kevinveenbirkenbachandClaude Opus 5
36cd39533a
The pipeline gate only listed twelve of seventeen jobs in its needs, leaving out wait-fork-prereq-run, fork-prereqs-ready, build-ci-images, images-mirror-missing and test-dns. A failure in any of them turns its dependents into skipped rather than failure, and the gate's check matches only failure and cancelled, so the run would have concluded green without images ever being built. A caller-supplied whitelist was also passed through verbatim. Run 30492550883 was dispatched with web-app-prometheu; discovery dropped the unknown id without a warning, the empty resolution became [], the deploy workflows skipped their whole matrix on that condition and the parent job still concluded success. Validate every id against roles/<id> and exit naming the offenders, so a typo cannot quietly remove an application from a run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Workflow Input Resolution 🔎
Shell helpers that derive structured inputs and outputs for GitHub Actions jobs from repository state.
Scope 📋
This directory contains pure resolvers that read repository state (git history, role metadata, version tags, input environment variables) and emit resolved values either via $GITHUB_OUTPUT or stdout. Resolvers MUST be idempotent and MUST NOT mutate repository or registry state beyond writing to $GITHUB_OUTPUT. The covered concerns are distro selection for push CI, diff-driven app whitelist resolution, the 🧩 Subset label dispatch (pr_affected_roles.sh, which picks between the PR-body subset and the diff resolver), release-tag parsing, app discovery for the deploy matrix, and change detection that gates the update pipeline.
For the workflow catalog that consumes these outputs see workflows.md. For the diff-driven whitelist contract see the "Diff-driven app selection" section in pipeline.md.