mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
The maintainer-only manual CI dispatch (workflow_dispatch) cannot be triggered by fork contributors. The 🧩 Subset label closes that gap: when present on a PR, the detect-affected-roles job resolves the deploy whitelist from an explicit roles: YAML block in the PR body instead of the diff, giving fork PRs the same narrowed matrix a maintainer would dispatch manually. Without the label, behavior is unchanged (the dispatcher falls through to the diff resolver, output byte-identical). - subset_roles.py: parse and strictly validate the PR-body roles block (invalid YAML / empty / unknown id / path-traversal all hard-fail) - pr_affected_roles.sh: single dispatcher selecting subset vs diff resolver - entry-pull-request-change.yml: wire the label and PR body into the job - PR templates, pipeline/workflows docs and READMEs, integration tests Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitHub governance guides 🛡️
This directory contains contributor guidance for GitHub governance and repository controls. Its scope is branch protection, repository settings, GitHub Actions workflows and variables, and other platform rules that affect contributions.