Harden three CI guards, found while porting this pipeline

[Baasie]

This pipeline was ported to weave-it.org over the last few days. Three things surfaced there that are latent here too. Each is one commit against one file, so they can be taken separately.

Workflow-only; no application code touched.

1. The content guard fails on any merge commit — a live bug

deploy.yml asks git log -1 --format='%an' "$SHA" and compares it to virtualddd-sync. That is "who changed the content" only when the sync's commit is the last one to land.

Merge a PR that carries a sync commit and the tip is the merge commit, authored by whoever pressed the button — so the deploy rejects files nobody touched. Verified against this repo's own history:

case	current	proposed
plain sync push (7b7370a)	pass	pass
merge commit carrying that sync commit	fails — reads "Kenny Baas-Schwegler"	pass
genuine hand edit (c6311f5)	fails	fails

It asks the range instead: who authored the commits between BEFORE and SHA that actually touched src/content. A merge commit touches nothing, so it never appears.

A squash still fails, and should — squashing rewrites the content's author into whoever opened the PR, leaving no evidence the sync produced it. The failure message now says so, since the next person to hit it will be holding a legitimate sync.

2. The sync has no guard for an unset NOTION_TOKEN

Every other secret here degrades to "skip and say so" — deploy.yml guards on [ -z "$HOST" ]. This one exits 1, hourly, on a schedule.

Nothing is wrong today because the secret is set. It matters when it's rotated, or a fork runs the workflow. On weave-it.org the hourly sync failed for seven hours with an unset token before anyone connected the red cross to the open task that caused it — a red run meaning "not configured" is indistinguishable from one meaning "broken".

3. node --test on an empty glob exits 0

Both globs match here, so this changes nothing today.

It's here because weave-it.org spent its entire migration with an empty tests/ directory: the step ran, went green on every push, and the brief went on saying that tier fails the deploy. Nobody was careless — the output said pass.

A green tick for "there was nothing to check" is worse than a red one, because it's indistinguishable from "everything passed".

---

Validated: all six workflows still parse as YAML, the three changed run: blocks pass bash -n, and the guard logic was replayed against real commits from this repository's history (above).

🤖 Generated with Claude Code

https://claude.ai/code/session_01QeS7uT29MpUrFiefwb4jzW

[Baasie]

Reviewed, and pushed three fixes to the branch (7023be9). All three are inside the guards this PR adds; nothing about the design changed.

The range form has a hole the tip form did not. When github.event.before is newer than github.sha — a force-push backwards — git diff BEFORE SHA still reports content moving while BEFORE..SHA is empty. The author list then came back empty, others was empty, and the guard passed. A guard whose whole job is attribution should not pass when it cannot attribute, so an empty list is now a refusal with its own message. Replayed against this repository's history:

case	result
plain sync push (bb7c822)	pass
range mixing sync commits with hand-written code (ff6ac6f~1..714dd6e)	pass — only the sync touched src/content
rollback, range empty and diff not	fail (was: silent pass)

paste -sd', ' cycles its delimiter list rather than using it whole, so three authors rendered as alice,bob carol. Now paste -sd, | sed 's/,/, /g'. Message-only, but it is the line someone reads while they are already confused.

The escaped quotes in the sync.yml comment were characters rather than quoting: \"nothing changed in Notion\".

Everything else stands as written. I checked what the token gate does downstream rather than assuming: every later step is gated on steps.diff.outputs.changed == 'true', which is empty when the diff step is skipped, and the deploy job needs the same output — so a skipped sync deploys nothing and claims nothing. compgen -G works under the bash -e shell Actions uses. All six workflows still parse and the changed run: blocks pass bash -n.

One thing worth a sentence in the file before this lands, because the next reader meets both comments in one sitting: changes 2 and 3 point in opposite directions on purpose. An empty test directory goes red because it is a promise this repo makes to itself; an unset secret goes green because it describes an environment that was never configured, such as a fork. That is defensible, but only if it is written down.

The squash caveat in the description does not apply to this PR itself — it touches no src/content, so squashing it is fine.