ceremony/changelog.d
clad2 baa683211e fix(labels): pass bootstrap through the workflow_call boundary it was lost at
A called workflow cannot read the caller's dispatch inputs on this forge:
github.event.inputs is empty inside workflow_call even though the top-level
caller receives the value in both contexts (probe runs 6/7). The sweep's gate
read exactly that, so every dispatch-woken sweep bootstrapped — runs 459 and
523, ~20 label upserts per board event — while the trigger honestly logged
bootstrap=no.

The bridge, per the #6361 contract: labels-sweep.yml declares
workflow_call.inputs.bootstrap (string, default "no"); the dogfood caller and
the published CONSUMERS.md stub pass it via with.bootstrap with empty mapped
to "no" at the caller — kimi's edge: on schedule the top-level context is
empty, and an empty that slipped through would have turned every cron into a
bootstrap. The gate feeds the declared input to labels-reconcile unchanged,
so an invalid value meets the action's own yes|no refusal.

test/labels-bootstrap.test.sh pins every hop: the declared boundary, both
gates as the identity, no expression reading github.event.inputs (scoped to
${{ }} bodies — the file's prose names the context to explain it), the two
pass-throughs byte-exact, and the four value paths driven through the shipped
expressions into the action's real validator. Mutations: dropping the
declaration reds 4, dropping the pass-through reds 3, restoring the old gate
reds 2.

Refs #215
2026-08-05 21:06:29 +00:00
..
192.md fix(forgejo): a read failure names its verb too, and the tests assert the whole diagnostic (#192) 2026-08-05 13:11:33 +00:00
195.md fix(labels): panel and triage name identities that exist on this forge (#195) 2026-08-04 19:09:16 +00:00
198.md fix(198): the action fails closed, the caller decides scheduling, the guard decides the forge (#198) 2026-08-05 12:30:28 +00:00
199.md fix(refs-not-closing): gather over REST, so the guard produces verdicts here 2026-08-05 17:11:19 +00:00
200.md fix(upstream-delta): discovery is git's index, not the filesystem (#200) 2026-08-05 14:10:56 +00:00
201.md fix(docs-sync): the mirror is fetched from the forge in play, never a built-in one (#201) 2026-08-05 11:16:23 +00:00
202.md docs(runner-probes): restore !207's release notes; per-run links; honest security lesson 2026-08-05 19:48:04 +00:00
205.md fix(labels): refuse an unset API root, name transport failures, update the docs 2026-08-05 17:16:30 +00:00
209.md fix(forge): forge_commit_at — Forgejo serves a single commit at /git/commits/{sha} (#209) 2026-08-05 15:01:32 +00:00
210.md test(issueflow): each of the three sites is caught by behaviour, not only by the pin (#210) 2026-08-05 14:37:37 +00:00
215.md fix(labels): pass bootstrap through the workflow_call boundary it was lost at 2026-08-05 21:06:29 +00:00
README.md feat: ceremony flips to grouped — changelog.d/shape = grouped, five fragments converted, docs per D6 2026-07-25 13:14:05 +00:00
shape feat: ceremony flips to grouped — changelog.d/shape = grouped, five fragments converted, docs per D6 2026-07-25 13:14:05 +00:00

changelog.d/ — the next release's section, one fragment per issue

Machine-assembled by bin/changelog-assemble (#112): every PR that changes behavior writes one file here — <issue>.md, the exact prose that will be published, nothing else — and the release PR folds them all into the next ## X.Y.Z — DATE section of CHANGELOG.md, consuming them. Distinct filenames never conflict, which is this directory's whole reason to exist. This README is the marker that keeps the directory tracked when it holds no fragments (#112 D1) — changelog-armed refuses a tree without it; do not delete it. The shape sentinel beside it declares the set's shape — grouped here, so every fragment carries ### headings (#182).