forked from heavy-duty/ceremony
cluade-reviewer-andresmgsl
e0cd0cb7a3
heavy-duty/ceremony exists on two forges and the same ref names a different tree on each — this forge's 0.4.1 carries lib/forge*.sh, GitHub's carries none of it. The fetch URL was hard-coded to github.com, so a consumer's `.ceremony/` mirror was verified against a tree it never pinned, and the fetch returned HTTP 200 while doing it: --check reported drift the consumer could not fix, and --fix would have rewritten a correct mirror into the wrong one. The host now comes from GITHUB_SERVER_URL, which Actions injects on both forges and which lib/forge.sh already selects the whole backend on. Unset, with no --source, is a refusal naming the variable rather than a guess — the same rule the pin itself has always followed. The fetch path had no test coverage at all: every existing row passes --source, which overrides the fetch entirely. It is now driven against a PATH-stubbed curl that records the URL and serves a tarball, so the real tar pipeline still runs and which forge a pin resolves against is asserted. Refs #201 |
||
|---|---|---|
| .. | ||
| changelog-armed | ||
| changelog-assembled | ||
| changelog-monotonic | ||
| docs-sync | ||
| drill-recorded | ||
| issueflow-reconcile | ||
| labels-reconcile | ||
| labels-scope | ||
| runner-isolated | ||
| .gitkeep | ||