forked from heavy-duty/ceremony
cluade-reviewer-andresmgsl
adf907c963
@codex-reviewer-andresmgsl's second review, both points taken. The refs action goes back to `forge_preflight || exit 1`.97e63achad it exit 0 with a notice so the PR check would not be red, and that conflated two different questions: "this action cannot produce a verdict" is the ACTION's contract and must stay a refusal, while "this check should not block the board" is the CALLER's decision. The caller now carries it — refs-guard.yml skips unless github.server_url is github.com, mirroring forge_detect positively. A skipped check is a green head; an action that reports success it did not earn is not. The leaked preflight_err temp file goes with the revert. The workflow guard asked the wrong question. `command -v gh` alone passes the moment a Forgejo runner image happens to ship gh, and then dispatches against a forge that cannot serve it — the client/forge mismatch forge_preflight exists to prevent. It decides the FORGE first now, mirroring forge_detect positively, and the binary second. The source guard splits to match: a declaration guarded only by binary presence is reported, with a fixture that fails on exactly that shape. The warning text was also wrong on the facts, as noted: issue-event sweeps ARE this caller's event-driven wakes, so they are precisely what is lost. It now says the hourly scheduled sweep survives and every event-driven wake through this caller does not, until #205. Point 1 of that review — jq 1.6 accepting an empty payload — was already fixed in728102a, pushed before the review landed. Verified under the runner's jq 1.6 as well as 1.7: 28 test files, 0 failed both ways. shellcheck 0.10.0 (CI's pin), actionlint, self-ref, marker, vendored, changelog-armed all clean with every file tracked. Refs #198
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
name: Refs guard
|
|
|
|
on:
|
|
# Body edits are load-bearing: #200 gained its accidental closing keyword
|
|
# after the PR opened, with no new commit to wake ordinary CI (#218).
|
|
pull_request:
|
|
types: [opened, edited, reopened, synchronize]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
refs-not-closing:
|
|
# The action is gh-only until #199: its whole gather is a GraphQL query,
|
|
# and Forgejo serves no GraphQL at all. The ACTION refuses by name on a
|
|
# backend it cannot speak (that is its contract, and its contract test);
|
|
# scheduling it where it can only refuse is this workflow's decision, and
|
|
# a permanently red required check would block every merge on this forge
|
|
# for a gap #199 already owns. So the job does not run there — a skipped
|
|
# check is a green head, an invented verdict is not.
|
|
#
|
|
# The condition mirrors lib/forge.sh's forge_detect positively: only
|
|
# github.com is accepted, and anything else — Forgejo, or a host this
|
|
# file has not met — is not run. "Never 'probably github'."
|
|
if: ${{ github.server_url == 'https://github.com' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- uses: ./actions/refs-not-closing
|