From 5a8e3cc3b61adb3e73df58df138e45ca241a6189 Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Thu, 26 Feb 2026 17:33:32 -0500
Subject: [PATCH 1/9] standardize workflow filenames

---
 .github/workflows/automated-ci.yml               | 16 ++++++++--------
 .../{build_version.yml => build-version.yml}     |  0
 .../{docker_release.yml => docker-release.yml}   |  0
 .../{lint_format.yml => lint-format.yml}         |  0
 .github/workflows/release.yml                    |  2 +-
 .../{test_release.yml => test-release.yml}       |  0
 ..._preview.yml => test-rule-editor-preview.yml} |  0
 .../workflows/{test_suite.yml => test-suite.yml} |  0
 .../workflows/{test_unit.yml => test-unit.yml}   |  0
 .gitignore                                       |  1 -
 10 files changed, 9 insertions(+), 10 deletions(-)
 rename .github/workflows/{build_version.yml => build-version.yml} (100%)
 rename .github/workflows/{docker_release.yml => docker-release.yml} (100%)
 rename .github/workflows/{lint_format.yml => lint-format.yml} (100%)
 rename .github/workflows/{test_release.yml => test-release.yml} (100%)
 rename .github/workflows/{test_rule_editor_preview.yml => test-rule-editor-preview.yml} (100%)
 rename .github/workflows/{test_suite.yml => test-suite.yml} (100%)
 rename .github/workflows/{test_unit.yml => test-unit.yml} (100%)

diff --git a/.github/workflows/automated-ci.yml b/.github/workflows/automated-ci.yml
index 7e2ec7de0..26a67da98 100644
--- a/.github/workflows/automated-ci.yml
+++ b/.github/workflows/automated-ci.yml
@@ -4,20 +4,20 @@ on:
     types: [opened, synchronize, reopened]
 
 jobs:
-  lint_format:
-    uses: ./.github/workflows/lint_format.yml
-  test_unit:
-    uses: ./.github/workflows/test_unit.yml
-  rule_tester:
+  lint-format:
+    uses: ./.github/workflows/lint-format.yml
+  test-unit:
+    uses: ./.github/workflows/test-unit.yml
+  rule-tester:
     if: github.event.action == 'opened'
     uses: ./.github/workflows/rule-tester.yml
     secrets: inherit
     with:
       environment: DEV
-  test_rule_editor_preview:
+  test-rule-editor-preview:
     if: github.event.action == 'opened'
-    needs: rule_tester
-    uses: ./.github/workflows/test_rule_editor_preview.yml
+    needs: rule-tester
+    uses: ./.github/workflows/test-rule-editor-preview.yml
     secrets: inherit
     with:
       pr_ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/build_version.yml b/.github/workflows/build-version.yml
similarity index 100%
rename from .github/workflows/build_version.yml
rename to .github/workflows/build-version.yml
diff --git a/.github/workflows/docker_release.yml b/.github/workflows/docker-release.yml
similarity index 100%
rename from .github/workflows/docker_release.yml
rename to .github/workflows/docker-release.yml
diff --git a/.github/workflows/lint_format.yml b/.github/workflows/lint-format.yml
similarity index 100%
rename from .github/workflows/lint_format.yml
rename to .github/workflows/lint-format.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 805ac4ddf..6918c1baf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -118,7 +118,7 @@ jobs:
 
