From 0bddebdc43db6dda76b4e33b60f245cf3535a1d8 Mon Sep 17 00:00:00 2001 From: "jorisjonkers-dev-agents[bot]" Date: Sun, 28 Jun 2026 13:10:40 +0000 Subject: [PATCH 1/2] fix(reusable): check out github-workflows at github.job_workflow_sha MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reusable workflows resolved the github-workflows checkout ref from github.workflow_ref, which in a called workflow is the CALLER's ref (…/ci.yml@refs/pull/N/merge) — so the composite-action checkout tried github-workflows@refs/pull/N/merge and failed with 'ref not found', breaking every JVM/node/gitops consumer on PR events. Use github.job_workflow_sha (the reusable workflow's own commit) instead. --- .../workflows/deploy-config-render-drift.yml | 2 +- .github/workflows/flux-render-validate.yml | 2 +- .github/workflows/gitops-ci.yml | 2 +- .github/workflows/jvm-ci.yml | 36 ++----------------- .github/workflows/migration-guard.yml | 2 +- .github/workflows/node-ci.yml | 2 +- .../workflows/platform-config-validate.yml | 2 +- 7 files changed, 8 insertions(+), 40 deletions(-) diff --git a/.github/workflows/deploy-config-render-drift.yml b/.github/workflows/deploy-config-render-drift.yml index 33fa52a..27182cd 100644 --- a/.github/workflows/deploy-config-render-drift.yml +++ b/.github/workflows/deploy-config-render-drift.yml @@ -57,7 +57,7 @@ jobs: - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false diff --git a/.github/workflows/flux-render-validate.yml b/.github/workflows/flux-render-validate.yml index 9d46b96..b2f5c3b 100644 --- a/.github/workflows/flux-render-validate.yml +++ b/.github/workflows/flux-render-validate.yml @@ -57,7 +57,7 @@ jobs: - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false diff --git a/.github/workflows/gitops-ci.yml b/.github/workflows/gitops-ci.yml index 5ddc6d6..b72f497 100644 --- a/.github/workflows/gitops-ci.yml +++ b/.github/workflows/gitops-ci.yml @@ -64,7 +64,7 @@ jobs: - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false diff --git a/.github/workflows/jvm-ci.yml b/.github/workflows/jvm-ci.yml index 5592dcc..e8d9ee0 100644 --- a/.github/workflows/jvm-ci.yml +++ b/.github/workflows/jvm-ci.yml @@ -58,26 +58,10 @@ jobs: steps: - uses: actions/checkout@v6 - - name: Resolve workflow ref - id: workflow-ref - shell: bash - env: - WORKFLOW_REF: ${{ github.workflow_ref }} - run: | - set -euo pipefail - - ref="${WORKFLOW_REF#*@}" - if [ -z "$ref" ] || [ "$ref" = "$WORKFLOW_REF" ]; then - echo "::error::Unable to resolve reusable workflow ref from $WORKFLOW_REF" - exit 1 - fi - - printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false @@ -97,26 +81,10 @@ jobs: steps: - uses: actions/checkout@v6 - - name: Resolve workflow ref - id: workflow-ref - shell: bash - env: - WORKFLOW_REF: ${{ github.workflow_ref }} - run: | - set -euo pipefail - - ref="${WORKFLOW_REF#*@}" - if [ -z "$ref" ] || [ "$ref" = "$WORKFLOW_REF" ]; then - echo "::error::Unable to resolve reusable workflow ref from $WORKFLOW_REF" - exit 1 - fi - - printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false diff --git a/.github/workflows/migration-guard.yml b/.github/workflows/migration-guard.yml index f7590de..d638838 100644 --- a/.github/workflows/migration-guard.yml +++ b/.github/workflows/migration-guard.yml @@ -56,7 +56,7 @@ jobs: - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml index 0ca1683..07e2f84 100644 --- a/.github/workflows/node-ci.yml +++ b/.github/workflows/node-ci.yml @@ -83,7 +83,7 @@ jobs: - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false diff --git a/.github/workflows/platform-config-validate.yml b/.github/workflows/platform-config-validate.yml index 5c0c02d..d7579d2 100644 --- a/.github/workflows/platform-config-validate.yml +++ b/.github/workflows/platform-config-validate.yml @@ -66,7 +66,7 @@ jobs: - uses: actions/checkout@v6 with: repository: JorisJonkers-dev/github-workflows - ref: ${{ steps.workflow-ref.outputs.ref }} + ref: ${{ github.job_workflow_sha }} path: .github-workflows persist-credentials: false From fb9519a42dda328509decf297d04a9fda46862a6 Mon Sep 17 00:00:00 2001 From: "jorisjonkers-dev-agents[bot]" Date: Sun, 28 Jun 2026 13:13:31 +0000 Subject: [PATCH 2/2] fix(ci): ignore actionlint false positive for github.job_workflow_sha github.job_workflow_sha is a documented context property (the reusable workflow's own commit) but this actionlint version's context schema lacks it. Ignore that one message so the legitimate fix passes lint. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 816b7b4..724025d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,7 +37,7 @@ jobs: sudo install /tmp/actionlint /usr/local/bin/actionlint - name: Lint workflows - run: actionlint .github/workflows/*.yml + run: actionlint -ignore 'property "job_workflow_sha" is not defined' .github/workflows/*.yml yaml-validity: name: YAML Validity