ci: resolve the action from the workspace root, and fetch for all three jobs #140

Merged

peterswimm merged 1 commit from ci/fix-action-path into main

2026-09-14 22:43:07 +00:00

peterswimm commented

2026-09-14 22:38:32 +00:00

Owner

ci-rituals-reader and secret/forge/rituals-read now exist, so #139's fetch was tried for the first time on main — and never ran:

failed to read action 'Fetch the Rituals read token from OpenBao', no files found after reading paths: action.yml, action.yaml, Dockerfile

uses: ./… resolves from the workspace root, and these workflows check this repo out into toilville-design/, so the action was not at that path. The step failed soft, the checkout got an empty token, and the credential was never exercised. Carrying the checkout directory in the path fixes it.

While here, the other two jobs get the same fetch. udg-copy-coverage.yml and test-generator.yml both ask for a CI_TOKEN secret that exists on neither repo — which is why both have failed on every run since at least 2026-09-11. They need the same blocks from the same private repository for the same reason, so they now read the same short-lived token.

udg-native-sync.yml still asks for CI_TOKEN on purpose: it pushes generated tokens into Rituals, so it needs a write credential, and ci-rituals-reader is deliberately read-only on one repository. Wiring that one up is separate work.

Scope

block-validation.yml — the action path.
udg-copy-coverage.yml, test-generator.yml — add the OpenBao fetch, replace CI_TOKEN with the fetched value.

Testing

yamllint across all workflows, test_workflow_invariants.py (57 passing), and a grep confirming no expression sits inside a run: comment — one of those took a whole workflow down in #137.
The credential itself is verified: ci-rituals-reader reads wordpress/rituals-wp/blocks (200) and the repo archive checkout uses (200), and 404s on every other private repo.
Run #671 is the evidence for the path bug; the three dispatched runs after this merges are the evidence for the fix.

Impact Statement

CI only — no change to any generated artifact, the theme, or the site. Should turn three jobs green, two of which have been red for a fortnight, and puts the block-validation gate into real service for the first time.

`ci-rituals-reader` and `secret/forge/rituals-read` now exist, so #139's fetch was tried for the first time on main — and never ran: > failed to read action 'Fetch the Rituals read token from OpenBao', no files found after reading paths: action.yml, action.yaml, Dockerfile `uses: ./…` resolves from the **workspace root**, and these workflows check this repo out into `toilville-design/`, so the action was not at that path. The step failed soft, the checkout got an empty token, and the credential was never exercised. Carrying the checkout directory in the path fixes it. While here, the other two jobs get the same fetch. `udg-copy-coverage.yml` and `test-generator.yml` both ask for a `CI_TOKEN` secret that exists on neither repo — which is why both have failed on **every** run since at least 2026-09-11. They need the same blocks from the same private repository for the same reason, so they now read the same short-lived token. `udg-native-sync.yml` still asks for `CI_TOKEN` on purpose: it *pushes* generated tokens into Rituals, so it needs a write credential, and `ci-rituals-reader` is deliberately read-only on one repository. Wiring that one up is separate work. ## Scope - `block-validation.yml` — the action path. - `udg-copy-coverage.yml`, `test-generator.yml` — add the OpenBao fetch, replace `CI_TOKEN` with the fetched value. ## Testing - `yamllint` across all workflows, `test_workflow_invariants.py` (57 passing), and a grep confirming no expression sits inside a `run:` comment — one of those took a whole workflow down in #137. - The credential itself is verified: `ci-rituals-reader` reads `wordpress/rituals-wp/blocks` (200) and the repo archive checkout uses (200), and 404s on every other private repo. - Run #671 is the evidence for the path bug; the three dispatched runs after this merges are the evidence for the fix. ## Impact Statement CI only — no change to any generated artifact, the theme, or the site. Should turn three jobs green, two of which have been red for a fortnight, and puts the block-validation gate into real service for the first time.

peterswimm added 1 commit

2026-09-14 22:38:32 +00:00

ci: resolve the action from the workspace root, and fetch for all three jobs

PR policy check / policy-gate (pull_request) Successful in 1s

Details

Block Validation / validate (pull_request) Failing after 26s

Details

Security Scans / Trivy filesystem scan (pull_request) Successful in 33s

Details

Security Scans / Gitleaks secret scan (pull_request) Successful in 27s

Details

Test Generator / test (pull_request) Failing after 21s

Details

Test Generator / lint-workflows (pull_request) Successful in 15s

Details

Test Generator / lint-prose (pull_request) Successful in 18s

Details

UDG dist drift gate / dist/ matches dtcg + udg sources (pull_request) Successful in 15s

Details

Copy coverage / Design copy reaching rendered HTML (pull_request) Failing after 27s

Details

45fcc276fb

#139's fetch step never ran: `uses: ./…` resolves from the workspace root,
and these workflows check this repo out into `toilville-design/`, so the
action was not there. The runner said "no files found after reading paths:
action.yml, action.yaml, Dockerfile", the checkout then got an empty token,
and the credential was never used. Carry the checkout directory in the path.

udg-copy-coverage.yml and test-generator.yml get the same fetch. Both ask
for a CI_TOKEN secret that exists on neither repo, which is why both have
failed on every run since at least 2026-09-11 — they need the same blocks,
for the same reason, and now read the same short-lived token.

udg-native-sync.yml still asks for CI_TOKEN: it pushes generated tokens
into Rituals, so it needs a write credential that ci-rituals-reader, being
read-only on one repository, deliberately is not.

peterswimm merged commit c993d9b65f into main

2026-09-14 22:43:07 +00:00

peterswimm deleted branch ci/fix-action-path

2026-09-14 22:43:07 +00:00

peterswimm referenced this pull request from a commit

2026-09-14 22:43:07 +00:00

Merge pull request 'ci: resolve the action from the workspace root, and fetch for all three jobs' (#140) from ci/fix-action-path into main