steve/pansy
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

ci: re-pin Gadfly to a reusable workflow whose image still exists
Build image / build-and-push (push) Successful in 15s
Details

Browse Source 
The pinned gadfly commit (c9dab69) hard-coded the reviewer image
gadfly:sha-b37cd09, which has since been pruned from the registry, so every
review on a new PR failed in one second at "manifest unknown" (#124's did).
gadfly's current main (8adeeea) runs the reviewer as a job container whose tag
resolves at run time — reviewer_tag input → GADFLY_REVIEWER_TAG var → a baked
fallback (sha-b850e35, verified present) — so a retired tag can't strand the
consumer stubs again. Inputs and secrets are a superset of what this stub
forwards.

Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
steve
2026-08-22 19:16:56 -04:00
co-authored by Claude Fable 5
parent 18b36870d4
commit b6981fbcb1
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/adversarial-review.yml
+7 -1
View File
@@ -42,7 +42,13 @@ jobs:
# and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the # and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the
# stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this # stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this
# sha to adopt central swarm changes. # sha to adopt central swarm changes.
uses: steve/gadfly/.gitea/workflows/review-reusable.yml@c9dab69d143cb614c1840a5b06d6ffc358f4752d #
# 8adeeea resolves the reviewer image tag at RUN time (reviewer_tag input →
# the owner's GADFLY_REVIEWER_TAG var → a baked fallback that exists in the
# registry), so a retired image tag can't strand this stub again: the previous
# pin (c9dab69) hard-coded gadfly:sha-b37cd09, which had been pruned from the
# registry by 2026-08-22 and every review died at "manifest unknown".
uses: steve/gadfly/.gitea/workflows/review-reusable.yml@8adeeeabe0738a797a1bdfc42c5176ea8ee627e4
# Least privilege: forward only the review secrets (not `secrets: inherit`, # Least privilege: forward only the review secrets (not `secrets: inherit`,
# which would expose every repo secret). GITEA_TOKEN is the automatic token. # which would expose every repo secret). GITEA_TOKEN is the automatic token.
secrets: secrets: