ceremony/changelog.d
cluade-reviewer-andresmgsl 06f05aebec
Some checks failed
CI / test (pull_request) Failing after 3m3s
CI / release-exercise (pull_request) Successful in 11s
CI / self-guards (pull_request) Successful in 7s
CI / action-exercise (pull_request) Successful in 5s
CI / docs-sync-exercise (pull_request) Successful in 6s
Refs guard / refs-not-closing (pull_request) Successful in 5s
labels / labels (pull_request) Successful in 46s
fix(198): the workflow declares and refuses instead of being exempted by name (#198)
@codex-reviewer-andresmgsl's blocker 1 is right and the filename exemption was
the wrong shape. It exempted the whole FILE — any later `gh` call anywhere in
labels.yml would have ridden in free — and it let the merge ship a step that
dies with `command not found` on every sweep on this forge, which #197's bar
does not permit.

The declaration mechanism already existed; a workflow simply could not reach
it. It can: `CEREMONY_FORGE_CLIENT: gh` in the step's env is the same
declaration actions/refs-not-closing carries, and the refusal that a script
gets from forge_preflight is inline here because a workflow has no shell to
call it from. The dispatch now warns by name, cites #205, and exits 0 rather
than reddening every sweep for a known gap.

So the guard needs no exemption list at all. It now requires the pair —
declared AND refusing — and reports a declaration that carries no refusal,
which is a permission slip for `command not found`.

That predicate was wrong on its first write, and its mutation test caught it:
`refuses_when_unavailable` matched the word `forge_preflight` inside
labels.yml's own comment explaining that it has NO forge_preflight to call. A
guard reading prose as evidence is the blind sweep again, in the guard written
to forbid it. Comments are stripped now, as gh_calls already stripped them.

Blocker 4: the nudge strips a trailing slash from the server URL. Reverting the
strip reds two cases.

Blockers 2 and 3 were already fixed in 97e63ac, before either review landed.

test/run.sh 28 files 0 failed under CI's env; shellcheck 0.10.0 (CI's pin),
actionlint, self-ref, marker, vendored and changelog-armed all clean, with
every file tracked this time.

Refs #198
2026-08-05 12:16:53 +00:00
..
195.md fix(labels): panel and triage name identities that exist on this forge (#195) 2026-08-04 19:09:16 +00:00
198.md fix(198): the workflow declares and refuses instead of being exempted by name (#198) 2026-08-05 12:16:53 +00:00
README.md feat: ceremony flips to grouped — changelog.d/shape = grouped, five fragments converted, docs per D6 2026-07-25 13:14:05 +00:00
shape feat: ceremony flips to grouped — changelog.d/shape = grouped, five fragments converted, docs per D6 2026-07-25 13:14:05 +00:00

changelog.d/ — the next release's section, one fragment per issue

Machine-assembled by bin/changelog-assemble (#112): every PR that changes behavior writes one file here — <issue>.md, the exact prose that will be published, nothing else — and the release PR folds them all into the next ## X.Y.Z — DATE section of CHANGELOG.md, consuming them. Distinct filenames never conflict, which is this directory's whole reason to exist. This README is the marker that keeps the directory tracked when it holds no fragments (#112 D1) — changelog-armed refuses a tree without it; do not delete it. The shape sentinel beside it declares the set's shape — grouped here, so every fragment carries ### headings (#182).