   build-and-push-docker:
     needs: [create-release-assets, deploy-PyPi]
-    uses: ./.github/workflows/docker_release.yml
+    uses: ./.github/workflows/docker-release.yml
     with:
       version: ${{ github.event.release.tag_name }}
     secrets: inherit
diff --git a/.github/workflows/test_release.yml b/.github/workflows/test-release.yml
similarity index 100%
rename from .github/workflows/test_release.yml
rename to .github/workflows/test-release.yml
diff --git a/.github/workflows/test_rule_editor_preview.yml b/.github/workflows/test-rule-editor-preview.yml
similarity index 100%
rename from .github/workflows/test_rule_editor_preview.yml
rename to .github/workflows/test-rule-editor-preview.yml
diff --git a/.github/workflows/test_suite.yml b/.github/workflows/test-suite.yml
similarity index 100%
rename from .github/workflows/test_suite.yml
rename to .github/workflows/test-suite.yml
diff --git a/.github/workflows/test_unit.yml b/.github/workflows/test-unit.yml
similarity index 100%
rename from .github/workflows/test_unit.yml
rename to .github/workflows/test-unit.yml
diff --git a/.gitignore b/.gitignore
index ecf4c8a1c..67ce5235a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -150,5 +150,4 @@ resources/cache/custom_rules.pkl
 
 #ignore custom build artifacts
 /build-output
-.github/workflows/build_version.yml
 Dockerfile.build

From 61e1b45f7e744b9e054ed7f62e15bb97e83de413 Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Thu, 26 Feb 2026 20:50:20 -0500
Subject: [PATCH 2/9] removed extraneous automated-ci and added actions to push
 to main

---
 .github/workflows/automated-ci.yml            | 23 -------------------
 .github/workflows/build-binary.yml            |  6 ++---
 .github/workflows/build-version.yml           | 18 +++++++--------
 ...rule-tester.yml => deploy-rule-tester.yml} | 21 +++++++++--------
 .github/workflows/docker-release.yml          |  2 +-
 .github/workflows/lint-format.yml             | 23 +++++++++++--------
 .github/workflows/prerelease-update-cache.yml |  4 ++--
 .../workflows/prerelease-update-version.yml   |  4 ++--
 .github/workflows/release.yml                 | 10 ++++----
 .github/workflows/test-release.yml            |  8 +++----
 .../workflows/test-rule-editor-preview.yml    |  8 +++----
 .github/workflows/test-suite.yml              | 10 ++++----
 .github/workflows/test-unit.yml               |  9 +++++---
 13 files changed, 67 insertions(+), 79 deletions(-)
 delete mode 100644 .github/workflows/automated-ci.yml
 rename .github/workflows/{rule-tester.yml => deploy-rule-tester.yml} (75%)

diff --git a/.github/workflows/automated-ci.yml b/.github/workflows/automated-ci.yml
deleted file mode 100644
index 26a67da98..000000000
--- a/.github/workflows/automated-ci.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: CI
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  lint-format:
-    uses: ./.github/workflows/lint-format.yml
-  test-unit:
-    uses: ./.github/workflows/test-unit.yml
-  rule-tester:
-    if: github.event.action == 'opened'
-    uses: ./.github/workflows/rule-tester.yml
-    secrets: inherit
-    with:
-      environment: DEV
-  test-rule-editor-preview:
-    if: github.event.action == 'opened'
-    needs: rule-tester
-    uses: ./.github/workflows/test-rule-editor-preview.yml
-    secrets: inherit
-    with:
-      pr_ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/build-binary.yml b/.github/workflows/build-binary.yml
index 5a82dabb8..8a257da1d 100644
--- a/.github/workflows/build-binary.yml
+++ b/.github/workflows/build-binary.yml
@@ -12,9 +12,9 @@ jobs:
   build:
     runs-on: ${{ inputs.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         id: pysetup
         with:
           python-version: "3.12"
@@ -35,7 +35,7 @@ jobs:
         if: runner.os == 'Windows'
         run: pyinstaller --onedir --contents-directory "." core.py --icon=resources/assets/CORE_logo_sm.ico --dist ./dist/output/${{ inputs.name }} --collect-submodules pyreadstat --add-data="$env:pythonLocation\Lib\site-packages\xmlschema\schemas;xmlschema/schemas" --hidden-import numpy --hidden-import numpy.core._methods --hidden-import numpy.lib.format --add-data="resources/cache;resources/cache" --add-data="resources/templates;resources/templates" --add-data="resources/schema;resources/schema"  --add-data="resources/datasets;resources/datasets" --add-data="resources/jsonata;resources/jsonata"
       - name: Archive Binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ${{ inputs.name }}
           path: dist/output/${{ inputs.name }}/
diff --git a/.github/workflows/build-version.yml b/.github/workflows/build-version.yml
index 1066e9001..f23872f85 100644
--- a/.github/workflows/build-version.yml
+++ b/.github/workflows/build-version.yml
@@ -8,12 +8,12 @@ jobs:
   custom-executable-build:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           repository: cdisc-org/cdisc-rules-engine
           ref: main
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install dependencies
@@ -48,7 +48,7 @@ jobs:
           mv core cdisc-core-$(date +%Y%m%d)
           echo "Executable ready: $(ls cdisc-core-*)"
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: cdisc-core-ubuntu-22.04
           path: dist/output/core-ubuntu-22.04/core/
@@ -62,12 +62,12 @@ jobs:
 #   custom-executable-build-windows:
 #     runs-on: windows-latest
 #     steps:
-#       - uses: actions/checkout@v4
+#       - uses: actions/checkout@v6
 #         with:
 #           repository: cdisc-org/cdisc-rules-engine
 #           ref: main
 #       - name: Set up Python
-#         uses: actions/setup-python@v5
+#         uses: actions/setup-python@v6
 #         with:
 #           python-version: "3.12"
 #       - name: Install dependencies
@@ -91,7 +91,7 @@ jobs:
 #           Rename-Item core.exe "cdisc-core-$date.exe"
 #           Write-Output "Executable ready: $(Get-ChildItem cdisc-core-*)"
 #       - name: Upload Artifact
-#         uses: actions/upload-artifact@v4
+#         uses: actions/upload-artifact@v6
 #         with:
 #           name: cdisc-core-windows
 #           path: dist/output/core-windows/core/
@@ -106,12 +106,12 @@ jobs:
 #   custom-executable-build-macos:
 #     runs-on: macos-latest
 #     steps:
-#       - uses: actions/checkout@v4
+#       - uses: actions/checkout@v6
 #         with:
 #           repository: cdisc-org/cdisc-rules-engine
 #           ref: main
 #       - name: Set up Python
-#         uses: actions/setup-python@v5
+#         uses: actions/setup-python@v6
 #         with:
 #           python-version: "3.12"
 #       - name: Install dependencies
@@ -146,7 +146,7 @@ jobs:
 #           mv core cdisc-core-$(date +%Y%m%d)
 #           echo "Executable ready: $(ls cdisc-core-*)"
 #       - name: Upload Artifact
-#         uses: actions/upload-artifact@v4
+#         uses: actions/upload-artifact@v6
 #         with:
 #           name: cdisc-core-macos
 #           path: dist/output/core-macos/core/
diff --git a/.github/workflows/rule-tester.yml b/.github/workflows/deploy-rule-tester.yml
similarity index 75%
rename from .github/workflows/rule-tester.yml
rename to .github/workflows/deploy-rule-tester.yml
index c5ec8c701..fa0d94c27 100644
--- a/.github/workflows/rule-tester.yml
+++ b/.github/workflows/deploy-rule-tester.yml
@@ -1,19 +1,15 @@
 name: Deploy Rule Tester Endpoint
 
 on:
-  workflow_call:
-    inputs:
-      environment:
-        required: true
-        type: string
-
   workflow_dispatch:
     inputs:
       environment:
         required: true
         default: DEV
         type: environment
-
+  pull_request:
+    types:
+      - opened
   push:
     branches:
       - main
@@ -26,9 +22,9 @@ env:
 jobs:
   deploy_rule_tester:
     runs-on: ubuntu-latest
-    environment: ${{ inputs.environment || 'PROD' }}
+    environment: ${{ github.event.pull_request && 'DEV' || inputs.environment || 'PROD' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: azure/login@v2
         with:
           creds: ${{ env.creds }}
@@ -47,3 +43,10 @@ jobs:
         with:
           app-name: ${{ env.functionAppName }}
           slot-name: ${{ vars.AZURE_WEBAPP_SLOT }}
+  test_rule_editor_preview:
+    needs: deploy_rule_tester
+    uses: ./.github/workflows/test-rule-editor-preview.yml
+    secrets: inherit
+    if: github.event.pull_request
+    with:
+      pr_ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index aef7c620e..d927ee21e 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
         with:
           ref: ${{ needs.check-if-latest.outputs.version }}
 
diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml
index 644be249d..66d5a9507 100644
--- a/.github/workflows/lint-format.yml
+++ b/.github/workflows/lint-format.yml
@@ -1,22 +1,27 @@
 name: Check Lint and Format
 on:
-  # Can't be workflow_dispatch because it uses github.event.pull_request.base.sha
-  workflow_call:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
 
 jobs:
   get_changed_files:
     runs-on: ubuntu-latest
     outputs:
-      py: ${{ steps.changes.outputs.py }}
+      py: ${{ steps.changes.outputs.all_changed_files }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
-          fetch-depth: "0"
+          fetch-depth: 0
       - name: Get changed files
         id: changes
-        run: |
-          echo "py=$(git diff --name-only --diff-filter=ACMRT ${{ github.event.pull_request.base.sha }} | grep .py$ | xargs)" >> $GITHUB_OUTPUT
+        uses: tj-actions/changed-files@v47
+        with:
+          files: "**.py"
+          separator: " "
 
   lint:
     runs-on: ubuntu-latest
@@ -25,11 +30,11 @@ jobs:
     if: ${{needs.get_changed_files.outputs.py}}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: "0"
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install linters
diff --git a/.github/workflows/prerelease-update-cache.yml b/.github/workflows/prerelease-update-cache.yml
index 91822624b..ba225f5d1 100644
--- a/.github/workflows/prerelease-update-cache.yml
+++ b/.github/workflows/prerelease-update-cache.yml
@@ -9,7 +9,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#generating-a-new-ssh-key
           # git bash: ssh-keygen -t ed25519 -C "github-actions@cdisc.org"
@@ -18,7 +18,7 @@ jobs:
           ssh-key: ${{ secrets.GH_ACTION_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/prerelease-update-version.yml b/.github/workflows/prerelease-update-version.yml
index 69b525592..f0a9a07fb 100644
--- a/.github/workflows/prerelease-update-version.yml
+++ b/.github/workflows/prerelease-update-version.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent#generating-a-new-ssh-key
           # git bash: ssh-keygen -t ed25519 -C "github-actions@cdisc.org"
@@ -27,7 +27,7 @@ jobs:
           ssh-key: ${{ secrets.GH_ACTION_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6918c1baf..f3b8258e2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
       contents: write
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
       - name: Create release zip files
@@ -61,7 +61,7 @@ jobs:
         with:
           name: core-ubuntu-22.04-tar
       - name: Upload Ubuntu 22.04 tar.gz
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: core-ubuntu-22.04-tarball
           path: core-ubuntu-22.04.tar.gz
@@ -78,7 +78,7 @@ jobs:
 
       # Upload zips as artifact for the PyPI job
       - name: Upload Release Assets for PyPI
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: release-artifacts
           path: |
@@ -94,9 +94,9 @@ jobs:
       id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install dependencies
diff --git a/.github/workflows/test-release.yml b/.github/workflows/test-release.yml
index 1a844d3ff..bd3a60802 100644
--- a/.github/workflows/test-release.yml
+++ b/.github/workflows/test-release.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
       - name: Create individual release zip files
@@ -58,7 +58,7 @@ jobs:
         with:
           name: core-ubuntu-22.04-tar
       - name: Upload Ubuntu 22.04 tar.gz
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: core-ubuntu-22.04-tarball
           path: core-ubuntu-22.04.tar.gz
@@ -71,10 +71,10 @@ jobs:
       id-token: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/test-rule-editor-preview.yml b/.github/workflows/test-rule-editor-preview.yml
index 57492fe16..20def7107 100644
--- a/.github/workflows/test-rule-editor-preview.yml
+++ b/.github/workflows/test-rule-editor-preview.yml
@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: "PR number to test (leave empty for current branch)"
+        description: "PR number to test (for forked repositories) (leave empty for current branch)"
         required: false
         type: string
 
@@ -20,12 +20,12 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ inputs.pr_ref || (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.ref }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: 3.12
 
@@ -47,7 +47,7 @@ jobs:
 
       - name: Upload screenshot (always runs)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: selenium-screenshot
           path: login_screenshot.png
diff --git a/.github/workflows/test-suite.yml b/.github/workflows/test-suite.yml
index 59732139e..1ca8bc1bb 100644
--- a/.github/workflows/test-suite.yml
+++ b/.github/workflows/test-suite.yml
@@ -9,7 +9,7 @@ on:
   workflow_dispatch:
     inputs:
       pr_number:
-        description: "PR number to test (leave empty for current branch)"
+        description: "PR number to test (for forked repositories) (leave empty for current branch)"
         required: false
         type: string
   pull_request_target:
@@ -21,18 +21,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Get Engine Changes
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ inputs.pr_ref || (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.event.pull_request.head.sha || github.ref }}
       - name: Get Test Suite Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: cdisc-org/CORE_Test_Suite
           path: CORE_Test_Suite
           token: ${{ secrets.ACCESS_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install dependencies
@@ -218,7 +218,7 @@ jobs:
       #######################
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: comparison-results
           path: |
diff --git a/.github/workflows/test-unit.yml b/.github/workflows/test-unit.yml
index d27fc62bf..8b3207bca 100644
--- a/.github/workflows/test-unit.yml
+++ b/.github/workflows/test-unit.yml
@@ -1,14 +1,17 @@
 name: Unit Tests
 on:
-  workflow_call:
   workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install requirements

From 1e67edcc80e61d75aa94015bd809a9c81466526b Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Thu, 26 Feb 2026 21:04:10 -0500
Subject: [PATCH 3/9] fix security issues

---
 .github/workflows/deploy-rule-tester.yml | 3 +++
 .github/workflows/lint-format.yml        | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-rule-tester.yml b/.github/workflows/deploy-rule-tester.yml
index fa0d94c27..f1da376f1 100644
--- a/.github/workflows/deploy-rule-tester.yml
+++ b/.github/workflows/deploy-rule-tester.yml
@@ -14,6 +14,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   creds: '{"clientId":"${{ vars.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ vars.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ vars.AZURE_TENANT_ID }}"}'
   functionAppName: cdisc-library-conformance-rules-generator-dev
diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml
index 66d5a9507..64af47a77 100644
--- a/.github/workflows/lint-format.yml
+++ b/.github/workflows/lint-format.yml
@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0
       - name: Get changed files
         id: changes
-        uses: tj-actions/changed-files@v47
+        uses: tj-actions/changed-files@7dee1b0c1557f278e5c7dc244927139d78c0e22a # v47.0.4
         with:
           files: "**.py"
           separator: " "

From e0303e281acac4c73d6260fb49b2908ea4ee23a6 Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Thu, 26 Feb 2026 21:33:28 -0500
Subject: [PATCH 4/9] deploy tester endpoint on all pr events

