Skip to content

fix(ci-feedback): vendor reusable workflow; repoint at moved repo - #117

Merged
rldyourmnd merged 1 commit into
mainfrom
fix/ci-feedback-vendored
Sep 19, 2026
Merged

rldyourmnd merged 1 commit into
mainfrom
fix/ci-feedback-vendored

Conversation

@rldyourmnd

Copy link
Copy Markdown
Contributor

Summary

ci-feedback-events.yml called NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@6064b7d9. That repository moved to NDDev-Archive/github-actions-garm on 2026-09-17 and is archived, so the call fails at resolution and no CI-failure issues have been published since. This vendors the reusable workflow (verbatim from 6064b7d9) into .github/workflows/ci-feedback.yml and its composite action into actions/ci-feedback/, repoints the caller at the same-repository path, and repoints tool-cache action references at the moved repository (identical pinned commit).

Catalog: ci-feedback leaves tools.yml (a vendored component is not an external pin) and gains a capabilities.yml entry, a workflow-routing.yml entry (linux-shell), and examples/quality/ci-feedback.yml. Generated docs regenerated.

Type of change

  • New reusable workflow / capability
  • Fix to an existing workflow

Threat-model note

Same trust boundary as before: the callable reads completed-run metadata and writes unassigned issues; it never checks out or executes source-run code. Vendoring removes a cross-repository dependency on an archived repo rather than adding surface. The local action reference is bound to the caller's commit.

Permissions diff

ci-feedback job notify: top-level is now permissions: {}; job declares actions: read + issues: write (unchanged scopes, previously top-level).

Checklist

  • actionlint clean; zizmor auditor: no new medium+ findings
  • validate_all core tier OK
  • CHANGELOG under [Unreleased]

Tier impact

  • Public (free OSS suite) -- every tier's caller can use it

NDDev-OpenNetwork/github-actions moved to NDDev-Archive/github-actions-garm
on 2026-09-17. An archived repository cannot serve a workflow_call, so
ci-feedback-events.yml failed at resolution on every triggering run. The
reusable now lives at .github/workflows/ci-feedback.yml and its composite
action at actions/ci-feedback/, vendored verbatim from 6064b7d9; the caller
uses the same-repository path and the action reference inside it is local.

tool-cache action references repoint at the moved repository (same pinned
commit 468af475). Catalog updated: ci-feedback leaves tools.yml (a vendored
component is not an external pin) and gains a capabilities.yml entry, a
workflow-routing entry, and a caller example; generated docs regenerated.

Other repositories' ci-feedback-events.yml files still reference the
archived path and need the same repoint.

Signed-off-by: rldyourmnd <danil@nddev.it.com>
@github-actions github-actions Bot added ci and removed ci labels Sep 19, 2026
@rldyourmnd
rldyourmnd merged commit 9adc78a into main Sep 19, 2026
28 checks passed
@rldyourmnd
rldyourmnd deleted the fix/ci-feedback-vendored branch September 19, 2026 17:49
@rldyourmnd rldyourmnd mentioned this pull request Sep 20, 2026
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant