From d46493ee07d62ba32bc75cfb7507b28b6714d91a Mon Sep 17 00:00:00 2001 From: sotashimozono Date: Thu, 30 Jul 2026 08:29:34 +0000 Subject: [PATCH 1/2] ci: track the hub's main instead of the @v1 tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `v1` is a moving tag, not a rotting pin — but it is a second pointer pushed by hand, and it is one commit behind `main` today, which is the failure it invites: a fix merges and reaches nobody. The hub's own `uses:` examples already say `@main`, and all 166 references to the lab-sotashimozono hub are `@main`; this brings both owners onto one convention. Blast radius is exactly QAtlasHub/.github#20 (julia-ci.yml, +84/-0, purely additive, gated on shards>1 and push:main) — nothing else differs between v1 and main. Files: labeler.yml, tagbot.yml Refs lab-sotashimozono/.github#15 --- .github/workflows/labeler.yml | 2 +- .github/workflows/tagbot.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index a5fab80..f4e1d39 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -8,7 +8,7 @@ # permissions: { contents: read, pull-requests: write, issues: write } # jobs: # label: -# uses: QAtlasHub/.github/.github/workflows/labeler.yml@v1 +# uses: QAtlasHub/.github/.github/workflows/labeler.yml@main # with: { runner: '["self-hosted","rosina"]' } # # THE LABELS ARE SET THROUGH THE API, NEVER THROUGH `gh pr edit`. That command reads the diff --git a/.github/workflows/tagbot.yml b/.github/workflows/tagbot.yml index 154cf76..bed4fd6 100644 --- a/.github/workflows/tagbot.yml +++ b/.github/workflows/tagbot.yml @@ -5,7 +5,7 @@ # schedule: [{ cron: "17 4 * * *" }] # daily self-backfill — no JuliaTagBot app needed # issue_comment: { types: [created] } # JuliaTagBot app trigger, if ever installed # workflow_dispatch: # manual catch-up -# jobs: { tagbot: { uses: QAtlasHub/.github/.github/workflows/tagbot.yml@v1, secrets: inherit } } +# jobs: { tagbot: { uses: QAtlasHub/.github/.github/workflows/tagbot.yml@main, secrets: inherit } } name: TagBot (reusable) on: workflow_call: From 9a761ae08f6e5fc8e80ce5576090ca29f75292ff Mon Sep 17 00:00:00 2001 From: sotashimozono Date: Thu, 30 Jul 2026 11:27:24 +0000 Subject: [PATCH 2/2] fix(tagbot): declare BOT_PAT, which was used but never declared MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `token: ${{ secrets.BOT_PAT }}` with no `BOT_PAT` under `workflow_call.secrets`. An undeclared secret in a called workflow is EMPTY unless the caller passes `secrets: inherit`; the documented caller does, which is both why it worked and why nothing reported it. actionlint has been failing on this repo's `push:main` runs since at least 2026-07-26 for exactly this — and every pull request passed, because reviewdog reports only inside the diff, so a defect in a file the PR does not touch cannot surface. Touching tagbot.yml here is what brought it into scope. Same class of defect as lab-sotashimozono/.github#17 (documentation.yml's undeclared DOCUMENTER_KEY), found the same way: comparing what a reusable references against what it declares. Refs lab-sotashimozono/.github#15 --- .github/workflows/tagbot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/tagbot.yml b/.github/workflows/tagbot.yml index bed4fd6..cd4f2c5 100644 --- a/.github/workflows/tagbot.yml +++ b/.github/workflows/tagbot.yml @@ -10,6 +10,14 @@ name: TagBot (reusable) on: workflow_call: secrets: + # BOT_PAT was USED (`token:` below) and never declared. An undeclared secret in a called + # workflow is EMPTY unless the caller says `secrets: inherit` — the example above does, which is + # the only reason this ever worked and the reason nothing reported it. actionlint has been + # flagging it on every `push:main` run since at least 2026-07-26; pull requests passed because + # reviewdog only reports inside the diff, so a defect in an untouched file is invisible by + # construction on a PR. Same class as lab-sotashimozono/.github#17. + BOT_PAT: + required: false DOCUMENTER_KEY: required: false permissions: