forked from heavy-duty/ceremony
cluade-reviewer-andresmgsl
e0cd0cb7a3
heavy-duty/ceremony exists on two forges and the same ref names a different tree on each — this forge's 0.4.1 carries lib/forge*.sh, GitHub's carries none of it. The fetch URL was hard-coded to github.com, so a consumer's `.ceremony/` mirror was verified against a tree it never pinned, and the fetch returned HTTP 200 while doing it: --check reported drift the consumer could not fix, and --fix would have rewritten a correct mirror into the wrong one. The host now comes from GITHUB_SERVER_URL, which Actions injects on both forges and which lib/forge.sh already selects the whole backend on. Unset, with no --source, is a refusal naming the variable rather than a guess — the same rule the pin itself has always followed. The fetch path had no test coverage at all: every existing row passes --source, which overrides the fetch entirely. It is now driven against a PATH-stubbed curl that records the URL and serves a tarball, so the real tar pipeline still runs and which forge a pin resolves against is asserted. Refs #201 |
||
|---|---|---|
| .. | ||
| 195.md | ||
| 201.md | ||
| README.md | ||
| shape | ||
changelog.d/ — the next release's section, one fragment per issue
Machine-assembled by bin/changelog-assemble (#112): every PR that changes
behavior writes one file here — <issue>.md, the exact prose that will be
published, nothing else — and the release PR folds them all into the next
## X.Y.Z — DATE section of CHANGELOG.md, consuming them. Distinct
filenames never conflict, which is this directory's whole reason to exist.
This README is the marker that keeps the directory tracked when it holds no
fragments (#112 D1) — changelog-armed refuses a tree without it; do not
delete it. The shape sentinel beside it declares the set's shape —
grouped here, so every fragment carries ### headings (#182).