[PR] fix(dev): use ./ for the reusable-workflow calls, not $/ [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1236:
URL: https://github.com/apache/magpie/pull/1236

   ## Summary
   
   - **[Run 35000731127](https://github.com/apache/magpie/actions/runs/35000731127) is a `startup_failure` with zero jobs** — the workflow never parsed, so nothing ran.
   - The only non-standard construct in it was `uses: $/.github/workflows/…`, applied from zizmor's `self-repository` auto-fix in #1234. `./` is the documented syntax for calling a reusable workflow in the same repository, and it is what actually parses.
   - Reverts the four calls to `./` and suppresses the audit per call, with the reason recorded in the workflow header.
   
   ## Type of change
   
   - [ ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
   - [ ] Tool / bridge contract (`tools/<system>/*.md`)
   - [ ] Python package (`tools/*/` with `pyproject.toml`)
   - [ ] Groovy reference impl
   - [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
   - [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [ ] Project template (`projects/_template/`)
   - [x] CI / dev loop (`prek`, workflows, validators)
   - [ ] Other:
   
   ## Test plan
   
   - [ ] `prek run --all-files` passes
   - [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes
   - [ ] For Groovy bridges touched: command-line invocation tested end-to-end
   - [ ] For skill changes: eval suite passes for the affected skill
   - [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
   - [x] Other:
     - `prek run --files` clean on the workflow.
     - `zizmor --persona regular` clean across all workflows (4 ignored, with the inline reason).
     - The failure being fixed is observed — a run that produced no jobs at all.
   
   ⚠️ **Still not a proven-green workflow.** `workflow_dispatch` runs whatever is on `main`, so the next dispatch after this merges is the first that can get past parsing. What this PR establishes is that it parses; what it cannot establish is that the six jobs then succeed.
   
   ## RFC-AI-0004 compliance
   
   - [ ] **HITL** — any new mutation is gated on explicit user confirmation
   - [x] **Sandbox** — no new host access.
   - [ ] **Vendor neutrality** — placeholders used in all skill / tool prose
   - [ ] **Conversational + correctable** — agentic-override path documented if behaviour is adopter-tunable
   - [ ] **Write-access discipline** — no autonomous outbound messages; drafts only, sent on confirmation
   - [ ] **Privacy LLM** — private content does not reach a non-approved LLM
   
   ## Linked issues
   
   Follow-up to #1234.
   
   ## Notes for reviewers
   
   - **This was my mistake, and it is worth naming so the pattern does not repeat.** zizmor reported `self-repository` at High confidence with an auto-fix, and I applied it to a workflow that by construction cannot be executed before merging — having said in the same breath that the syntax was unverified. A linter's confidence is not evidence when nothing can run the result. The suppression comment now carries that reason inline so the next person does not re-apply the fix.
   - **The suppression is per call, not a `.zizmor.yml` rule**, matching the existing precedent in `asf-allowlist-check.yml`: the reason is specific to these four lines, and a config-level rule would silence the audit everywhere including places where it is right.
   - If `$/` becomes usable on this GitHub version later, the suppressions are the thing to delete — but only with a run that actually starts as evidence.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(dev): use ./ for the reusable-workflow calls, not $/ [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1236:
URL: https://github.com/apache/magpie/pull/1236


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org