Merge pull request #9 from wave-av/harden/public-repo-guard-selfconta… #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # foundation-gate.yml — calls the INLINED checks at ./.github/workflows/_checks.yml. | |
| # | |
| # WHY INLINED: dispatch-edge is PUBLIC; wave-av/wave-foundation is PRIVATE. GitHub Actions does | |
| # NOT permit a public repo to consume a private repo's reusable workflow even with org-level | |
| # access set to "enterprise" — the call fails in 0s with 0 jobs (workflow_run never starts). | |
| # We tested this end-to-end; access settings change had no effect. `_checks.yml` mirrors | |
| # wave-foundation/.github/workflows/checks.yml@v1 (sha 8c9bfdc5f9). Keep them in sync on every | |
| # v1.x bump (no consume-not-copy here; this is the one repo where the consume path is | |
| # structurally impossible). | |
| # | |
| # Required check names ("gate / checks" + "gate / skill-validate") resolve from the outer job | |
| # "gate" + the inner job names "checks" + "skill-validate" in `_checks.yml` — same shape branch | |
| # protection has been requiring all along. | |
| name: foundation-gate | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, master, staging] | |
| permissions: | |
| contents: read | |
| jobs: | |
| gate: | |
| uses: ./.github/workflows/_checks.yml | |
| with: | |
| max_lines: 800 |