fix: scaffold emits type-correct workflow set and derives stale literals

[TMHSDigital]

Summary

Review-and-improve pass on the tool-scaffolding subsystem. Ships the clear-cut defects found in the Phase-2 audit and adds a durable born-green guard.

• Type-conditional emission (Probe A). mcp-server repos were emitting the cursor-plugin-specific validate.yml and release.yml. Per standards/ci-cd.md, validate's checks all assume a plugin.json and publish.yml replaces release.yml. The renderer now emits exactly the per-type required set from standards/drift-checker.config.json (drift-check, stale, publish) plus the optional-for-both pages and label-sync. Orphaned validate.mcp.yml.j2 / release.mcp.yml.j2 templates deleted.
• Derive-don't-hardcode (Probe C). LICENSE copyright year now derives from the current UTC year instead of a hardcoded 2026; the CI assertion derives the year too (SSOT, Probe F).
• plugin.json defaults (Probe D). Keywords are type-aware: the stock "mcp" keyword is only emitted when the repo actually has an MCP server (the smell that forced the Blender manual override).
• Test-coverage integrity (Probe E). PyYAML added to requirements-test.txt so test_release_doc_sync.py and test_composite_action_shape.py stop importorskip-ing and actually run in CI.
• Durable born-green test. tests/test_scaffold_born_green.py renders each supported type and asserts: correct _detect_repo_type, empty drift findings, current standards markers, derived action pins, consistent README counts, and the exact emitted workflow set. This turns "born wrong" into a CI failure.

Bumps VERSION 1.16.2 -> 1.16.3 (validate's version-bump-check requires it for fix:). registry.json untouched.

Audit findings (Phase 2)

• A: cursor-plugin already exact; mcp-server over-emitted validate.yml + release.yml (fixed). Required non-workflow files for mcp-server (publish.yml, package.json, docs/index.html) all present.
• B: both types are born green; detection correct; markers 1.10.0; pins @v1.16 / @v1.
• C: year literals were the remaining stale class; meta-action pins already derived (PR fix(scaffold): derive meta-repo action pins from VERSION #72).
• E: test_snapshot_remote integration test stays skipped (needs a real token/network) - intentional.
• G: re-running against an existing target directory refuses with a non-zero exit - safe.

Flagged for your decision (not implemented)

• Registry registration. The scaffold path does NOT create or queue a registry.json entry; a repo can be born outside the catalog (the Blender gap). Registry-sync is a separate manual step (registry.json -> scripts/sync_from_registry.py). Whether to auto-register or add a scaffold reminder/checklist is a design call.
• Placeholder content vs empty dirs, and possible drift between this create-tool.py and the Developer-Tools-MCP createTool path (out of scope for edits) - the two generators can diverge with no shared source.

Test plan

• pytest tests/ (224 passed, 1 skipped integration)
• pytest tests/test_scaffold_born_green.py -v (12 passed)
• python -m py_compile scaffold/create-tool.py
• python scripts/sync_from_registry.py --check
• rendered both types and mcp-server workflow set verified {drift-check, label-sync, pages, publish, stale}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/Jinja2	>= 3.1,< 4.0	Unknown	Unknown
pip/PyYAML	>= 6.0,< 7.0	Unknown	Unknown

Scanned Files

• requirements-test.txt

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pyyaml@​6.0.3

View full report