From c8ca0bd27485c22f33ecaf95de59195cb5d7568d Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 11:38:54 +0200
Subject: [PATCH 01/17] linter checks bundles and extras

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 6ff01922..b98c1bca 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -112,24 +112,44 @@ jobs:
         env:
           SCHEMA_VERSION: ${{ matrix.schema_version }}
           LINTER_TEST: ${{ matrix.linter_test }}
+          LINT_BUNDLED: >-
+            ${{ github.ref == 'refs/heads/master'
+             || github.ref == 'refs/heads/main'
+             || github.ref == 'refs/heads/2.0-dev'
+             || github.ref == 'refs/heads/2.0-dev-ci-linter-include-bundled-and-extras'
+             || (  github.event_name == 'pull_request'
+                && github.base_ref == 'master'
+                )
+            }}
         run: |
           set -eu
+          # conditionally exclude bundled schemas
+          find_exclude_args=()
+          if [ "$LINT_BUNDLED" != 'true' ]; then
+            find_exclude_args=( -not -name '*-bundled*.schema.json' )
+          fi
           mapfile -d '' -t schemas < <(
             find "schema/${SCHEMA_VERSION}" \
               -type f \
               -name '*.schema.json' \
-              -not -name '*-bundled*.schema.json' \
+              "${find_exclude_args[@]}" \
               -print0
           )
           if [ ${#schemas[@]} -eq 0 ]; then
             echo "No schemas found in schema/${SCHEMA_VERSION}" >&2
             exit 1
           fi
+          extra_schemas=(
+            'schema/behavior-taxonomy.schema.json'
+            'schema/spdx.schema.json'
+            'schema/cryptography-defs.schema.json'
+          )
           mkdir -p "$(dirname "$REPORT_FILE")"
           node tools/src/main/js/linter/cli.js \
             --include "$LINTER_TEST" \
             --format json \
             "${schemas[@]}" \
+            "${extra_schemas[@]}" \
             > "$REPORT_FILE"
       - name: Make report relative
         if: '!cancelled()'

From 77a447cb65922bfc6359e4df195ff0530946beb7 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 11:53:10 +0200
Subject: [PATCH 02/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index b98c1bca..5e23024f 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -116,9 +116,8 @@ jobs:
             ${{ github.ref == 'refs/heads/master'
              || github.ref == 'refs/heads/main'
              || github.ref == 'refs/heads/2.0-dev'
-             || github.ref == 'refs/heads/2.0-dev-ci-linter-include-bundled-and-extras'
              || (  github.event_name == 'pull_request'
-                && github.base_ref == 'master'
+                && github.base_ref == '2.0-dev'
                 )
             }}
         run: |

