ceremony/.github/workflows
clad2 935a813d75
All checks were successful
CI / test (pull_request) Successful in 3m13s
CI / release-exercise (pull_request) Successful in 11s
CI / self-guards (pull_request) Successful in 7s
CI / action-exercise (pull_request) Successful in 6s
CI / docs-sync-exercise (pull_request) Successful in 6s
Refs guard / refs-not-closing (pull_request) Has been skipped
labels / labels (pull_request) Successful in 8s
fix(labels): wake the sweep over REST, so board events reconcile in seconds
`.github/workflows/labels.yml` dispatched the sweep with `gh workflow run`,
the eighth runtime gh call site the 0.6.0 merge reintroduced and the only one
!204 did not port. On this forge the runner carries neither gh nor a GitHub
API, so the step refused and the entire event-driven reconcile path ended
there — every transition waiting up to an hour for the scheduled sweep.

The workflow-dispatch endpoint has the SAME shape on both forges:

  POST {api}/repos/{owner}/{repo}/actions/workflows/{file}/dispatches
  {"ref": "<branch>", "inputs": {...}}  -> 204, empty body

so the step no longer decides a forge at all. The CEREMONY_FORGE_CLIENT=gh
declaration and both inline refusals are removed rather than ported, and
test/no-runtime-gh.test.sh now asserts their ABSENCE — an opt-out with no gh
behind it is a standing permission slip.

The ref is supplied explicitly and taken from the repository, never from
GITHUB_REF_NAME: on a pull_request_target run that is `<n>/merge`, which is
not a branch. A non-204 still fails the job, keeping the misconfiguration
alarm the trigger exists to be, and the diagnostic explains Forgejo's empty
500 rather than passing a bare status to a reader who will go looking for an
outage that is not there.

test/labels-dispatch.test.sh extracts the shipped step and executes it against
a recording stub, asserting the method, endpoint, ref and inputs actually
sent. Dropping the inputs or ignoring a non-204 both red the suite.

Refs #205
2026-08-05 16:58:05 +00:00
..
ci.yml fix(upstream-delta): the object is mandatory, the scan covers every governed surface, and the teeth drive the real guard (#200) 2026-08-05 13:51:21 +00:00
labels-sweep.yml release: cut 0.6.0 2026-08-05 00:01:03 +00:00
labels.yml fix(labels): wake the sweep over REST, so board events reconcile in seconds 2026-08-05 16:58:05 +00:00
refs-guard.yml fix(198): the action fails closed, the caller decides scheduling, the guard decides the forge (#198) 2026-08-05 12:30:28 +00:00
release-exercise.yml merge upstream 0.6.0 onto the forge tree, and port every gh call site it brought (#198) 2026-08-05 11:56:23 +00:00
release.yml merge upstream 0.6.0 onto the forge tree, and port every gh call site it brought (#198) 2026-08-05 11:56:23 +00:00
self-labels-sweep.yml labels: detach the reconcile sweep from PR-triggered runs (#209) 2026-08-01 16:20:00 +00:00
self-labels.yml labels: detach the reconcile sweep from PR-triggered runs (#209) 2026-08-01 16:20:00 +00:00
self-release.yml feat: dogfood bootstrap — ceremony adopts its own ceremony (#11) 2026-07-22 22:19:50 +00:00