* CI: fire mirror on pull_request:closed, not just workflow_run workflow_run on Automerge fires when auto-merge is *enabled* (gh pr merge --auto on PR open), not when the PR is actually *merged*. So the mirror was pushing the pre-merge main to Tangled — the new commit never triggered a BuildBuddy build. pull_request:closed fires when GitHub's auto-merge lands the PR. That event comes from GitHub's PR system, not the GITHUB_TOKEN push, so it bypasses the GITHUB_TOKEN→no-further-workflows restriction. The if condition filters to merged==true so draft-closed PRs are ignored. The workflow_run:Automerge trigger is kept as a fallback. cancel-in- progress means the pull_request:closed run (which fires after the real merge) will cancel any racing workflow_run run that checked out old main. * CI: fail loudly when DEPLOY_KEY is missing, not silently exit 0 Silent exit 0 masked the fact that DEPLOY_KEY was never set in GitHub repo secrets (Settings → Secrets and variables → Actions). Every mirror run has been a no-op — nothing was ever pushed to Tangled, so Tangled's webhook never fired and BuildBuddy never ran. Fail with exit 1 so the run goes red and the missing secret is obvious. --------- Co-authored-by: Blocks Task Runner <task@blocks.team>