From b6981fbcb1d844b0789db42cecfe3329ebbb117b Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Sat, 22 Aug 2026 19:16:56 -0400 Subject: [PATCH] ci: re-pin Gadfly to a reusable workflow whose image still exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned gadfly commit (c9dab69) hard-coded the reviewer image gadfly:sha-b37cd09, which has since been pruned from the registry, so every review on a new PR failed in one second at "manifest unknown" (#124's did). gadfly's current main (8adeeea) runs the reviewer as a job container whose tag resolves at run time — reviewer_tag input → GADFLY_REVIEWER_TAG var → a baked fallback (sha-b850e35, verified present) — so a retired tag can't strand the consumer stubs again. Inputs and secrets are a superset of what this stub forwards. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/adversarial-review.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/adversarial-review.yml b/.gitea/workflows/adversarial-review.yml index 36abf92..9b8d536 100644 --- a/.gitea/workflows/adversarial-review.yml +++ b/.gitea/workflows/adversarial-review.yml @@ -42,7 +42,13 @@ jobs: # and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the # stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this # sha to adopt central swarm changes. - uses: steve/gadfly/.gitea/workflows/review-reusable.yml@c9dab69d143cb614c1840a5b06d6ffc358f4752d + # + # 8adeeea resolves the reviewer image tag at RUN time (reviewer_tag input → + # the owner's GADFLY_REVIEWER_TAG var → a baked fallback that exists in the + # registry), so a retired image tag can't strand this stub again: the previous + # pin (c9dab69) hard-coded gadfly:sha-b37cd09, which had been pruned from the + # registry by 2026-08-22 and every review died at "manifest unknown". + uses: steve/gadfly/.gitea/workflows/review-reusable.yml@8adeeeabe0738a797a1bdfc42c5176ea8ee627e4 # Least privilege: forward only the review secrets (not `secrets: inherit`, # which would expose every repo secret). GITEA_TOKEN is the automatic token. secrets: