        if: steps.deps.outputs.changed == 'true'
+        run: uv audit
 
       # Step 2: Run a sync. If a package contains known malware,
       # the OSV-lookup triggers an immediate, non-zero failure exit.