From f791467633e04d0d67e4cac54ce9724f66862499 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:09:20 -0400 Subject: [PATCH 1/3] repo: run the term wall in CI Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230919Z-apply-push-06b283 Patch-SHA256: 7eb098b1f00ca663978af20a1f5ec92c9645ba363405dab7326f696e5b14441b --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2912a72..ec2783f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,10 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false + - name: term wall + uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + env: + TERM_WALL: ${{ vars.TERM_WALL }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' From 25af98afd22b7c1fb371fa0f06d0ce3711f9e99f Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:46:39 -0400 Subject: [PATCH 2/3] repo: scan a pull request again when its text is edited `pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234639Z-apply-push-6bd968 Patch-SHA256: d98bba1f87201c326cc5eec4934e6561789644fd2bc90df54651dffe51ff055e --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec2783f..54a4675 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,7 @@ name: ci on: pull_request: + types: [opened, synchronize, reopened, edited] push: branches: [dev, master] permissions: From 6dfa3eb160b39590bb66b10364eff186b1aeed6b Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 20:40:35 -0400 Subject: [PATCH 3/3] repo: move the wall to the object-store scan, pin the e2e workflow minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. The e2e job called the reusable workflow in workbench at the mutable `dev`; pin it to the current dev commit. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004034Z-apply-push-c1e45f Patch-SHA256: 34fe6902c5e921f8d37c9bba39cbd394b7cc91b70275cc46eab878199b8942c7 --- .github/workflows/ci.yml | 2 +- .github/workflows/e2e.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 54a4675..11658e4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: with: persist-credentials: false - name: term wall - uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10 env: TERM_WALL: ${{ vars.TERM_WALL }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 7c967fe..47a14d2 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -10,7 +10,7 @@ permissions: contents: read jobs: e2e: - uses: minspec/workbench/.github/workflows/e2e.yml@dev + uses: minspec/workbench/.github/workflows/e2e.yml@a84bc5568a33220fd7b4037345c2b38186cff29d # dev with: skeleton_ref: ${{ github.event.pull_request.head.sha || github.sha }} workbench_ref: dev