Homelab/workflows
Homelab/workflows
Watch
5
0
Fork
You've already forked workflows
 0
Code Issues 7 Pull requests Projects Releases 95 Packages Wiki Activity Actions

fix(ci): use safe inputs and versioned workflow releases #9

Merged
gitchegumi merged 3 commits from fix/forgejo-input-names into main 2026-09-04 15:11:16 -05:00
Conversation 2 Commits 3 Files changed 15 +173 -147
kiyi commented 2026-09-04 14:39:01 -05:00
Member
Copy link

Forgejo resolves the reusable workflow's hyphenated input expression in runs-on to an empty label, leaving the Homelab/bundles consumer job waiting with no requested runner label.

This renames every reusable workflow_call input to an underscore identifier and updates all expressions, examples, and documentation. A contract test now rejects hyphenated input identifiers and expressions so runner, library, registry, and deployment inputs cannot regress.

Validation:

  • 28 Python unit and contract tests pass.
  • YAML and Bash scaffold validation passes in WSL across 16 mocked success, finding, error, and version cases.
  • The hosted test-library workflow will run checksum-verified setup and full integration on the ci runner.
  • No application bundle was built or deployed.

Follow-up after merge:

  • pin Homelab/bundles PR #3 to this merge commit
  • update its caller input keys
  • rerun the cross-repository source-security consumer check

Relates to #3.

Forgejo resolves the reusable workflow's hyphenated input expression in runs-on to an empty label, leaving the Homelab/bundles consumer job waiting with no requested runner label. This renames every reusable workflow_call input to an underscore identifier and updates all expressions, examples, and documentation. A contract test now rejects hyphenated input identifiers and expressions so runner, library, registry, and deployment inputs cannot regress. Validation: - 28 Python unit and contract tests pass. - YAML and Bash scaffold validation passes in WSL across 16 mocked success, finding, error, and version cases. - The hosted test-library workflow will run checksum-verified setup and full integration on the ci runner. - No application bundle was built or deployed. Follow-up after merge: - pin Homelab/bundles PR #3 to this merge commit - update its caller input keys - rerun the cross-repository source-security consumer check Relates to #3.
fix(ci): use Forgejo-safe workflow input names
All checks were successful
Library checks / tests (pull_request) Successful in 1m37s
Details
8f2b736851 
Rename reusable workflow inputs from hyphenated keys to underscore identifiers so Forgejo resolves runner labels and subsequent delivery inputs. Update examples and documentation, and add a contract test that rejects unsafe input names.
fix(ci): pin workflow consumers to release tags
All checks were successful
Library checks / tests (pull_request) Successful in 1m27s
Details
af1c52bafd 
Accept immutable vMAJOR.MINOR.PATCH tags in reusable workflow callers instead of requiring raw commit hashes. Resolve each tag to its commit SHA inside build receipts and document the protected release process.
kiyi commented 2026-09-04 14:48:08 -05:00
Author
Member
Copy link

Release policy update: consumer repositories will use readable immutable semantic version tags such as v1.0.0 in both uses and library_ref. They will not contain raw workflow commit hashes or track main. Build receipts resolve the selected tag to its commit SHA internally for provenance.

The release protocol is documented in docs/releases.md: merge through protected main, publish the next unused vMAJOR.MINOR.PATCH tag, never move or reuse a published tag, and update consumers through reviewed pull requests.

Follow-up after this PR merges: publish v1.0.0, update Homelab/bundles PR #3 to v1.0.0 and the underscore input names, then rerun its consumer check.

Release policy update: consumer repositories will use readable immutable semantic version tags such as v1.0.0 in both uses and library_ref. They will not contain raw workflow commit hashes or track main. Build receipts resolve the selected tag to its commit SHA internally for provenance. The release protocol is documented in docs/releases.md: merge through protected main, publish the next unused vMAJOR.MINOR.PATCH tag, never move or reuse a published tag, and update consumers through reviewed pull requests. Follow-up after this PR merges: publish v1.0.0, update Homelab/bundles PR #3 to v1.0.0 and the underscore input names, then rerun its consumer check.
kiyi changed title from fix(ci): use Forgejo-safe workflow input names to fix(ci): use safe inputs and versioned workflow releases 2026-09-04 14:48:49 -05:00
style(docs): keep Markdown paragraphs on single lines
All checks were successful
Library checks / tests (pull_request) Successful in 1m30s
Details
f2dc2068e0 
Let rendered word wrapping handle paragraph width while preserving normal Markdown structure for lists, tables, and code blocks.
gitchegumi approved these changes 2026-09-04 15:10:28 -05:00
gitchegumi deleted branch fix/forgejo-input-names 2026-09-04 15:11:16 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
gitchegumi
Labels
Clear labels
  
app-migration

   
bug
Something is not working

  
ci-cd

   
cluster

   
Documentation

   
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
gpu

   
invalid
Something is wrong

  
networking

   
question
More information is needed

  
security

   
Storage

   
wontfix
This won't be fixed

No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Homelab/workflows!9
No description provided.