From 44d0a79547f8a1307ef06a4227ec6196dc4c797d Mon Sep 17 00:00:00 2001 From: claude-bot-andresmgsl Date: Thu, 23 Jul 2026 11:18:56 +0000 Subject: [PATCH] =?UTF-8?q?feat(guards):=20wire=20runner-isolated=20?= =?UTF-8?q?=E2=80=94=20self-guards=20step,=20consumer=20entry,=20changelog?= =?UTF-8?q?=20(#58)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 6 ++++-- CHANGELOG.md | 1 + docs/CONSUMERS.md | 14 ++++++++++++-- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5b4617d..a9c2a5d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,8 +52,9 @@ jobs: uses: ./.github/workflows/release-exercise.yml # The self-guards (issue #11): this repo eats exactly what it serves. The - # three guard actions run against the REAL tree — VERSION, CHANGELOG.md, - # drills/ — through the same `uses:` steps every consumer's CI carries. + # guard actions run against the REAL tree — VERSION, CHANGELOG.md, + # drills/, .github/workflows/ — through the same `uses:` steps every + # consumer's CI carries. # These steps are also the composite-action wiring proof (issue #5's # acceptance criterion: action.yml resolving, $GITHUB_ACTION_PATH, the # relative lib sourcing) that action-exercise carried with scratch files @@ -73,6 +74,7 @@ jobs: - uses: ./actions/changelog-armed - uses: ./actions/changelog-monotonic - uses: ./actions/drill-recorded + - uses: ./actions/runner-isolated # Exercises changelog-monotonic the way a consumer does, against a # CONSTRUCTED history. The self-guards job above runs the same action on diff --git a/CHANGELOG.md b/CHANGELOG.md index 2cf773f..570debb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ so entries say what changed, cite the issue, and stop. - `needs-ruling` — the cross-cutting flag for a pending human decision, excluded from `state:needs-human` and from the staleness sweep (#51). - Cross-repo doctrine: the panel is the PR's repo's roster, a review request is authorization but not panel membership, and `Part of #N` replaces the `Closes #N` that cannot cross repos (#57). +- `actions/runner-isolated` — a `pull_request`-triggered job may never run on a self-hosted runner (#58). ## 0.1.0 — 2026-07-22 diff --git a/docs/CONSUMERS.md b/docs/CONSUMERS.md index 85de0c8..1f38c91 100644 --- a/docs/CONSUMERS.md +++ b/docs/CONSUMERS.md @@ -70,6 +70,7 @@ the machinery at all: - uses: heavy-duty/ceremony/actions/changelog-armed@ - uses: heavy-duty/ceremony/actions/changelog-monotonic@ - uses: heavy-duty/ceremony/actions/drill-recorded@ + - uses: heavy-duty/ceremony/actions/runner-isolated@ ``` `changelog-armed` and `drill-recorded` take @@ -77,6 +78,15 @@ the machinery at all: inputs and defaults are in its `action.yml` ([actions/](../actions/)). Adopting the agent team flow adds the `docs-sync` step ([below](#adopting-the-agent-team-flow)). + + `runner-isolated` asserts that no `pull_request`-triggered workflow + names a self-hosted runner — a PR workflow runs the branch's code, and + unreviewed fork code must never execute on your own hardware + ([#58](https://github.com/heavy-duty/ceremony/issues/58)). It fires on + the PR that first mixes a PR trigger and a self-hosted `runs-on` in + one file; the unblock is splitting the workflow. A repo with **no** + self-hosted runner still wants it: the guard's value is the day + somebody adds one. 6. **Labels automation** (optional but recommended): the caller from [Labels automation](#labels-automation), plus `.github/labels.conf` (panel + the repo's `scope:*` rows) and `.github/labeler.yml` (the @@ -323,9 +333,9 @@ Bumping the pin re-syncs the mirror in the same PR — [releases page](https://github.com/heavy-duty/ceremony/releases) is that section, verbatim). One bump PR updates **every** ceremony `uses:` reference in the repo to the new tag — the workflow callers *and* each - guard step; a release-only setup already has four (the + guard step; a release-only setup already has five (the [release caller](#release-workflow) plus the - [three CI guards](#bootstrap-a-new-repo)), and changing only one line + [four CI guards](#bootstrap-a-new-repo)), and changing only one line leaves the consumer split across ceremony versions, which the same-tag rule above forbids. A repo that has adopted the agent team flow additionally bumps the mirror in the same PR —