From 831f78af16dec1ca9c3ce2dfa37808337c9170fe Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 12:20:42 +0200
Subject: [PATCH 03/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 96 ++++++++++++++++++++------
 1 file changed, 75 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 5e23024f..0799383f 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -112,43 +112,24 @@ jobs:
         env:
           SCHEMA_VERSION: ${{ matrix.schema_version }}
           LINTER_TEST: ${{ matrix.linter_test }}
-          LINT_BUNDLED: >-
-            ${{ github.ref == 'refs/heads/master'
-             || github.ref == 'refs/heads/main'
-             || github.ref == 'refs/heads/2.0-dev'
-             || (  github.event_name == 'pull_request'
-                && github.base_ref == '2.0-dev'
-                )
-            }}
         run: |
           set -eu
-          # conditionally exclude bundled schemas
-          find_exclude_args=()
-          if [ "$LINT_BUNDLED" != 'true' ]; then
-            find_exclude_args=( -not -name '*-bundled*.schema.json' )
-          fi
           mapfile -d '' -t schemas < <(
             find "schema/${SCHEMA_VERSION}" \
               -type f \
               -name '*.schema.json' \
-              "${find_exclude_args[@]}" \
+              -not -name '*-bundled*.schema.json' \
               -print0
           )
           if [ ${#schemas[@]} -eq 0 ]; then
             echo "No schemas found in schema/${SCHEMA_VERSION}" >&2
             exit 1
           fi
-          extra_schemas=(
-            'schema/behavior-taxonomy.schema.json'
-            'schema/spdx.schema.json'
-            'schema/cryptography-defs.schema.json'
-          )
           mkdir -p "$(dirname "$REPORT_FILE")"
           node tools/src/main/js/linter/cli.js \
             --include "$LINTER_TEST" \
             --format json \
             "${schemas[@]}" \
-            "${extra_schemas[@]}" \
             > "$REPORT_FILE"
       - name: Make report relative
         if: '!cancelled()'
@@ -165,6 +146,79 @@ jobs:
           path: ${{ env.REPORT_FILE }}
           if-no-files-found: error
           retention-days: 1
+  lint-bundled:
+    if: >-
+      ${{ github.ref == 'refs/heads/master'
+       || github.ref == 'refs/heads/main'
+       || github.ref == 'refs/heads/2.0-dev'
+       || (  github.event_name == 'pull_request'
+          && github.base_ref == '2.0-dev'
+          )
+      }}
+    needs:
+      - discover-schema
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        schema_version: ${{ fromJSON(needs.discover-schema.outputs.versions) }}
+    name: lint ${{ matrix.schema_version }}-bundled
+    env:
+      REPORT_FILE: tools/src/main/js/linter/reports/${{ matrix.schema_version }}-bundled.json
+    steps:
+      - name: Checkout repository
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          package-manager-cache: false
+      - name: Install linter
+        working-directory: tools/src/main/js/linter
+        run: npm install
+      - name: Lint schemas
+        env:
+          SCHEMA_VERSION: ${{ matrix.schema_version }}
+        run: |
+          set -eu
+          mapfile -d '' -t schemas < <(
+            find "schema/${SCHEMA_VERSION}" \
+              -type f \
+              -name '*-bundled*.schema.json' \
+              -print0
+          )
+          if [ ${#schemas[@]} -eq 0 ]; then
+            echo "No schemas found in schema/${SCHEMA_VERSION}" >&2
+            exit 1
+          fi
+          mkdir -p "$(dirname "$REPORT_FILE")"
+          # only run checks not carried over from source files
+          node tools/src/main/js/linter/cli.js \
+            --include schema-id-pattern \
+            --include schema-id-filepath \
+            --format json \
+            "${schemas[@]}" \
+            > "$REPORT_FILE"
+      - name: Make report relative
+        if: '!cancelled()'
+        run: sed -i "s|${GITHUB_WORKSPACE}/||g" "$REPORT_FILE"
+      - name: Print report
+        if: '!cancelled()'
+        run: cat "$REPORT_FILE"
+      - name: Artifact report
+        if: '!cancelled()'
+        # https://github.com/actions/upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: report_${{ matrix.schema_version }}-bundled
+          path: ${{ env.REPORT_FILE }}
+          if-no-files-found: error
+          retention-days: 1
   summary:
     if: '!cancelled()'
     needs:
@@ -182,7 +236,7 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: reports
-          pattern: report_${{ matrix.schema_version }}_*
+          pattern: report_${{ matrix.schema_version }}[_-]*
           merge-multiple: true
       - name: Make summary
         working-directory: reports

From 55f1171a9e163734d8776ad82db6f304eb2b2910 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 12:25:05 +0200
Subject: [PATCH 04/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 0799383f..d369b72a 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -199,8 +199,10 @@ jobs:
           mkdir -p "$(dirname "$REPORT_FILE")"
           # only run checks not carried over from source files
           node tools/src/main/js/linter/cli.js \
+            --include schema-draft \
             --include schema-id-pattern \
             --include schema-id-filepath \
+            --include schema-comment \
             --format json \
             "${schemas[@]}" \
             > "$REPORT_FILE"

