From a7781869fde2eb0b59d311cd21d16e8d66a4a73e Mon Sep 17 00:00:00 2001 From: Lilleman auf Larv Date: Sat, 31 Oct 2026 11:19:11 +0100 Subject: [PATCH] =?UTF-8?q?Answer=20prose=20round=201:=200=20=F0=9F=94=B4,?= =?UTF-8?q?=206=20=F0=9F=9F=A1=20(0=20misread);=20the=20never-on-main=20re?= =?UTF-8?q?ason=20sits=20at=20on:,=20the=20overview=20paragraph=20stops=20?= =?UTF-8?q?narrating=20its=20test,=20the=20AGENTS=20bullet=20splits=20into?= =?UTF-8?q?=20sentences?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitea/workflows/release.yml | 4 ++-- .gitea/workflows/renovate.yml | 3 +-- AGENTS.md | 9 ++++----- 3 files changed, 7 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 7dd707f..0ca879a 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -1,4 +1,5 @@ name: Release +# The Hub overview names a released tag, so it is published here only, never on a push to main. on: push: tags: ['v[0-9]+.[0-9]+.[0-9]+'] @@ -81,8 +82,7 @@ jobs: - uses: actions/checkout@v7.0.1 if: github.event_name == 'push' # Publish the named release's own tree, so the page never pairs one Plainpages tag with another - # release's sidecar pins, which is also why it never syncs on a push to main. A version that - # was never released fails here. + # release's sidecar pins. A version that was never released fails here. - uses: actions/checkout@v7.0.1 if: github.event_name == 'workflow_dispatch' with: diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml index fffd8b7..d842fcf 100644 --- a/.gitea/workflows/renovate.yml +++ b/.gitea/workflows/renovate.yml @@ -38,8 +38,7 @@ jobs: - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - # A persisted token rides every request as an extraheader, outranking the PAT in the push - # URL: Gitea then sees the Actions bot push the tag and starts no workflow for it. + # A persisted token outranks the PAT in the push URL, and Gitea runs nothing for its pushes. persist-credentials: false - name: Tag a release for what Renovate merged env: diff --git a/AGENTS.md b/AGENTS.md index cd48e46..f5287df 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -340,11 +340,10 @@ Revisit only if the stated reason stops holding. *text* guard — the test image ships neither `git` nor `bash`. This is why the Docker Hub overview is `release-tooling/dockerhub-overview.md.tmpl` and not a `.md`: a release reads it and a unit test guards it, so giving it a `.md` name would let a broken `{{VERSION}}` merge with its own guard - skipped. `README.md` is the one markdown tests read — `release-tooling/contract-version.test.ts` - checks its `apiVersion` samples, `release-tooling/dockerhub-overview.test.ts` that the Hub page - says only what it says — and a README-only change skips both; accepted, because those samples are - illustrative, the copies that matter (`examples/`, `views/`, the template) are gated, and the next - gated change catches a README that dropped a Hub command. **Valid while no markdown file is rendered or executed.** + skipped. `README.md` is the one markdown tests read, and a README-only change skips them. Accepted: + the `apiVersion` samples `release-tooling/contract-version.test.ts` checks are illustrative, and + the copies that matter (`examples/`, `views/`, the template) are gated. A Hub page command the + README dropped (`release-tooling/dockerhub-overview.test.ts`) fails the next gated change. **Valid while no markdown file is rendered or executed.** - **CI docker logins share the runner host's Docker config.** The act_runner is host-mode, so `docker login`/`logout` in the workflows mutate one shared `~/.docker/config.json`: concurrent jobs can race (one job's logout can 401 another's push — recover by re-running), and tokens sit in that