7 Commits

Include renames

Author	SHA1	Message	Date
Steve DudenhoefferandClaude Opus 4.8	09d04de619	docs: align review-reusable.yml header comments with the @v1 recommendation ... PR #12's own review flagged that the reusable's own header still said pin @<sha>/@main while the example+README now recommend @v1. Update the header to recommend @v1 (or @<sha>) consistently. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-28 00:15:28 -04:00
steve	0d80ae73d8	tune(reusable): claude-code=3 models × 5 lenses (claude was the bottleneck) (#11)	2026-06-28 04:02:17 +00:00
steve	b02b11d691	feat(reusable): ship the curated swarm as the default config consumers inherit (#10)	2026-06-28 02:23:40 +00:00
Steve DudenhoefferandClaude Opus 4.8	daff6d08a1	docs: drop stale 'secrets: inherit' mentions (reusable comment + CLAUDE.md) ... Self-review on PR #9 flagged two doc-drift spots left over from the explicit-secret-forwarding switch. Cosmetic. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-27 21:00:40 -04:00
Steve DudenhoefferandClaude Opus 4.8	18de9b8ebc	fix: source GITEA_TOKEN from github.token (auto) under explicit secret forwarding ... The first attempt failed at entrypoint.sh:61 'GITEA_TOKEN required' — with explicit secrets (no `inherit`), secrets.GITEA_TOKEN resolves empty in the reusable job. github.token comes from the github context (not a forwarded secret), so it's present regardless. The forwarded provider/findings secrets arrived correctly; only the auto-token sourcing was wrong. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-27 20:53:00 -04:00
Steve DudenhoefferandClaude Opus 4.8	f06fe5ef72	security: scope reusable-workflow secrets (least privilege) over secrets: inherit ... The swarm (reviewing the mort/executus rollout PRs) correctly flagged that `secrets: inherit` forwards EVERY caller secret to the reusable review workflow — registry/deploy/db creds the reviewer never touches. Fix: - review-reusable.yml: declare workflow_call.secrets (all optional) so a caller can forward only what the reviewer needs. - adversarial-review.yml (gadfly's own caller) + examples/reusable.yml: replace `secrets: inherit` with an explicit forward of just OLLAMA_CLOUD_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / findings tokens. GITEA_TOKEN stays automatic. - Docs (README, examples) updated; also advise pinning consumers to an immutable @<sha> instead of @main (supply-chain, the other finding). gadfly's own review on this PR exercises the explicit-secrets path (local reusable ref) — validating it on the act_runner before mort/executus adopt it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-27 20:45:18 -04:00
steveandClaude Opus 4.8	5f86062a5a	feat: Phase 4 — reusable "subscribe" workflow (+ dogfood it) (#8) ... Centralizes the consumer stub into a reusable Gitea workflow (.gitea/workflows/review-reusable.yml, workflow_call + defaulted inputs + secrets: inherit); gadfly's own dogfood is now a thin caller of it, which proved end-to-end that github.event context propagates into the reusable on this act_runner. Adds the slim examples/reusable.yml stub + docs. Folded in the swarm's findings: timeout_minutes default 30->45, map GADFLY_API_KEY, explicit permissions block, drop the dead specialist_suite input, and harden the example's actor gate. ~70 findings graded. Completes the gadfly-games build (Phases 1-4 + quality fixes). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: Steve Dudenhoeffer <[email protected]> Co-committed-by: Steve Dudenhoeffer <[email protected]>	2026-06-27 23:42:01 +00:00