mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
93521ee0b3
019fb572a7 minted the app token before the script could decide whether a push
follows, so every repository paid for a job that mostly no-ops. Run 37169357364
showed the cost on the fork: BOT_APP_CLIENT_ID is unset there, the token step
failed, and sync-main went red earlier than before rather than green. On
infinito-nexus/core the script always takes the source-equals-target shortcut,
so every push on every branch would have drawn a Workflows:write token for
nothing.
The script now resolves its own decision and writes sync=true|false to
GITHUB_OUTPUT when CI_SYNC_MAIN_DECIDE_ONLY is set. The workflow asks first and
gates both the token and the push on the answer, which is also what makes the
documented off-switch work: with CI_SYNC_MAIN_SOURCE_REPOSITORY disabled the job
now ends green instead of failing on an absent secret. The decision stays in the
script, so the workflow does not restate the normalization or the disabled-value
list.
The push takes its credential from CI_SYNC_MAIN_PUSH_TOKEN through a credential
helper rather than a remote URL or an extraheader: .git/config holds the
variable name and the helper expands it at call time, so the token reaches
neither argv nor the config file. Checkout runs with persist-credentials: false
because its extraheader would otherwise outrank the helper.
Verified by running all four paths: source equals target and disabled both emit
sync=false and exit 0, a mirroring fork emits sync=true, and push mode without a
token fails loudly. git credential fill against the configured helper returns
username=x-access-token and the value from the environment.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>GitHub Workflow Helpers 🔧
This directory holds the shell helpers that GitHub Actions workflows under .github/workflows/ call. Helpers are grouped by responsibility into subfolders so each workflow file pulls only from the clusters it actually needs.
Subfolders 🗂️
| Subfolder | Responsibility |
|---|---|
| runner/ | Host-runner hygiene around image builds and deploys (disk, swap, Docker daemon, diagnostics). |
| cancel/ | Cancellation of in-progress workflow runs on PR-close and branch-delete events. |
| cleanup/ | Scheduled repository maintenance that prunes stale GitHub resources. |
| resolve/ | Derivation of structured workflow inputs and outputs from repository state. |
| sync/ | Ref synchronization before workflow jobs derive CI scope from git history. |
| update/ | The scheduled 🔄 Update versions pipeline (version bumps and PR open/refresh). |
| i18n/ | Catalog extraction and machine translation for the per-language runners of 🌐 Translate catalogs. |
| release/ | Release-time gates that decide whether a tagged commit may be released. |
A new helper MUST live in the subfolder that matches its responsibility. New responsibilities MAY motivate a new subfolder, but MUST NOT flatten back into the top level.
For the workflow catalog see workflows.md. For the repository Make target index see make.md.