timothyandtimothy 45b17e58e1 fix(744,835): ci-image.yml publishes from main only; guard persist-credentials with no exemption (#857) ...

Closes the push route into ci-image.yml (#744) and ships the persist-credentials guard that was waiting on it (#835).

ci-image.yml's push trigger had no branches: filter and was path-scoped to docker/ci/** AND to the workflow file itself. Gitea resolves a push workflow's definition from the pushed ref, so any branch push touching those paths ran that branch's own YAML on a docker-capable runner holding the credential that writes ersatztv:prod and the ersatztv-ci:<sha> five container: jobs execute.

Be precise about what the filter buys: it is loaded from the pushed ref like the rest of the file, so a branch that deletes it re-enables the route. This closes the DRIVE-BY case - publication as a side effect of an ordinary push - and is not a boundary against a writer who intends to run their own YAML. The wider class is #853.

The self-reference left both paths: and ci-image-pin's expected in the same change - a decided tradeoff with both prices stated, not a necessity. Branch publishing moves to workflow_dispatch, probed live: run 2340 on this branch published ersatztv-ci:43b1e45 and left :latest unchanged.

With both mechanical blockers gone, ci-image.yml's checkout takes persist-credentials: false (16 of 16) and scripts/tests/test_workflow_persist_credentials.py holds the convention with NO exemption list - git-index population, declared clause mutation re-run every suite, guard-inventory rows.

fixes #744
fixes #835

Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>

2026-08-27 20:44:44 +00:00

..

fixtures

feat(610): split the decision corpus into one YAML-frontmatter file per record

2026-07-25 19:45:09 +02:00

__init__.py

feat(521): decision-record parser (decisions_lib)

2026-07-21 02:58:58 +02:00

conftest.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

mutation_harness_lib.py

feat(790): execute every MUTATION grade instead of asserting it (#815)

2026-08-22 13:12:15 +00:00

mutation_manifest.py

fix(744,835): ci-image.yml publishes from main only; guard persist-credentials with no exemption (#857)

2026-08-27 20:44:44 +00:00

test_bom_guard_detection.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_build_catalog_check_path.py

test(785): mutation proofs for the three unproven ranked guards (#810)

2026-08-21 20:10:01 +00:00

test_build_catalog.py

fix(603): close four defects found in adversarial review of the stale-after fields

2026-07-25 15:22:50 +02:00

test_check_doc_narrative.py

fix(780): reconcile the ruff gate with #784, merged in parallel (#814)

2026-08-22 09:34:03 +00:00

test_check_review_verdict.py

fix(788): one declarative H10 verdict vocabulary, derived by both sides (#846)

2026-08-26 20:58:09 +00:00

test_ci_dropped_step_guard.py

fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818)

2026-08-22 16:07:58 +00:00

test_ci_image_pin_population.py

fix(772,792): name the missing toolchain image, and stop a refusal leaving a verdict comment

2026-08-22 22:52:56 +02:00

test_ci_release_path_scan_job.py

fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818)

2026-08-22 16:07:58 +00:00

test_ci_toolchain_image_resolves.py

docs(772): correct the twins of two claims this branch already fixed

2026-08-23 00:23:44 +02:00

test_decisions_lib.py

fix(688): make the n oracle dynamic; correct a tense that asserted false history

2026-08-04 22:35:00 +02:00

test_decisions_validate.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_guard_inventory.py

fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818)

2026-08-22 16:07:58 +00:00

test_guard_populations_derive_from_git.py

fix(744,835): ci-image.yml publishes from main only; guard persist-credentials with no exemption (#857)

2026-08-27 20:44:44 +00:00

test_hook_fire_log.py

fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818)

2026-08-22 16:07:58 +00:00

test_jq_preflight.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_merge_consent_base_change.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_merge_consent_exemption.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_merge_consent_required_check.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_migration_equivalence.py

feat(610): split the decision corpus into one YAML-frontmatter file per record

2026-07-25 19:45:09 +02:00

test_mutation_harness.py

feat(790): execute every MUTATION grade instead of asserting it (#815)

2026-08-22 13:12:15 +00:00

test_optional_request_members.py

fix(807): SPA full-replace bodies are built as Complete<T>, with a derived guard over droppable request members (#827)

2026-08-23 00:58:19 +00:00

test_post_review_verdict.py

fix(772,792): address both cold reviews — an unverified pin is no longer a green job

2026-08-22 23:25:26 +02:00

test_pr_changed_files.py

fix(742): inherit an h10 verdict only from an allow-listed reviewer (#850)

2026-08-27 02:52:02 +00:00

test_prepush_rebase_check_tag_exemption.py

fix(743): re-tense the third stale site, and pin the two surviving mutants

2026-08-06 00:10:45 +02:00

test_prepush_unsets_git_env.py

test(785): mutation proofs for the three unproven ranked guards (#810)

2026-08-21 20:10:01 +00:00

test_prove_fix.py

feat(780): commit a ruff config and enforce it in CI (#813)

2026-08-22 00:33:18 +00:00

test_remote_state_inventory.py

fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818)

2026-08-22 16:07:58 +00:00

test_review_verdict_vocabulary.py

fix(788): one declarative H10 verdict vocabulary, derived by both sides (#846)

2026-08-26 20:58:09 +00:00

test_workflow_persist_credentials.py

fix(744,835): ci-image.yml publishes from main only; guard persist-credentials with no exemption (#857)

2026-08-27 20:44:44 +00:00

test_worktree_ownership_guard.py

test(785): mutation proofs for the three unproven ranked guards (#810)

2026-08-21 20:10:01 +00:00

tracked_files.py

fix(806): guard populations over FILES derive from the git index, not a filesystem walk (#818)

2026-08-22 16:07:58 +00:00