---
 .github/workflows/deploy-rule-tester.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/deploy-rule-tester.yml b/.github/workflows/deploy-rule-tester.yml
index f1da376f1..a2d21855a 100644
--- a/.github/workflows/deploy-rule-tester.yml
+++ b/.github/workflows/deploy-rule-tester.yml
@@ -8,8 +8,6 @@ on:
         default: DEV
         type: environment
   pull_request:
-    types:
-      - opened
   push:
     branches:
       - main
@@ -37,7 +35,6 @@ jobs:
           app-name: ${{ env.functionAppName }}
           mask-inputs: false
           app-settings-json: '{"WEBSITE_ENABLE_SYNC_UPDATE_SITE": "1"}' # wait for this step to complete before the webapps-deploy step
-
           general-settings-json: '{"linuxFxVersion": "PYTHON|${{ env.PYTHON_VERSION }}"}'
           slot-name: ${{ vars.AZURE_WEBAPP_SLOT }}
 
@@ -46,6 +43,7 @@ jobs:
         with:
           app-name: ${{ env.functionAppName }}
           slot-name: ${{ vars.AZURE_WEBAPP_SLOT }}
+
   test_rule_editor_preview:
     needs: deploy_rule_tester
     uses: ./.github/workflows/test-rule-editor-preview.yml

From f67a50096173f1c19114de36429db0c9c5b9f9d6 Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Fri, 27 Feb 2026 10:59:08 -0500
Subject: [PATCH 5/9] setup for prettier in other ticket

---
 .github/workflows/lint-format.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml
index 64af47a77..c54ed3dd3 100644
--- a/.github/workflows/lint-format.yml
+++ b/.github/workflows/lint-format.yml
@@ -10,7 +10,7 @@ jobs:
   get_changed_files:
     runs-on: ubuntu-latest
     outputs:
-      py: ${{ steps.changes.outputs.all_changed_files }}
+      py: ${{ steps.changes.outputs.py_all_changed_files }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -20,7 +20,9 @@ jobs:
         id: changes
         uses: tj-actions/changed-files@7dee1b0c1557f278e5c7dc244927139d78c0e22a # v47.0.4
         with:
-          files: "**.py"
+          files_yaml: |
+            py: 
+              - '**.py'
           separator: " "
 
   lint:

From 128fa06ee65814323f18036a571e6ea7fc52e11b Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Fri, 27 Feb 2026 13:02:12 -0500
Subject: [PATCH 6/9] rule deploy tester on push to main

---
 .github/workflows/deploy-rule-tester.yml       | 6 ++----
 .github/workflows/test-rule-editor-preview.yml | 7 +------
 .github/workflows/test-suite.yml               | 8 +-------
 3 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/deploy-rule-tester.yml b/.github/workflows/deploy-rule-tester.yml
index a2d21855a..bb6b2c14c 100644
--- a/.github/workflows/deploy-rule-tester.yml
+++ b/.github/workflows/deploy-rule-tester.yml
@@ -23,7 +23,7 @@ env:
 jobs:
   deploy_rule_tester:
     runs-on: ubuntu-latest
-    environment: ${{ github.event.pull_request && 'DEV' || inputs.environment || 'PROD' }}
+    environment: ${{ github.event_name == 'pull_request' && 'DEV' || inputs.environment || 'PROD' }}
     steps:
       - uses: actions/checkout@v6
       - uses: azure/login@v2
@@ -48,6 +48,4 @@ jobs:
     needs: deploy_rule_tester
     uses: ./.github/workflows/test-rule-editor-preview.yml
     secrets: inherit
-    if: github.event.pull_request
-    with:
-      pr_ref: ${{ github.event.pull_request.head.sha }}
+    if: contains(fromJSON('["push", "pull_request"]'), github.event_name)
diff --git a/.github/workflows/test-rule-editor-preview.yml b/.github/workflows/test-rule-editor-preview.yml
index 20def7107..1523e932a 100644
--- a/.github/workflows/test-rule-editor-preview.yml
+++ b/.github/workflows/test-rule-editor-preview.yml
@@ -2,11 +2,6 @@ name: Run Tests on Preview Deployment
 
