[dkastl]

Moves the node to datamodels-toolkit v0.3.19 with datamodels upgrade: the Action pin in .github/workflows/publish.yml (commit d4537b8, the v0.3.19 tag) and the npx version in the docs.

0.3.19 is a security release for the Action (geolonia/datamodels-toolkit#127): the job token goes only to the step that fetches a pull request's base branch, which runs only git. The toolkit's own steps run without it, and also without the OIDC request variables that the deploying job has.

Checked locally with 0.3.19: datamodels check . and datamodels build . pass.

Summary by CodeRabbit

• Chores
  • Updated the data model tooling used for pull request checks and publishing.
• Documentation
  • Updated the build and check instructions to match the current tooling.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a5d00df4-d5b0-42e1-b279-54217d67d32f

Commits

Reviewing files that changed from the base of the PR and between b9a6bcb and 1d8d47b.

Files selected for processing: 3

• .github/workflows/publish.yml
• AGENTS.md
• README.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The pull-request check and publish job now use datamodels-toolkit v0.3.19. The toolkit commands in AGENTS.md and README.md also use version 0.3.19 instead of 0.3.18.

Changes: Toolkit version update

Layer / File(s)	Summary
Update toolkit version references .github/workflows/publish.yml, AGENTS.md, README.md	Both workflow jobs and the documented toolkit commands now use version 0.3.19.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• gtt-project/models#16: PR #16 updated the same workflow and documentation references to version 0.3.18.

Merge Risk: Minimal · up to 1d8d4

No actionable merge-blocking risk is evident; the version update is consistent across automation and project instructions.

Security architecture risk: Low · up to 1d8d4

The update preserves existing permissions, deployment conditions, and checkout protections. No introduced security issue was established, but the new dependency’s credential isolation and failure handling could not be independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The updated dependency executes at two authority levels: repository-reading pull-request checks and publishing with Pages-write and OIDC-request authority. Unchanged permission declarations do not independently prove unchanged effective exposure inside the updated action.

Trust Boundaries and Controls

• inferred — The claimed restriction of the job token to git-only base fetching, and removal of OIDC request variables from toolkit processing, depend on enforcement within the external action. Local workflow configuration alone cannot verify those claims; the existing checkout protection is narrower than action-internal credential isolation.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: updating datamodels-toolkit to version 0.3.19.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}