fix(ci): restore valid adversarial-review.yml + pin gadfly reusable @7bc3c98 [skip ci]

The reusable now reads swarm config from user-scope vars (GADFLY_DEFAULT_* + GADFLY_ENDPOINT_*); this immutable @sha bumps past the long-lived-runner ref cache so the vars-config reusable is adopted. Direct to main + [skip ci] to avoid triggering the review swarm. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ci: pin gadfly reusable workflow to immutable sha (cache-bust @v1)
2026-06-28 02:05:28 -04:00 · 2026-06-28 05:44:52 +00:00
1 changed files with 5 additions and 4 deletions
@@ -38,10 +38,11 @@ jobs:
          && (github.actor == 'steve'
              || github.actor == 'fizi'
              || github.actor == 'dazed'))
-    # Tracks gadfly's v1 release tag — a curated pointer re-moved on each release
-    # (unlike @main, which moves on every push). Central swarm tuning propagates
-    # here automatically; the tradeoff vs a full sha pin is that v1 is mutable.
-    uses: steve/gadfly/.gitea/workflows/review-reusable.yml@v1
+    # Pinned to an immutable gadfly commit (not @v1): our act_runners are long-lived
+    # and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the
+    # stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this
+    # sha to adopt central swarm changes.
+    uses: steve/gadfly/.gitea/workflows/review-reusable.yml@7bc3c982fa7b72367034c673f7812bf05e9c503e
    # Least privilege: forward only the review secrets (not `secrets: inherit`,
    # which would expose every repo secret). GITEA_TOKEN is the automatic token.
    secrets: