mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
93521ee0b3
019fb572a7 minted the app token before the script could decide whether a push
follows, so every repository paid for a job that mostly no-ops. Run 37169357364
showed the cost on the fork: BOT_APP_CLIENT_ID is unset there, the token step
failed, and sync-main went red earlier than before rather than green. On
infinito-nexus/core the script always takes the source-equals-target shortcut,
so every push on every branch would have drawn a Workflows:write token for
nothing.
The script now resolves its own decision and writes sync=true|false to
GITHUB_OUTPUT when CI_SYNC_MAIN_DECIDE_ONLY is set. The workflow asks first and
gates both the token and the push on the answer, which is also what makes the
documented off-switch work: with CI_SYNC_MAIN_SOURCE_REPOSITORY disabled the job
now ends green instead of failing on an absent secret. The decision stays in the
script, so the workflow does not restate the normalization or the disabled-value
list.
The push takes its credential from CI_SYNC_MAIN_PUSH_TOKEN through a credential
helper rather than a remote URL or an extraheader: .git/config holds the
variable name and the helper expands it at call time, so the token reaches
neither argv nor the config file. Checkout runs with persist-credentials: false
because its extraheader would otherwise outrank the helper.
Verified by running all four paths: source equals target and disabled both emit
sync=false and exit 0, a mirroring fork emits sync=true, and push mode without a
token fails loudly. git credential fill against the configured helper returns
username=x-access-token and the value from the environment.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>GitHub Sync Helpers 🔄
This directory contains shell helpers that synchronize repository refs before later workflow jobs derive CI scope from git history.