mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 21:32:10 +03:00
321488abee
* chore(ci): remove two fork-owned publish workflows that rode in by accident
Both files publish to a DIFFERENT owner's GHCR namespace, and both arrived as an
unrelated extra file inside an otherwise on-topic PR:
build-fork.yml added by #1528 (scope: SSE translator, Qiwen Chen)
env IMAGE_NAME: ghcr.io/kang-heewon/omniroute
if: github.repository == 'kang-heewon/OmniRoute'
100+ runs instantiated here
build-rinseaid-image.yml added by #8729 (scope: SSE reasoning)
tags: ghcr.io/rinseaid/omniroute:...
no repository guard at all — 0 runs
Neither can ever succeed: this repository's GITHUB_TOKEN cannot write to another
owner's namespace. The cost is not a breach, it is noise. build-fork.yml's guard
sits on the JOB, not the workflow, so GitHub instantiates a run on every push to
main and every v* tag and then skips the job — which is why every release check
board has carried a permanently skipped "Publish Fork Image to GHCR" entry.
build-rinseaid-image.yml never fires because its trigger branch
(`build-k3-reasoning-image`) does not exist in this repo.
Only build-fork.yml was pre-approved (2026-07-30). The second was found while
executing: grepping the workflow directory for registry namespaces turned up
ghcr.io/rinseaid alongside ghcr.io/kang-heewon. Same defect, same remedy, so both
go — easy to split if that is preferred.
Nothing else is touched. Specifically NOT touched: the 14 `kang-heewon` credit
links in CHANGELOG.md (real contributions), their 42 i18n mirrors, and the
historical `- **ci:** update build-fork workflow…` entry from #2055. Measured: 0
of the 14 credit mentions concern build-fork, so no credit line is involved
either way. `git status` shows exactly two deletions and one new test.
TDD — the guard names both offenders before the removal and passes after:
node --import tsx/esm --test tests/unit/workflows-no-foreign-fork-publishers.test.ts
# before: 0 pass, 2 fail → build-fork.yml → ghcr.io/kang-heewon
# build-rinseaid-image.yml → ghcr.io/rinseaid
# after: 2 pass, 0 fail
Zizmor findings drop 190 → 178 (both files use unpinned docker/* and checkout
actions). The baseline is deliberately NOT rebaselined here: the metric direction
is `down` so a drop cannot break the ratchet, tightening it to exactly 178 would
leave zero headroom and self-break on drift, and validate-release-green states
the convention outright — "Any drift above is rebaselined at release, not a
contributor concern."
* docs(changelog): fragment for #8967
---------
Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>