devops-engineerandClaude Fable 5
62114dca90
The Detect force-merge step set GITEA_HOST via
`${{ github.server_url | replace('https://','') }}`. Gitea's expression lexer
mis-parses the single `|` as the start of `||`, so the job fails at
expression-interpolation time (every run, status=2) before the audit
script runs. Pass github.server_url whole and strip the scheme in the
shell step instead.
Named mechanism: Gitea expression lexer `| replace` -> `||` parse error.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
name: audit-force-merge
|
|
# Detect a §SOP-6 force-merge after PR close and emit structured audit JSON.
|
|
# Runs on base branch (pull_request_target) so secrets are available.
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [closed]
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
if: github.event.pull_request.merged == true
|
|
steps:
|
|
- name: Checkout base (for scripts)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.base_ref }}
|
|
|
|
- name: Detect force-merge
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ github.server_url }}
|
|
REPO: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
# Required-status-check contexts to evaluate at merge time.
|
|
# Branch-aware JSON dict: keys are protected branch names,
|
|
# values are arrays of context names that branch protection
|
|
# requires for that branch. Mirror this against branch
|
|
# protection settings for each branch listed here.
|
|
REQUIRED_CHECKS_JSON: |
|
|
{
|
|
"main": [
|
|
"CI / test (pull_request)"
|
|
]
|
|
}
|
|
run: |
|
|
# Gitea expression lexer mis-parses `| replace` as `||` (job fails before
|
|
# the script runs). Pass github.server_url whole and strip the scheme in shell.
|
|
GITEA_HOST="${GITEA_SERVER_URL#http://}"
|
|
GITEA_HOST="${GITEA_HOST#https://}"
|
|
export GITEA_HOST
|
|
bash .gitea/scripts/audit-force-merge.sh
|