6 Commits

Include renames

Author	SHA1	Message	Date
steveandClaude Fable 5	4dafac0d13	feat(reusable): resolve the reviewer image tag at runtime (GADFLY_REVIEWER_TAG) ... Nearly every consumer re-pin of review-reusable.yml was a reviewer IMAGE bump, not a structural change — but the tag was baked into a `uses: docker://` step, which is parsed before any expression context exists and so can't read a variable. Run the reviewer as the JOB container instead (container.image DOES accept expressions) with an explicit `run: /entrypoint.sh` step: the tag now resolves per-run via inputs.reviewer_tag → user var GADFLY_REVIEWER_TAG → the baked fallback pin (sha-b37cd09, unchanged). A Gadfly release becomes: build the image, update the ONE user-level variable — every consumer pinned to this file's @<sha> picks it up on its next review with no re-pin. Workflow re-pins remain only for structural yml changes (this is one — intended to be the last routine one). - Entrypoint contract unchanged: same env block, same /entrypoint.sh brains (bash + entrypoint already live in the image; ENTRYPOINT was /entrypoint.sh). - Keep the variable on immutable sha- tags, never :latest (act_runner caches :latest and often does not re-pull a moved one). - Tradeoff noted in comments: vars are unmasked and move without a commit trail — same blast radius as editing this file, minus the audit trail. - README (image/pinning para + Central config table) and examples/reusable.yml updated per the maintenance rule. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-07-22 22:43:37 -04:00
Steve DudenhoefferandClaude Opus 4.8	6e87a3e73f	docs: correct examples/reusable.yml pin guidance (runners cache @v1; prefer @sha) ... The @v1 comment claimed it auto-updates on releases, but long-lived act_runners cache the reusable by ref so a moved tag isn't re-fetched. Recommend an immutable @<sha>; routine tuning rides owner variables. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-28 02:10:35 -04:00
steve	8f69e71311	docs: recommend the @v1 release tag for reusable-workflow consumers (#12)	2026-06-28 04:17:19 +00:00
steve	b02b11d691	feat(reusable): ship the curated swarm as the default config consumers inherit (#10)	2026-06-28 02:23:40 +00:00
Steve DudenhoefferandClaude Opus 4.8	f06fe5ef72	security: scope reusable-workflow secrets (least privilege) over secrets: inherit ... The swarm (reviewing the mort/executus rollout PRs) correctly flagged that `secrets: inherit` forwards EVERY caller secret to the reusable review workflow — registry/deploy/db creds the reviewer never touches. Fix: - review-reusable.yml: declare workflow_call.secrets (all optional) so a caller can forward only what the reviewer needs. - adversarial-review.yml (gadfly's own caller) + examples/reusable.yml: replace `secrets: inherit` with an explicit forward of just OLLAMA_CLOUD_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / findings tokens. GITEA_TOKEN stays automatic. - Docs (README, examples) updated; also advise pinning consumers to an immutable @<sha> instead of @main (supply-chain, the other finding). gadfly's own review on this PR exercises the explicit-secrets path (local reusable ref) — validating it on the act_runner before mort/executus adopt it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-06-27 20:45:18 -04:00
steveandClaude Opus 4.8	5f86062a5a	feat: Phase 4 — reusable "subscribe" workflow (+ dogfood it) (#8) ... Centralizes the consumer stub into a reusable Gitea workflow (.gitea/workflows/review-reusable.yml, workflow_call + defaulted inputs + secrets: inherit); gadfly's own dogfood is now a thin caller of it, which proved end-to-end that github.event context propagates into the reusable on this act_runner. Adds the slim examples/reusable.yml stub + docs. Folded in the swarm's findings: timeout_minutes default 30->45, map GADFLY_API_KEY, explicit permissions block, drop the dead specialist_suite input, and harden the example's actor gate. ~70 findings graded. Completes the gadfly-games build (Phases 1-4 + quality fixes). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Co-authored-by: Steve Dudenhoeffer <[email protected]> Co-committed-by: Steve Dudenhoeffer <[email protected]>	2026-06-27 23:42:01 +00:00