The instance moved 1.25.4 -> 1.27.1 during #743, which left a set of deliberately
version-pinned CI claims dated rather than wrong. The population was re-derived from
`git ls-files` instead of from the issue's own 9-key list, which found ~21 claim sites
across workflows, scripts, tests, docs and records.
Re-confirmed unchanged on 1.27.1:
* an `if:`-skipped job still reports commit-status `skipped`, a distinct state
* `compare/{base}...{head}` still serves no `files`
* no agent-side cancel route (POST 404, and live swagger has no cancel path at all)
* `review-verdict.yml`'s `branches: [main]` still suppresses the run off a non-main base
Re-derived from a constructed corpus rather than a sample, because two arbitrary PRs
showed only two of the values: the PR file-status vocabulary is changed/added/renamed/
deleted over 200 PRs. All four were already in the closed allow-list, so that set is now
evidenced rather than partly presumed.
Newly measured, replacing source-attestation. All three arms ran on throwaway
scratch-base protection rules, so `main`'s rule was never touched (its updated_at is
unchanged at 2026-08-05):
* `block_admin_merge_override: false` lets an admin force_merge past an ABSENT
required context (HTTP 200); flipping only that field to `true` refuses the
identical call (HTTP 405) - the negative control that makes it attributable
* an absent required context BLOCKS, so the merge gate does not fail open when
review-verdict.yml never runs
* `enable_bypass_allowlist` is NOT a better-targeted substitute: enabled with an
empty username list, the admin force_merge still succeeded
* trap: the PR API reports `mergeable: true` while that same merge is refused,
because the field reflects conflict-freedom and ignores branch protection
Left explicitly dated rather than silently refreshed, each with its reason:
push-supersession auto-cancel is no longer observable on this repo (no workflow
triggers on a non-main push, and main refuses direct pushes), and the scope-enum /
reqRepoWriter / write:package-403 items need a scoped PAT rather than a read-only probe.
review-verdict.yml carries three more 1.25.4-dated comments and is deliberately
untouched here: #763 is in-progress on that file and its paging work overlaps them.
Refs: #747
Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The test/migrations jobs check out fetch-depth:1. A shallow clone has NO
origin/<base> tracking ref and no merge-base, so the three-dot
origin/main...HEAD errored -> empty diff -> docs_only=false -> EVERY docs-only PR
silently ran the full matrix (safe but the skip never fired). git fetch always
writes FETCH_HEAD, which resolves in a shallow clone; diff against it with a
two-dot tree diff (no merge-base). Confirmed in a real shallow file:// clone:
origin/main did NOT resolve and three-dot errored, while FETCH_HEAD two-dot
correctly returned the docs file. api-docs/format were unaffected only because
they use fetch-depth:0.
Refs #416
The changed-set git diff had rename detection on by default, so a code->docs
rename (Foo.cs -> docs/Foo.md) showed only the destination and was misclassified
as docs-only, skipping required tests on a code change. --no-renames surfaces the
source deletion -> full matrix. Empirically verified. This is the cold-review
MEDIUM; it was applied in the working tree but never committed before the first
push (index/worktree mismatch) — committing it now.
Refs #416
Docs-only changes (docs/** or *.md) ran the full docker-build matrix (~9 min).
Each heavy job (test, migrations, functional-e2e, build) now runs
scripts/ci-detect-docs-only.sh as its first post-checkout step and gates every
real step on docs_only!='true'. The jobs still RUN and report success in
seconds, so the two required contexts keep reporting — a docs-only PR stays
mergeable (never an if:-skipped required job; Gitea 1.25.4 reports if-skip as
'skipped', verified with a throwaway probe PR). build skips its image steps on a
docs-only push to main; tag builds force docs_only=false. Detection uses
--no-renames so a code->docs rename can never be misclassified as docs-only.
Refs #416
timothyandClaude Opus 5