ci: re-render managed files with @j4k/align #6

Merged

jercik merged 2 commits from ci/realign-managed-files into main 2026-07-12 10:31:10 +00:00

Conversation 0 Commits 2 Files changed 3 +221 -53

jercik commented 2026-07-12 10:09:24 +00:00

Owner

Copy link

What

Re-renders this repo's aligner-managed files with the released @j4k/align@1.82.2. This repo lives in the j4k-oss org (not j4k) and was missed by regular fleet alignment, so its managed files were pre-migration.

Working-tree changes in this PR (all rendered by the aligner, none hand-edited):

• .forgejo/workflows/pr-review.yml — the big one. The old version fetched the review tool with npm exec --package=axrecipe@7 against npm.j4k.dev authenticated by secrets.NPM_TOKEN. Since the org NPM_TOKEN was deleted at the end of the registry migration, every PR-review draw against this repo has been failing. The re-rendered workflow drops NPM_TOKEN entirely and uses the current OIDC form: it mints a per-run ACTIONS_ID_TOKEN at vars.NPM_READ_AUDIENCE and scoped-pre-fetches the tools into a temp prefix — npm install --prefix "$review_tools" --ignore-scripts @j4k/axrecipe@8 @j4k/axrun@2 @j4k/axinstall@3 — then runs the pinned bin directly. No NPM_TOKEN reference remains.
• .forgejo/workflows/commit-msg.yml — drops the GitHub-style permissions: block that Forgejo ignores (and warns about).
• .gitignore — adds .claude/worktrees/ so a nested agent-worktree oxlint.config.ts can't crash oxlint's directory walk.

Forge-side changes already applied by --fix

• Branch protection on main now sets enable_status_check=true with the derived required context commit-msg / commitlint (pull_request) (previously enable_status_check=false with no contexts). Contexts are derived per repo from the workflows its traits render; this repo requires only the commitlint context.

Why the PR Review draws still run red on THIS PR (expected, non-gating)

pr-review.yml triggers on pull_request_target, which Forgejo always evaluates from the base branch, not the PR head. The base branch (main) still carries the old pre-migration pr-review.yml that references the deleted NPM_TOKEN, so the draws scheduled against this PR run the OLD workflow and fail. The re-rendered workflow only takes effect for PRs opened after this one merges. PR Review is advisory and is deliberately excluded from the required status contexts, so these red draws do not gate this PR. The only required context here is commit-msg / commitlint (pull_request), which runs from the PR head and is unaffected.

Owner follow-ups (cannot be done from this PR)

• NPM_READ_AUDIENCE Actions variable is missing on this repo. The re-rendered pr-review.yml needs it, and its value is a server-generated audience the aligner cannot supply. Set it before merging (or PR-review draws will still fail after merge):
  fgj actions variable create NPM_READ_AUDIENCE '<value>' -R j4k-oss/agent-skills --hostname code.j4k.dev
• Leftover NPM_TOKEN org secret in j4k-oss. The j4k-oss org still carries a stale NPM_TOKEN org secret from before the registry migration. It is no longer referenced by any managed workflow after this PR. Left untouched here on purpose — deleting an org-level secret is the owner's call.

## What Re-renders this repo's aligner-managed files with the released `@j4k/align@1.82.2`. This repo lives in the `j4k-oss` org (not `j4k`) and was missed by regular fleet alignment, so its managed files were pre-migration. Working-tree changes in this PR (all rendered by the aligner, none hand-edited): - `.forgejo/workflows/pr-review.yml` — the big one. The old version fetched the review tool with `npm exec --package=axrecipe@7` against `npm.j4k.dev` authenticated by `secrets.NPM_TOKEN`. Since the org `NPM_TOKEN` was deleted at the end of the registry migration, every PR-review draw against this repo has been failing. The re-rendered workflow drops `NPM_TOKEN` entirely and uses the current OIDC form: it mints a per-run `ACTIONS_ID_TOKEN` at `vars.NPM_READ_AUDIENCE` and scoped-pre-fetches the tools into a temp prefix — `npm install --prefix "$review_tools" --ignore-scripts @j4k/axrecipe@8 @j4k/axrun@2 @j4k/axinstall@3` — then runs the pinned bin directly. No `NPM_TOKEN` reference remains. - `.forgejo/workflows/commit-msg.yml` — drops the GitHub-style `permissions:` block that Forgejo ignores (and warns about). - `.gitignore` — adds `.claude/worktrees/` so a nested agent-worktree `oxlint.config.ts` can't crash oxlint's directory walk. ## Forge-side changes already applied by `--fix` - Branch protection on `main` now sets `enable_status_check=true` with the derived required context `commit-msg / commitlint (pull_request)` (previously `enable_status_check=false` with no contexts). Contexts are derived per repo from the workflows its traits render; this repo requires only the commitlint context. ## Why the PR Review draws still run red on THIS PR (expected, non-gating) `pr-review.yml` triggers on `pull_request_target`, which Forgejo always evaluates from the **base** branch, not the PR head. The base branch (`main`) still carries the old pre-migration `pr-review.yml` that references the deleted `NPM_TOKEN`, so the draws scheduled against this PR run the OLD workflow and fail. The re-rendered workflow only takes effect for PRs opened **after** this one merges. PR Review is advisory and is deliberately excluded from the required status contexts, so these red draws do not gate this PR. The only required context here is `commit-msg / commitlint (pull_request)`, which runs from the PR head and is unaffected. ## Owner follow-ups (cannot be done from this PR) - **`NPM_READ_AUDIENCE` Actions variable is missing** on this repo. The re-rendered `pr-review.yml` needs it, and its value is a server-generated audience the aligner cannot supply. Set it before merging (or PR-review draws will still fail after merge): `fgj actions variable create NPM_READ_AUDIENCE '<value>' -R j4k-oss/agent-skills --hostname code.j4k.dev` - **Leftover `NPM_TOKEN` org secret in `j4k-oss`.** The `j4k-oss` org still carries a stale `NPM_TOKEN` org secret from before the registry migration. It is no longer referenced by any managed workflow after this PR. Left untouched here on purpose — deleting an org-level secret is the owner's call.

jercik added 1 commit 2026-07-12 10:09:24 +00:00

ci: re-render managed files with @j4k/align@1.82.2 f01843f888

jercik added 1 commit 2026-07-12 10:30:20 +00:00

Merge branch 'main' into ci/realign-managed-files cda0e59a4c

jercik merged commit c145df57c3 into main 2026-07-12 10:31:10 +00:00

jercik referenced this pull request from a commit 2026-07-12 10:31:11 +00:00

ci: re-render managed files with @j4k/align (#6)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

j4k-oss/agent-skills!6

No description provided.