From 8e9ca52da4ce89628a93436318d7d5190ff9a934 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:14:40 +0200
Subject: [PATCH 05/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index d369b72a..3ee57ca8 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -15,6 +15,14 @@ permissions: {}
 
 env:
   NODE_VERSION: '24.x'
+  INCLUDE_BUNDLED: |
+    ${{ github.ref == 'refs/heads/master'
+       || github.ref == 'refs/heads/main'
+       || github.ref == 'refs/heads/2.0-dev'
+       || (  github.event_name == 'pull_request'
+          && github.base_ref == '2.0-dev'
+          )
+      }}
 
 jobs:
   discover-schema:
@@ -147,14 +155,7 @@ jobs:
           if-no-files-found: error
           retention-days: 1
   lint-bundled:
-    if: >-
-      ${{ github.ref == 'refs/heads/master'
-       || github.ref == 'refs/heads/main'
-       || github.ref == 'refs/heads/2.0-dev'
-       || (  github.event_name == 'pull_request'
-          && github.base_ref == '2.0-dev'
-          )
-      }}
+    if: ${{ env.INCLUDE_BUNDLED == 'true' }}
     needs:
       - discover-schema
     timeout-minutes: 10
@@ -220,7 +221,7 @@ jobs:
           name: report_${{ matrix.schema_version }}-bundled
           path: ${{ env.REPORT_FILE }}
           if-no-files-found: error
-          retention-days: 1
+          retention-days: 7
   summary:
     if: '!cancelled()'
     needs:
@@ -238,7 +239,7 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: reports
-          pattern: report_${{ matrix.schema_version }}[_-]*
+          pattern: report_${{ matrix.schema_version }}_*
           merge-multiple: true
       - name: Make summary
         working-directory: reports
@@ -286,6 +287,6 @@ jobs:
           REPORTS_URL: ${{ steps.artifact-reports.outputs.artifact-url }}
         run: |
           cat reports/summary.md
-          echo -e "# Summary for ${SCHEMA_VERSION}\n" >> "$GITHUB_STEP_SUMMARY"
-          echo -e "Reports: <${REPORTS_URL}>\n" >> "$GITHUB_STEP_SUMMARY"
+          echo -e "# Summary for ${SCHEMA_VERSION}\n" > "$GITHUB_STEP_SUMMARY"
+          echo -e "\nReports: <${REPORTS_URL}>\n\n" >> "$GITHUB_STEP_SUMMARY"
           cat reports/summary.md >> "$GITHUB_STEP_SUMMARY"

From 9731f102050043554f49c2cb5c2686f2248f2f3a Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:15:12 +0200
Subject: [PATCH 06/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 3ee57ca8..4b4f944e 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -20,7 +20,7 @@ env:
        || github.ref == 'refs/heads/main'
        || github.ref == 'refs/heads/2.0-dev'
        || (  github.event_name == 'pull_request'
-          && github.base_ref == '2.0-dev'
+          && github.base_ref == 'master'
           )
       }}
 

From cccdba36e9554f213da035dd4da930639fb5b0ec Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:16:36 +0200
Subject: [PATCH 07/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 4b4f944e..a05f5865 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -15,14 +15,14 @@ permissions: {}
 
 env:
   NODE_VERSION: '24.x'
-  INCLUDE_BUNDLED: |
+  INCLUDE_BUNDLED: >-
     ${{ github.ref == 'refs/heads/master'
-       || github.ref == 'refs/heads/main'
-       || github.ref == 'refs/heads/2.0-dev'
-       || (  github.event_name == 'pull_request'
-          && github.base_ref == 'master'
-          )
-      }}
+     || github.ref == 'refs/heads/main'
+     || github.ref == 'refs/heads/2.0-dev'
+     || (  github.event_name == 'pull_request'
+        && github.base_ref == '2.0-dev'
+        )
+    }}
 
 jobs:
   discover-schema:

