kevinveenbirkenbachandClaude Opus 4.8
6ad17c07de
The maintainer-only manual CI dispatch (workflow_dispatch) cannot be triggered by fork contributors. The 🧩 Subset label closes that gap: when present on a PR, the detect-affected-roles job resolves the deploy whitelist from an explicit roles: YAML block in the PR body instead of the diff, giving fork PRs the same narrowed matrix a maintainer would dispatch manually. Without the label, behavior is unchanged (the dispatcher falls through to the diff resolver, output byte-identical). - subset_roles.py: parse and strictly validate the PR-body roles block (invalid YAML / empty / unknown id / path-traversal all hard-fail) - pr_affected_roles.sh: single dispatcher selecting subset vs diff resolver - entry-pull-request-change.yml: wire the label and PR body into the job - PR templates, pipeline/workflows docs and READMEs, integration tests Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.1 KiB
Workflow Input Resolution 🔎
Shell helpers that derive structured inputs and outputs for GitHub Actions jobs from repository state.
Scope 📋
This directory contains pure resolvers that read repository state (git history, role metadata, version tags, input environment variables) and emit resolved values either via $GITHUB_OUTPUT or stdout. Resolvers MUST be idempotent and MUST NOT mutate repository or registry state beyond writing to $GITHUB_OUTPUT. The covered concerns are distro selection for push CI, diff-driven app whitelist resolution, the 🧩 Subset label dispatch (pr_affected_roles.sh, which picks between the PR-body subset and the diff resolver), release-tag parsing, app discovery for the deploy matrix, and change detection that gates the update pipeline.
For the workflow catalog that consumes these outputs see workflows.md. For the diff-driven whitelist contract see the "Diff-driven app selection" section in pipeline.md.