diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 4d50e640..9eb3dba4 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -1,7 +1,6 @@ # Nightly (~10 min) and weekly (~1h) libFuzzer. Not a required PR check. # Product rustc stays 1.95; this job uses nightly only to drive cargo-fuzz. # -# Operator must push this workflow file (GitHub App cannot). # Single cron: Sunday uses fuzz-run.sh default 3600s; other days 600s. # workflow_dispatch.inputs.duration overrides when set. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 80b46a48..f7d76649 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,9 +8,6 @@ # Triggers: # - push of tag v*.*.* (publishes the Release) # - workflow_dispatch (build artifacts only; no tag → no Release) -# -# Operator push of this workflow file may be required (GitHub App cannot -# always create `.github/workflows/*`). name: release diff --git a/AGENTS.md b/AGENTS.md index ea62b82a..fced5ca5 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -134,15 +134,16 @@ Label **`core-functional`** when the PR touches the Core functional harness GitHub App SSH key. The App token from `~/.config/rbitcoin-grok/gh-login.sh` (~1h) is HTTPS-only. -`gh pr create` / `gh pr checks` talk to the API. `git fetch origin` works -here. Bot **push** must use an **explicit HTTPS URL**. Do **not** -`git remote set-url origin`. Do **not** `git push origin` as the bot. +`gh pr create` / `gh pr checks` / `gh issue comment` / `gh run rerun` talk +to the API. `git fetch origin` works here. Bot **push** must use an +**explicit HTTPS URL**. Do **not** `git remote set-url origin`. Do **not** +`git push origin` as the bot. -The App token **cannot** create or update `.github/workflows/*` (GitHub -`workflows` permission). If the commit set touches workflow YAML, **stop -and ask the operator to push** that branch. Do not strip the workflow -diff to sneak a push. Non-workflow commits on an already-pushed branch -are fine. +Installation write: `contents`, `pull_requests`, `issues`, `workflows`, +`actions`. Push `.github/workflows/*` with the rest of the topic branch. +Do not strip a workflow diff to sneak a push. `gh run rerun` is in-band. +Read: `checks`, `security_events`, `secret_scanning_alerts`, and the other +listed reads. CodeQL **dismiss** stays operator (`security_events` is read). ```bash ~/.config/rbitcoin-grok/gh-login.sh @@ -161,25 +162,24 @@ No `-u` on push (that would retarget the branch remote away from `origin`). | **Done** | Required checks green **and** the PR is up for review. Do not merge unless asked. | | **No post-green PR-cite** | After required checks are green, do **not** push a docs-only follow-up whose only change is inserting this PR's number into CHANGELOG / quality.md / similar. That wastes a full CI run. Cite in the **PR body**. Owner docs can omit the GitHub number, or pick it up later in a docs change that was already needed. | | **Do not** | Force-push `master`, merge a red PR, collapse `origin` to a single URL, skip polling because “tests passed locally,” or invent **empty commits** to poke Actions. | -| **Workflow YAML** | App cannot push `.github/workflows/*`. Ask the operator to `git push`. | -| **CodeQL in tests** | Alert that only fires in `#[cfg(test)]` / test modules: **stop**. Do **not** rename tests or shuffle literals to silence it. Ask the operator to **dismiss** the alert (App token cannot). Production / library CodeQL is a real finding — fix it. | +| **Workflow YAML** | Push with the topic branch (`workflows:write`). | +| **CodeQL in tests** | Alert that only fires in `#[cfg(test)]` / test modules: **stop**. Do **not** rename tests or shuffle literals to silence it. Ask the operator to **dismiss** (`security_events` is read). Production / library CodeQL is a real finding — fix it. | #### Retrigger CI (no empty commits) When required checks are green locally and CI only needs a re-run (flake, -stale run, App cannot `gh run rerun`): +stale run): | OK | Not OK | |----|--------| -| GitHub Actions UI **Re-run failed jobs** / **Re-run all jobs** | Empty commit whose only purpose is to wake Actions | -| `gh run rerun [--failed]` when the token allows it | Noise commits (“ci: bump”, “trigger”) with no product/test change; docs-only follow-up whose only change is this PR's `#N` after checks are already green | +| `gh run rerun [--failed]` | Empty commit whose only purpose is to wake Actions | +| GitHub Actions UI **Re-run failed jobs** / **Re-run all jobs** | Noise commits (“ci: bump”, “trigger”) with no product/test change; docs-only follow-up whose only change is this PR's `#N` after checks are already green | | Amend the tip commit (or rebase) and **force-push the topic branch** with `--force-with-lease` over HTTPS | Force-push `master` / `main` | ```bash -# Prefer API when the App/token can write Actions: gh run rerun --failed -# Else: amend tip (no empty commit) and lease-force the topic branch only: +# If the API rejects: amend tip (no empty commit) and lease-force the topic branch only: git commit --amend --no-edit # or fold a real fix into the tip git push --force-with-lease https://github.com/reardencode/rbitcoin.git HEAD:/ ``` diff --git a/docs/releases.md b/docs/releases.md index 846d6b35..6ff2c584 100644 --- a/docs/releases.md +++ b/docs/releases.md @@ -170,6 +170,4 @@ SECURITY support window and schema-freeze language. ## Operator follow-ups (not agent-mergeable) - Required check **`release-extra`** on protected branches. -- Workflow YAML on this branch may need an operator `git push` (GitHub App - cannot write `.github/workflows/*`). - Retry artifacts only: Actions → **release** → Run workflow (no tag). diff --git a/docs/reproducible-builds.md b/docs/reproducible-builds.md index 55c2a460..b6956db6 100644 --- a/docs/reproducible-builds.md +++ b/docs/reproducible-builds.md @@ -114,8 +114,6 @@ same three snapshots on that tag and attaches them to a GitHub Release: | `rbitcoin-*-aarch64-darwin` + `SHA256SUMS.darwin` | Ad-hoc codesign; not notarized | `workflow_dispatch` on that workflow builds artifacts only (no Release). -Creating or changing `.github/workflows/release.yml` may need an operator -push (GitHub App tokens often cannot write workflow files). **Byte-identity gate** (`./scripts/repro-check.sh`) still forces two clean `--rebuild`s — use it for release verification, not every commit.