From b179591f23ab3abe414485fedffba9766f8e33ba Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:22:28 +0200
Subject: [PATCH 08/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index a05f5865..2efc161b 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -221,7 +221,7 @@ jobs:
           name: report_${{ matrix.schema_version }}-bundled
           path: ${{ env.REPORT_FILE }}
           if-no-files-found: error
-          retention-days: 7
+          retention-days: 1
   summary:
     if: '!cancelled()'
     needs:
@@ -239,7 +239,7 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: reports
-          pattern: report_${{ matrix.schema_version }}_*
+          pattern: report_${{ matrix.schema_version }}[_-]]*
           merge-multiple: true
       - name: Make summary
         working-directory: reports
@@ -247,19 +247,19 @@ jobs:
         run: |
           import json, os
           from collections import Counter, defaultdict
+          from itertools import chain
           from pathlib import Path
           SEVERITY = ('error', 'warning', 'info')
           _ICONS = {'error': '❌', 'warning': '⚠️', 'info': 'ℹ️'}
           def md_icon(counter):
             return next((_ICONS[s] for s in SEVERITY if counter[s] > 0), '✅')
           def md_table(title, header, counters):
-            lines = [f'## {title}',
-                     f'|   | {header} | {" | ".join(SEVERITY)} |',
-                     f'|:-:|---|{"--:|" * len(SEVERITY)}']
+            yield f'## {title}'
+            yield f'|   | {header} | {" | ".join(SEVERITY)} |'
+            yield f'|:-:|---|{"--:|" * len(SEVERITY)}'
             for k in sorted(counters):
               c = counters[k]
-              lines.append(f'| {md_icon(c)} | `{k}` | {" | ".join(str(c[s]) for s in SEVERITY)} |')
-            return '\n'.join(lines) + '\n'
+              yield f'| {md_icon(c)} | `{k}` | {" | ".join(str(c[s]) for s in SEVERITY)} |'
           by_check, by_file = defaultdict(Counter), defaultdict(Counter)
           for f in Path('.').glob('*.json'):
             report = json.loads(f.read_text())
@@ -270,9 +270,13 @@ jobs:
               for i in r['issues']:
                 by_check[i['checkId']][i['severity']] += 1
                 file_counter[i['severity']] += 1
-          Path('summary.md').write_text(
-            md_table('By CheckID', 'checkId', by_check) + '\n' +
-            md_table('By File', 'filePath', by_file) + '\n')
+          Path('summary.md').write_text('\n'.join(chain(
+            md_table('By CheckID', 'checkId', by_check),
+            md_table('By File', 'filePath', by_file),
+            ('*) bundled files were checked for specific issues only; see raw file section "enabledChecks".'
+             if os.environ.get('INCLUDE_BUNDLED') == 'true'
+             else '',),
+          )))
       - name: Artifact reports
         id: artifact-reports
         # https://github.com/actions/upload-artifact

From 6b42721537b52d569c211b80fa87b70b38735c68 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:24:13 +0200
Subject: [PATCH 09/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 2efc161b..4fdce8d4 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -222,7 +222,7 @@ jobs:
           path: ${{ env.REPORT_FILE }}
           if-no-files-found: error
           retention-days: 1
-  summary:
+  summarize-version:
     if: '!cancelled()'
     needs:
       - discover-schema
@@ -232,7 +232,7 @@ jobs:
       fail-fast: false
       matrix:
         schema_version: ${{ fromJSON(needs.discover-schema.outputs.versions) }}
-    name: summary ${{ matrix.schema_version }}
+    name: summarize ${{ matrix.schema_version }}
     steps:
       - name: Fetch Reports
         # https://github.com/actions/download-artifact
@@ -292,5 +292,5 @@ jobs:
         run: |
           cat reports/summary.md
           echo -e "# Summary for ${SCHEMA_VERSION}\n" > "$GITHUB_STEP_SUMMARY"
-          echo -e "\nReports: <${REPORTS_URL}>\n\n" >> "$GITHUB_STEP_SUMMARY"
+          echo -e "Reports: <${REPORTS_URL}>\n\n" >> "$GITHUB_STEP_SUMMARY"
           cat reports/summary.md >> "$GITHUB_STEP_SUMMARY"

