Repository navigation
Lock public CI with native disable plus invert guard - #17
Merged
Merged
Conversation
Run Validate on every pull request and master push. Keep Test and Build in YAML, but gate them to the private deploy fork. Keep Deploy Preview as a gated template and retarget Release to Validate so Tegami still publishes without Cloudflare secrets. Co-authored-by: Jonathan Beckman <jonathantbeckman@gmail.com>
Contributor
TegamiThis repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under Create a changelog → · Changelog format Release preview
This PR does not add changelog files. Pending changelogs from other branches are included in the preview above. Run Managed by Tegami. |
Replace peter-evans comment actions with GitHub-owned github-script so SolZeroAI/platform's action allowlist does not fail the workflow at startup. Secret-using jobs stay gated to jonbeckman/solzero. Co-authored-by: Jonathan Beckman <jonathantbeckman@gmail.com>
jonbeckman
marked this pull request as ready for review
August 24, 2026 16:42
Replace equality gates with github.repository != SolZeroAI/platform so any non-public fork can run secret-using jobs without editing YAML. Keep preview.yml valid and add pinned actionlint to public Validate. Co-authored-by: Jonathan Beckman <jonathantbeckman@gmail.com>
cursor
Bot
changed the title
Use peter-evans find-comment@v4 and create-or-update-comment@v5 for preview comments. Pin checkout, artifact, and reviewdog actionlint to moving version tags. Keep nubjs/setup-nub@v0.4.0. Drop commit SHAs. Co-authored-by: Jonathan Beckman <jonathantbeckman@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not merge until the Engineering Manager / SolZero says to merge. Do not deploy.
Public SolZeroAI/platform stays secret-less CI only. This pull request does not add secrets, does not deploy, and does not disable or enable the public Deploy Preview workflow.
Summary
GitHub native disable plus a repository invert guard.
preview.ymlas valid, lintable YAML. Do not comment it out. Do not delete jobs.github.repository != 'SolZeroAI/platform'. The public repo never runs them. Any other repository, including forks, can run them without editing the file.peter-evans/find-comment@v4andpeter-evans/create-or-update-comment@v5(version tags only, no commit SHAs). Marker<!-- infra-preview -->, authorgithub-actions[bot],edit-mode: replace. Cleanup updates only when find-comment finds a comment.uses:is a version tag.actions/checkout@v7,actions/upload-artifact@v7,actions/download-artifact@v8,nubjs/setup-nub@v0.4.0(latest v0.x; no newer v0.x tag exists),reviewdog/action-actionlint@v1. No commit SHAs and no# shacomments.config:check, typecheck, lint, format, andreviewdog/action-actionlint@v1.gh workflow disable preview.yml). Disabled state is per-repo. Fork owners enable it on their Actions page. GitHub disables scheduled workflows on public forks by default. The invert guard is the belt if the public workflow is enabled.release.ymlwaits for Validate success on a same-repomasterpush and still usesGITHUB_TOKENonly.jonbeckman/solzero.config/pre.config.jsoncandconfig/prod.config.jsoncstay example-shaped. No live hostnames or secrets were added.Validation
Head
4e213fc. Public Validate did not start on SolZeroAI/platform:This pull request does not work around that with a tarball or
docker://rhysd/actionlint. Public Validate stays green only after the org allowsreviewdog/action-actionlint@v1.Invert guards are unchanged: Test/Build skip on SolZeroAI/platform. Preview jobs stay gated by
github.repository != 'SolZeroAI/platform'.Checklist
.tegami/release entry, or explained why this pull request usesrelease:none.reviewdog/action-actionlint@v1.THIRD_PARTY_NOTICES.mdfor new third-party code or separately licensed assets. Not applicable.Tests are not added because this is GitHub Actions and process documentation only.
release:none: this is CI and operator-process documentation. It does not change product behavior, and it must not bump the SolZero version.No deploy: do not run Deploy Preview,
nub run infra:deploy:*, or any production publish from this pull request. Do not enable or disable the public workflow from this change.