From e05bbe0b1332f43f25e47664234d88adeb0cb345 Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Fri, 21 Aug 2026 23:28:30 -0400 Subject: [PATCH] =?UTF-8?q?ci(gadfly):=20repin=20to=20@8adeeea=20=E2=80=94?= =?UTF-8?q?=20the=20old=20pin's=20image=20tag=20does=20not=20exist?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned reusable workflow (@c9dab69d) hardcoded `docker://…/steve/gadfly:sha-b37cd09` into the step URI. That tag was never pushed to the registry, so every review in this repo failed in ~1s on "failed to resolve reference … not found" — a red workflow that reads exactly like a review which found nothing (PR #28, run 7056). @8adeeea runs the reviewer as the job container and resolves its tag per run — inputs.reviewer_tag then vars.GADFLY_REVIEWER_TAG then the baked sha-b850e35 — so the hardcoded-dead-tag failure cannot recur, and retagging the reviewer needs no commit here. Both sha-b850e35 and sha-8adeeea are present in the registry. Gadfly config is read from main, so this has to land on main to take effect for any PR's review. --- .gitea/workflows/adversarial-review.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/adversarial-review.yml b/.gitea/workflows/adversarial-review.yml index 36abf92..7b54ac1 100644 --- a/.gitea/workflows/adversarial-review.yml +++ b/.gitea/workflows/adversarial-review.yml @@ -42,7 +42,17 @@ jobs: # and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the # stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this # sha to adopt central swarm changes. - uses: steve/gadfly/.gitea/workflows/review-reusable.yml@c9dab69d143cb614c1840a5b06d6ffc358f4752d + # + # NB: the reviewer IMAGE tag is no longer part of this pin. From @8adeeea on, + # the reusable workflow resolves it per run as + # `inputs.reviewer_tag || vars.GADFLY_REVIEWER_TAG || 'sha-b850e35'`, so + # retagging the reviewer is a user-scope variable edit with no commit here. + # The previous pin (@c9dab69d) hardcoded `docker://…gadfly:sha-b37cd09`, a tag + # that was never pushed to the registry — every review in this repo died in + # ~1s on "failed to resolve reference … not found", which reads exactly like a + # review that found nothing. Before bumping this pin again, check the tag its + # fallback names is really in the registry. + uses: steve/gadfly/.gitea/workflows/review-reusable.yml@8adeeeabe0738a797a1bdfc42c5176ea8ee627e4 # Least privilege: forward only the review secrets (not `secrets: inherit`, # which would expose every repo secret). GITEA_TOKEN is the automatic token. secrets: -- 2.54.0