From d23f69eb57c61e846367a55da3a04f102994d5f0 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:28:04 +0200
Subject: [PATCH 10/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 4fdce8d4..97c30d4e 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -273,9 +273,9 @@ jobs:
           Path('summary.md').write_text('\n'.join(chain(
             md_table('By CheckID', 'checkId', by_check),
             md_table('By File', 'filePath', by_file),
-            ('*) bundled files were checked for specific issues only; see raw file section "enabledChecks".'
-             if os.environ.get('INCLUDE_BUNDLED') == 'true'
-             else '',),
+            ( '*) bundled files were checked for specific issues only; see raw file section "enabledChecks".'
+              if os.environ.get('INCLUDE_BUNDLED') == 'true'
+              else '', ),
           )))
       - name: Artifact reports
         id: artifact-reports

From cd8dff6c22a0c091efa3bbb556a34f1f0d7e5fcc Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:35:17 +0200
Subject: [PATCH 11/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 97c30d4e..b3ad1ca4 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -140,13 +140,13 @@ jobs:
             "${schemas[@]}" \
             > "$REPORT_FILE"
       - name: Make report relative
-        if: '!cancelled()'
+        if: ${{ !cancelled() }}
         run: sed -i "s|${GITHUB_WORKSPACE}/||g" "$REPORT_FILE"
       - name: Print report
-        if: '!cancelled()'
+        if: ${{ !cancelled() }}
         run: cat "$REPORT_FILE"
       - name: Artifact report
-        if: '!cancelled()'
+        if: ${{ !cancelled() }}
         # https://github.com/actions/upload-artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -208,13 +208,13 @@ jobs:
             "${schemas[@]}" \
             > "$REPORT_FILE"
       - name: Make report relative
-        if: '!cancelled()'
+        if: ${{ !cancelled() }}
         run: sed -i "s|${GITHUB_WORKSPACE}/||g" "$REPORT_FILE"
       - name: Print report
         if: '!cancelled()'
         run: cat "$REPORT_FILE"
       - name: Artifact report
-        if: '!cancelled()'
+        if: ${{ !cancelled() }}
         # https://github.com/actions/upload-artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -223,7 +223,7 @@ jobs:
           if-no-files-found: error
           retention-days: 1
   summarize-version:
-    if: '!cancelled()'
+    if: ${{ !cancelled() }}
     needs:
       - discover-schema
       - lint-schemas

From 24919a3e711d4598d56ec123b10996826f2e03b8 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:39:00 +0200
Subject: [PATCH 12/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index b3ad1ca4..5dfa8969 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -15,14 +15,6 @@ permissions: {}
 
 env:
   NODE_VERSION: '24.x'
-  INCLUDE_BUNDLED: >-
-    ${{ github.ref == 'refs/heads/master'
-     || github.ref == 'refs/heads/main'
-     || github.ref == 'refs/heads/2.0-dev'
-     || (  github.event_name == 'pull_request'
-        && github.base_ref == '2.0-dev'
-        )
-    }}
 
 jobs:
   discover-schema:
@@ -155,7 +147,14 @@ jobs:
           if-no-files-found: error
           retention-days: 1
   lint-bundled:
-    if: ${{ env.INCLUDE_BUNDLED == 'true' }}
+    if: >-
+      ${{ github.ref == 'refs/heads/master'
+      || github.ref == 'refs/heads/main'
+      || github.ref == 'refs/heads/2.0-dev'
+      || (  github.event_name == 'pull_request'
+         && github.base_ref == '2.0-dev'
+         )
+      }}
     needs:
       - discover-schema
     timeout-minutes: 10
@@ -273,9 +272,7 @@ jobs:
           Path('summary.md').write_text('\n'.join(chain(
             md_table('By CheckID', 'checkId', by_check),
             md_table('By File', 'filePath', by_file),
-            ( '*) bundled files were checked for specific issues only; see raw file section "enabledChecks".'
-              if os.environ.get('INCLUDE_BUNDLED') == 'true'
-              else '', ),
+            ('*) bundled files were checked for specific issues only; see raw file section "enabledChecks".',)
           )))
       - name: Artifact reports
         id: artifact-reports

