From b802aab044bc69d8ac13be2144ca4da1ef1bda08 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 24 Aug 2026 23:47:30 +0000 Subject: [PATCH] fix(ci-queue-watch): fail without a fleet token instead of reporting a green it did not earn MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The token check warned and exited 0, and the observe step was gated on `steps.tok.outputs.ok == 'true'`. So on any scheduled run with FLEET_READ_PAT unset — which is every run today — the watchdog reported SUCCESS having observed nothing at all. The comment defending that said an environmental condition must not look like a fleet outage. Half right, wrong conclusion. A watchdog that goes green without looking is not cautious, it is absent, and it is worse than having none: the green gets read as "the fleet queue is fine". This is the same vacuous-gate shape as `gate-authz` ending in `|| true` and the gitleaks config that loaded zero rules — a check whose success carries no information. It now fails, and the concern the old comment had is preserved where it actually belongs: in the message. The error names the missing secret, says explicitly that this is a missing secret in THIS repository and not a fleet outage, and gives the exact scope to grant (classic PAT `repo`, or fine-grained Actions=read on the Fuze* repos). A red that says "this check could not run" is honest; a green that means nothing is not. Verified: zero steps remain gated on the removed `tok` output, so there is no path left where the observe step is silently skipped. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01GaPa3JgrVNtWrGvqQEAEqv --- .github/workflows/ci-queue-watch.yml | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci-queue-watch.yml b/.github/workflows/ci-queue-watch.yml index d2cf7056..1375ee21 100644 --- a/.github/workflows/ci-queue-watch.yml +++ b/.github/workflows/ci-queue-watch.yml @@ -70,20 +70,30 @@ jobs: # job -- say so loudly and exit 0. Never red a scheduled run on a missing # secret: an environmental condition must not look like a fleet outage, # which is the same inversion the actor gate caused in a2a-maintain. - - name: Check for a fleet-scoped token - id: tok + # THIS STEP USED TO WARN AND EXIT 0, with the observe step below gated on its + # output. The stated reasoning was that an environmental condition must not + # look like a fleet outage. That is half right, and the conclusion was wrong: + # with no token the scheduled run reported SUCCESS having observed nothing. + # A watchdog that goes green without looking is not a cautious watchdog, it + # is an absent one — and it is worse than none, because the green is read as + # "the fleet queue is fine". + # + # It now FAILS. The distinction the old comment cared about is preserved + # where it belongs — in the message, which names the missing secret and the + # exact scope to grant, so the red is self-describing and cannot be mistaken + # for a fleet outage. A red saying "this check could not run" is honest; a + # green that means nothing is not. + - name: Require a fleet-scoped token env: FLEET_READ_PAT: ${{ secrets.FLEET_READ_PAT }} run: | if [ -z "$FLEET_READ_PAT" ]; then - echo "::warning::FLEET_READ_PAT is not set — the watchdog can only see this repo, so it is skipping. Set a PAT with read access to Actions across the fleet (scope: repo, or fine-grained Actions:read on the Fuze* repos)." - echo "ok=false" >> "$GITHUB_OUTPUT" - else - echo "ok=true" >> "$GITHUB_OUTPUT" + echo "::error title=ci-queue-watch::FLEET_READ_PAT is not set, so this watchdog CANNOT observe the fleet queue. This is a MISSING SECRET in this repository, not a fleet outage. Set FLEET_READ_PAT to a token with read access to Actions across the fleet (classic PAT: scope 'repo'; fine-grained: Actions=read on the Fuze* repos). Until then this fails rather than reporting a green it did not earn." + exit 1 fi + echo "fleet-scoped token present" - name: Observe the fleet CI queue - if: steps.tok.outputs.ok == 'true' env: GITHUB_TOKEN: ${{ secrets.FLEET_READ_PAT }} STALL: ${{ inputs.stall_minutes || '30' }}