From a080feeb4c65401feda22ce7cf11f7fa55aaa507 Mon Sep 17 00:00:00 2001 From: "blocksorg[bot]" <173988465+blocksorg[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 18:59:34 +0000 Subject: [PATCH] CI: fail loudly when DEPLOY_KEY is missing instead of silently skipping (#127) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * CI: fire mirror on pull_request:closed, not just workflow_run workflow_run on Automerge fires when auto-merge is *enabled* (gh pr merge --auto on PR open), not when the PR is actually *merged*. So the mirror was pushing the pre-merge main to Tangled — the new commit never triggered a BuildBuddy build. pull_request:closed fires when GitHub's auto-merge lands the PR. That event comes from GitHub's PR system, not the GITHUB_TOKEN push, so it bypasses the GITHUB_TOKEN→no-further-workflows restriction. The if condition filters to merged==true so draft-closed PRs are ignored. The workflow_run:Automerge trigger is kept as a fallback. cancel-in- progress means the pull_request:closed run (which fires after the real merge) will cancel any racing workflow_run run that checked out old main. * CI: fail loudly when DEPLOY_KEY is missing, not silently exit 0 Silent exit 0 masked the fact that DEPLOY_KEY was never set in GitHub repo secrets (Settings → Secrets and variables → Actions). Every mirror run has been a no-op — nothing was ever pushed to Tangled, so Tangled's webhook never fired and BuildBuddy never ran. Fail with exit 1 so the run goes red and the missing secret is obvious. --------- Co-authored-by: Blocks Task Runner --- .github/workflows/mirror-to-tangled.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mirror-to-tangled.yml b/.github/workflows/mirror-to-tangled.yml index 25bbcff..22af205 100644 --- a/.github/workflows/mirror-to-tangled.yml +++ b/.github/workflows/mirror-to-tangled.yml @@ -53,8 +53,8 @@ jobs: run: | set -euo pipefail if [[ -z "${DEPLOY_KEY:-}" ]]; then - echo "DEPLOY_KEY secret not set — skipping mirror" >&2 - exit 0 + echo "DEPLOY_KEY secret not set — add it under Settings → Secrets and variables → Actions" >&2 + exit 1 fi mkdir -p "$HOME/.ssh" chmod 700 "$HOME/.ssh" -- 2.51.2