 on:
   workflow_call:
-    inputs:
-      pr_ref:
-        description: "Git reference to checkout (for PRs)"
-        required: false
-        type: string
   workflow_dispatch:
     inputs:
       pr_number:
@@ -22,7 +17,7 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.pr_ref || (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.ref }}
+          ref: ${{ (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.ref }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
diff --git a/.github/workflows/test-suite.yml b/.github/workflows/test-suite.yml
index 1ca8bc1bb..5e9b62b27 100644
--- a/.github/workflows/test-suite.yml
+++ b/.github/workflows/test-suite.yml
@@ -1,11 +1,5 @@
 name: CORE Test Suite Validation
 on:
-  workflow_call:
-    inputs:
-      pr_ref:
-        description: "Git reference to checkout (for PRs)"
-        required: false
-        type: string
   workflow_dispatch:
     inputs:
       pr_number:
@@ -23,7 +17,7 @@ jobs:
       - name: Get Engine Changes
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.pr_ref || (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.event.pull_request.head.sha || github.ref }}
       - name: Get Test Suite Repository
         uses: actions/checkout@v6
         with:

From 7e04bc1535e3f40239a462e2ac90a858ec83a4fd Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Fri, 27 Feb 2026 14:30:07 -0500
Subject: [PATCH 7/9] run test suite on push to main

---
 .github/workflows/test-suite.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-suite.yml b/.github/workflows/test-suite.yml
index 5e9b62b27..407ce9743 100644
--- a/.github/workflows/test-suite.yml
+++ b/.github/workflows/test-suite.yml
@@ -7,7 +7,10 @@ on:
         required: false
         type: string
   pull_request_target:
-    types: [opened, synchronize, reopened]
+  push:
+    branches:
+      - main
+
 env:
   DATASET_SIZE_THRESHOLD: 1000000000
 jobs:

From 1f49bcac76ebbb5ce06fb422564f1b746e0347d5 Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Fri, 27 Feb 2026 14:45:59 -0500
Subject: [PATCH 8/9] update lint checker for prettier

---
 .github/workflows/lint-format.yml | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml
index c54ed3dd3..72e00c547 100644
--- a/.github/workflows/lint-format.yml
+++ b/.github/workflows/lint-format.yml
@@ -11,6 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       py: ${{ steps.changes.outputs.py_all_changed_files }}
+      pretty: ${{ steps.changes.outputs.pretty_all_changed_files }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -23,18 +24,23 @@ jobs:
           files_yaml: |
             py: 
               - '**.py'
+            pretty: 
+              - '**.json'
+              - '**.md'
+              - '**.yaml'
+              - '**.yml'
           separator: " "
 
-  lint:
+  check_python_files:
     runs-on: ubuntu-latest
     needs: get_changed_files
-    # only run there are changed files
+    # only run if there are changed files
     if: ${{needs.get_changed_files.outputs.py}}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
-          fetch-depth: "0"
+          fetch-depth: 0
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -49,3 +55,19 @@ jobs:
       - name: Run black
         run: |
           black --check ${{needs.get_changed_files.outputs.py}}
+
+  check_prettier_files:
+    runs-on: ubuntu-latest
+    needs: get_changed_files
+    # only run if there are changed files
+    if: ${{needs.get_changed_files.outputs.pretty}}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+      - name: Run prettier
+        run: |
+          npm i prettier
+          npx prettier --check ${{needs.get_changed_files.outputs.pretty}}

From 858927676ad4e3300d165b2ad6077a8164c0701a Mon Sep 17 00:00:00 2001
From: Gerry Campion <gcampion@cdisc.org>
Date: Fri, 27 Feb 2026 14:48:50 -0500
Subject: [PATCH 9/9] fix permissions

---
 .github/workflows/lint-format.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/lint-format.yml b/.github/workflows/lint-format.yml
index 72e00c547..1e7be35ec 100644
--- a/.github/workflows/lint-format.yml
+++ b/.github/workflows/lint-format.yml
@@ -5,6 +5,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 
 jobs:
   get_changed_files: