Add sync-lockdown release job and fix reserved FORGEJO_PAT secret name #143
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Change
Add the canonical-bump automation so committed
.claudelockdown files stay in sync with the released coily, and fix the secret-name bug found along the way.sync-lockdownjob in.forgejo/workflows/release.yml: builds the just-tagged coily, renders the canonical.claudefiles once, and fans them out across non-archived catalog repos via the Forgejo Contents API. Idempotent,[skip ci], tolerant of repos missing/archived on Forgejo.scripts/sync-lockdown.shdoing the GET-compare-then-PUT fan-out (shellcheck clean).secrets.FORGEJO_PATis an invalid secret name (Forgejo reserves theFORGEJO_prefix, PUT returns 400), so it always resolved to empty. The existingbump-formulastep has been running without a real token. Renamed all three refs tosecrets.CI_RELEASE_TOKEN, set on this repo to awrite:repository-scoped token.Design and rationale: agentic-os-kai#457 (keep committed, fail-closed). Harness/self-mod context: agentic-os#92. Open tradeoff on GitHub mirror freshness: #142.