fix(ci): use static runner role labels #10

Merged

gitchegumi merged 1 commit from fix/static-runner-labels into main

2026-09-04 15:27:42 -05:00

kiyi commented

2026-09-04 15:22:32 -05:00

Member

This runs reusable scan, build, and publish jobs on the static ci role and cluster deployment jobs on deploy. The existing v1 runner_label and publish_runner_label inputs remain accepted for compatibility, but runner selection happens inside the shared workflow. A contract test rejects dynamic reusable-workflow runner expressions.

Validation:

30 Python unit and contract tests pass.
YAML and embedded Bash scaffold validation passes across 16 mocked success, finding, error, and version cases.
No bundle was built and nothing was deployed.

After merge, publish v1.0.1 and update Homelab/bundles PR #3 from v1.0.0 to v1.0.1. Its consumer security run must select ci and pass before the template PR is ready.

Relates to #3.

Forgejo 16.0.3 expands inputs used by a reusable workflow's runs-on expression to an empty runner label. Homelab/bundles consumer runs #5 and #6 reproduced this with both variable expressions and literal caller input values. This runs reusable scan, build, and publish jobs on the static ci role and cluster deployment jobs on deploy. The existing v1 runner_label and publish_runner_label inputs remain accepted for compatibility, but runner selection happens inside the shared workflow. A contract test rejects dynamic reusable-workflow runner expressions. Validation: - 30 Python unit and contract tests pass. - YAML and embedded Bash scaffold validation passes across 16 mocked success, finding, error, and version cases. - No bundle was built and nothing was deployed. After merge, publish v1.0.1 and update Homelab/bundles PR #3 from v1.0.0 to v1.0.1. Its consumer security run must select ci and pass before the template PR is ready. Relates to #3.

kiyi added 1 commit

2026-09-04 15:22:32 -05:00

fix(ci): use static runner role labels

Library checks / tests (pull_request) Successful in 1m30s

Details

8dfae53766

Run reusable scan, build and publish jobs on ci and deployment jobs on deploy. Forgejo 16 expands reusable inputs in runs-on to an empty label, so keep the v1 input fields for compatibility while enforcing static roles internally.

kiyi referenced this pull request

2026-09-04 15:22:52 -05:00

Establish versioned workflows reusable across organizations #3