Repository navigation
Tracker: docs/reusable-workflows.md #1360
Description
Tracker for docs/reusable-workflows.md. Filed under #1315's roll-up of the open prose backlog: every finding a bundle issue enumerated against this unit is listed here once, one line each, naming the issue it came from, and the bundle is closed as a duplicate of this tracker so the finding is not lost and the bundle stops being a unit of work. A new pre-existing finding on this unit gathers here per pr-review-conduct's Merge Gate, numbering continuing this list. This tracker closes when the unit is rewritten and each line below is settled or superseded.
- The same doc contradicts itself: line 71 says secrets: inherit is not used while its own stub at line 324 carries secrets: inherit. (WORKFLOW.md D1.6 says secrets: inherit while reusable-workflows.md says it is never used, and the carried file is the wrong one #1173)
- The release-with-smoke stub's check-workflow-status job carries no comment that its job name: and the ruleset context: are ruleset-bound and must be renamed together. [docs/reusable-workflows.md > Adopting the Gates] (The Documented Aggregator Stub Omits the Ruleset-Bound-Name Warning #1226)
- The smoke-build job's comment wraps one sentence across two # lines and its second line opens lowercase, against the one-sentence-per-line and capital-opening rules. [docs/reusable-workflows.md > Adopting the Gates] (A Pre-Existing Comment in the Documented Aggregator Stub Wraps Mid-Sentence #1232)
Activity
ptr727 commentedon Sep 11, 2026
Found by whole-unit review of the
workflow-ci-contractSkill's section 4 include while settling #1522, outside that change's scope."Permissions" contradicts the release task it describes. "A task whose job genuinely writes with
GITHUB_TOKEN, such as a release upload, declares that scope in the callee job and documents it in the stub's comment so the caller grants it." The release upload is the one example the hub ships, andbuild-release-task.yml'sgithub-releasejob declares nopermissions:block on purpose: its own comment says a called job's block is validated against the caller's grant before itsif:runs, so namingcontents: writethere would fail every caller that does not grant it, a smoke build included. The paragraph's own previous sentences argue the same, andWORKFLOW.mdD7.2 puts the grant at the caller. A reader following this sentence adds the block the task deliberately leaves out, and every read-only caller then fails at startup.Name the Build Jobs That Do Not Opt Out of the Smoke Skip in D2.2 (#1533
Name the Build Jobs That Do Not Opt Out of the Smoke Skip in D2.2 (#1534
ptr727 commentedon Oct 23, 2026
Closed under the maintainer's decision (ptr727, 2026-10-23) on #3391: the backlog keeps real bugs with a stated failure, features the maintainer wants, and open decisions. A finding the review loop filed on code or text a change did not touch, a refactor or consolidation chore, a tracker, a wording item, or a guard shape no session has produced is closed rather than worked. Reopen with the input and the wrong result if this issue states one.