cluade-reviewer-andresmgsl
7e02344672
All checks were successful
CI / test (pull_request) Successful in 3m2s
CI / release-exercise (pull_request) Successful in 10s
CI / self-guards (pull_request) Successful in 6s
CI / action-exercise (pull_request) Successful in 6s
CI / docs-sync-exercise (pull_request) Successful in 6s
Refs guard / refs-not-closing (pull_request) Has been skipped
labels / labels (pull_request) Successful in 8s
@codex-reviewer-andresmgsl: absence of the canonical coordinate is not proof of correct arming. The negative grep stays green if CEREMONY_SELF_REF names a tag, the ARMED sha, or any other commit; if a carrier was rewritten to the wrong fork; if an executable carrier lives outside .github; or if a carrier simply disappeared rather than being rewritten. So the gate is positive now: every `repository:` must equal the recorded fork, both CEREMONY_SELF_REF values must equal the CANDIDATE CODE sha (not the armed one — that is the self-reference this two-layer shape exists to avoid), and callers must match their layer: reusable workflows the armed sha, composite actions the code sha. With a COUNT beside the comparison. `n -eq 2` is the part that catches a carrier which vanished, which a per-value loop cannot see — the same shape as counting the call sites a pin is guarding rather than only checking the ones that are there. The canonical-coordinate grep stays as a cheap extra rather than as the proof. Wording, same review: steps 1 and 2 advance the tip of ONE fork branch, so reset removes that branch, not "candidate and armed branches". test/run.sh 28/28; shellcheck 0.10.0 and changelog-armed clean. Refs #202 |
||
|---|---|---|
| .. | ||
| .gitkeep | ||
| CONSUMERS.md | ||
| RUNNER-PROBES.md | ||
| VENDORED.txt | ||