From c9ca329d0f157313beb3d4ef572d3ad1e6d8b4bf Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:40:00 +0200
Subject: [PATCH 13/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 5dfa8969..76563b95 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -226,6 +226,7 @@ jobs:
     needs:
       - discover-schema
       - lint-schemas
+      - lint-bundled
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false

From db8a75aab001ac94d38627aab38344ab872843c5 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:40:29 +0200
Subject: [PATCH 14/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 76563b95..fd388972 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -239,7 +239,7 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: reports
-          pattern: report_${{ matrix.schema_version }}[_-]]*
+          pattern: report_${{ matrix.schema_version }}[_-]*
           merge-multiple: true
       - name: Make summary
         working-directory: reports

From d468780993406ba7fd8868486d584a4b5f50b2be Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:42:50 +0200
Subject: [PATCH 15/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index fd388972..871bcdb2 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -233,6 +233,8 @@ jobs:
       matrix:
         schema_version: ${{ fromJSON(needs.discover-schema.outputs.versions) }}
     name: summarize ${{ matrix.schema_version }}
+    env:
+      BUNDLED_RAN: ${{ needs.lint-bundled.result != 'skipped' }}
     steps:
       - name: Fetch Reports
         # https://github.com/actions/download-artifact
@@ -273,7 +275,9 @@ jobs:
           Path('summary.md').write_text('\n'.join(chain(
             md_table('By CheckID', 'checkId', by_check),
             md_table('By File', 'filePath', by_file),
-            ('*) bundled files were checked for specific issues only; see raw file section "enabledChecks".',)
+            ( '*) bundled files were checked for specific issues only; see raw file section "enabledChecks".'
+              if os.environ.get('BUNDLED_RAN') == 'true'
+              else '', ),
           )))
       - name: Artifact reports
         id: artifact-reports

From 2381e02af1d4b9c206de8a677193f2d6ef23c3db Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:46:00 +0200
Subject: [PATCH 16/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 871bcdb2..1ad8f6b6 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -262,6 +262,7 @@ jobs:
             for k in sorted(counters):
               c = counters[k]
               yield f'| {md_icon(c)} | `{k}` | {" | ".join(str(c[s]) for s in SEVERITY)} |'
+            yield ''
           by_check, by_file = defaultdict(Counter), defaultdict(Counter)
           for f in Path('.').glob('*.json'):
             report = json.loads(f.read_text())

From 664ce8ba6a8a9b879ffbbc5f24cc3c4186aa3858 Mon Sep 17 00:00:00 2001
From: Jan Kowalleck <jan.kowalleck@gmail.com>
Date: Fri, 28 Aug 2026 13:59:53 +0200
Subject: [PATCH 17/17] wip

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
---
 .github/workflows/lint_2.x_schemas.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/lint_2.x_schemas.yml b/.github/workflows/lint_2.x_schemas.yml
index 1ad8f6b6..35325262 100644
--- a/.github/workflows/lint_2.x_schemas.yml
+++ b/.github/workflows/lint_2.x_schemas.yml
@@ -152,7 +152,7 @@ jobs:
       || github.ref == 'refs/heads/main'
       || github.ref == 'refs/heads/2.0-dev'
       || (  github.event_name == 'pull_request'
-         && github.base_ref == '2.0-dev'
+         && github.base_ref == 'master'
          )
       }}
     needs: