42 lines
2.6 KiB
Markdown
42 lines
2.6 KiB
Markdown
# REPORT — CI runs the gate entry point on every push (R-168, 2026-08-02)
|
|
|
|
**Overwritten** per the standing rule. The prior contents (session 1's gate enforcement, same day) have their durable record in `CHANGELOG.md`.
|
|
|
|
**No version bump, no build, no deploy.** This adds `.gitea/workflows/gates.yml` and a CHANGELOG
|
|
entry. Nothing compiled changed.
|
|
|
|
## What changed
|
|
|
|
`.gitea/workflows/gates.yml` — on every push, a Gitea Actions runner obtains this repo at the
|
|
**exact pushed SHA** (shallow `git fetch`, no `uses:` step anywhere) and runs
|
|
`python3 scripts/controller_gates.py --fast` and nothing else. The exit code is the job's result: no `|| true`, no
|
|
pipe that could swallow it.
|
|
|
|
**It REPORTS, it cannot REFUSE**, and the workflow header says so in the pre-push hook's voice: this
|
|
repo pushes straight to `main` with no pull request, so there is no merge for a status check to stand
|
|
at. The refusing half is `.githooks/pre-push` (per-clone, `--no-verify`-able); this half notices when
|
|
that was skipped. Making CI blocking needs branch protection plus a PR workflow — an operator
|
|
decision, tracked as `felhom.eu` `OPEN-ITEMS.md` **R-169**.
|
|
|
|
**A failed run emails the operator.** Probe P5 measured that Gitea itself sends **nothing** on a
|
|
failed run — no mail, no notification row, no log line — so the workflow sends its own via Resend and
|
|
prints the provider's accepted id, making "a message left the machine" an observable. Demonstrated on
|
|
a real red run in `felhom.eu`: `RESEND-ACCEPTED id=5ff34766-c5f8-4588-8104-08296aeb45ab`.
|
|
|
|
**CI reproduces the workspace's SIBLING LAYOUT on purpose.** This repo's entry point invokes the
|
|
shared `reuse_refs_check.py` that lives in the `felhom.eu` clone next door and is deliberately never
|
|
copied here, and this repo's `REUSE.md` cites `wgsync/reconciler.go`, which lives in the hub. The workflow clones
|
|
`felhom.eu` as a sibling; without it the gate fails **closed** with `gate is MISSING` — correctly,
|
|
but for the wrong reason.
|
|
|
|
## Verification
|
|
|
|
First run: run #1, id=8, conclusion **success**, sha `dcc400e1`.
|
|
|
|
**CI and the local pre-push hook AGREE**, which is the check that mattered: `133 cited paths — exact 126, suffix 6, ambiguous 0, cross-repo 1, FAILED 0 (siblings searched: felhom.eu)` — identical to the local run.
|
|
|
|
The runner is unprivileged host-mode, shared with the other three repos on a single owner-scoped
|
|
registration (measured: all four repos' tasks claimed by `felhom-gates-runner`). Full probe detail,
|
|
the security posture and the teardown: `felhom.eu/documentation/audits/SPIKE-ci-runner-2026-08-02.md`
|
|
and `felhom.eu/REPORT.md`.
|