From d1e8400ae9cded0d57c3fadd305fe514da92cb23 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 30 Jun 2026 01:26:10 +0800 Subject: [PATCH] feat(ci): enable warning step runtime switch --- .../awoooi-onboarding-warning-step.yaml | 12 +++--- ...ng_warning_step_runtime_enablement_gate.py | 38 +++++++++++----- ...ding_warning_step_template_copy_receipt.py | 43 +++++++++++++++---- .../services/delivery_closure_workbench.py | 10 ++++- .../test_delivery_closure_workbench_api.py | 6 +-- ...t_p0_cicd_baseline_source_readiness_api.py | 26 +++++++---- docs/LOGBOOK.md | 14 ++++++ ...g-step-template-copy-receipt.snapshot.json | 11 +++-- ...itea-onboarding-warning-step.workflow.yaml | 12 +++--- 9 files changed, 123 insertions(+), 49 deletions(-) diff --git a/.gitea/workflows/awoooi-onboarding-warning-step.yaml b/.gitea/workflows/awoooi-onboarding-warning-step.yaml index 4ac65c2e5..0faee9f44 100644 --- a/.gitea/workflows/awoooi-onboarding-warning-step.yaml +++ b/.gitea/workflows/awoooi-onboarding-warning-step.yaml @@ -1,9 +1,9 @@ # AWOOOI Gitea Onboarding Warning Step template. # -# Controlled-copy default: +# Controlled-runtime default: # - no push / pull_request / pull_request_target trigger # - no generic runner labels -# - runtime warning-step job is disabled until a separate controlled gate changes the switch +# - runtime warning-step job is enabled only for manual workflow_dispatch # - no secrets, host writes, workflow dispatch from Codex, or runtime apply name: AWOOOI Onboarding Warning Step @@ -12,18 +12,18 @@ on: workflow_dispatch: env: - AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "0" + AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "1" jobs: workflow-shape: # Gitea 1.25 can mark a workflow invalid when every root job has a job-level # `if`. Keep this no-op root job so the template remains parseable while - # the runtime warning-step job below stays fail-closed. + # the runtime warning-step job below is gated by the explicit env switch. runs-on: awoooi-non110-host timeout-minutes: 1 steps: - name: Confirm fail-closed warning-step workflow shape - run: echo "warning-step runtime job remains disabled by default." + run: echo "warning-step runtime job is enabled for manual dispatch only." warning-step: if: ${{ env.AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED == '1' }} @@ -39,5 +39,5 @@ jobs: git diff --check cat <<'SUMMARY' AWOOOI onboarding warning step template is present. - Runtime execution remains disabled until the next controlled gate. + Runtime execution is enabled only for manual workflow_dispatch. SUMMARY diff --git a/apps/api/src/services/awoooi_gitea_onboarding_warning_step_runtime_enablement_gate.py b/apps/api/src/services/awoooi_gitea_onboarding_warning_step_runtime_enablement_gate.py index ba5572901..15fe178b4 100644 --- a/apps/api/src/services/awoooi_gitea_onboarding_warning_step_runtime_enablement_gate.py +++ b/apps/api/src/services/awoooi_gitea_onboarding_warning_step_runtime_enablement_gate.py @@ -22,6 +22,8 @@ def load_latest_awoooi_gitea_onboarding_warning_step_runtime_enablement_gate() - receipt_rollups = _dict(receipt.get("rollups")) receipt_boundaries = _dict(receipt.get("operation_boundaries")) receipt_readback = _dict(receipt.get("readback")) + switch_value = str(receipt_rollups.get("runtime_execution_switch_value") or "0") + switch_enabled = switch_value == "1" receipt_ready = ( receipt.get("status") == _RECEIPT_READY_STATUS and receipt.get("active_blockers") == [] @@ -30,7 +32,7 @@ def load_latest_awoooi_gitea_onboarding_warning_step_runtime_enablement_gate() - and receipt_rollups.get("workflow_dispatch_declared") is True and receipt_rollups.get("auto_branch_event_count") == 0 and receipt_rollups.get("generic_runner_label_count") == 0 - and receipt_rollups.get("fail_closed_execution_switch_present") is True + and receipt_rollups.get("runtime_execution_switch_controlled") is True and receipt_boundaries.get("workflow_trigger_performed") is False ) active_blockers = _active_blockers( @@ -44,7 +46,9 @@ def load_latest_awoooi_gitea_onboarding_warning_step_runtime_enablement_gate() - "priority": "P0-004", "scope": "gitea_onboarding_warning_step_runtime_enablement", "status": ( - "controlled_warning_step_runtime_enablement_gate_ready" + "controlled_warning_step_runtime_enabled" + if switch_enabled and not active_blockers + else "controlled_warning_step_runtime_enablement_gate_ready" if not active_blockers else "blocked_warning_step_runtime_enablement_gate" ), @@ -64,16 +68,19 @@ def load_latest_awoooi_gitea_onboarding_warning_step_runtime_enablement_gate() - "workflow_content_sha256_12" ), "runtime_enablement_switch": "AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED", - "current_switch_default": "0", + "current_switch_default": switch_value, "desired_switch_value_after_controlled_apply": "1", "safe_next_step": ( - "prepare_controlled_switch_flip_with_pressure_guard_then_verify_no_auto_branch_trigger" + "runtime_enablement_switch_enabled_wait_for_manual_dispatch_evidence" + if switch_enabled + else "prepare_controlled_switch_flip_with_pressure_guard_then_verify_no_auto_branch_trigger" ), }, "controlled_apply": { "mode": "controlled_apply_prepared", - "controlled_apply_allowed": not active_blockers, - "workflow_runtime_enablement_authorized": not active_blockers, + "controlled_apply_allowed": not active_blockers and not switch_enabled, + "workflow_runtime_enablement_authorized": not active_blockers + and not switch_enabled, "workflow_dispatch_authorized": False, "auto_push_or_pull_request_trigger_authorized": False, "generic_runner_label_authorized": False, @@ -88,12 +95,16 @@ def load_latest_awoooi_gitea_onboarding_warning_step_runtime_enablement_gate() - "selector_type": "workflow_runtime_enablement_switch", "workflow_path": _WORKFLOW_PATH, "env_key": "AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED", - "expected_current_value": "0", + "expected_current_value": switch_value, "desired_value_after_controlled_apply": "1", "allowed_runner_label": "awoooi-non110-host", }, "source_of_truth_diff": { - "current_state": "warning_step_runtime_job_fail_closed_disabled", + "current_state": ( + "warning_step_runtime_job_enabled_for_manual_dispatch_only" + if switch_enabled + else "warning_step_runtime_job_fail_closed_disabled" + ), "desired_state": "warning_step_runtime_job_enabled_for_manual_dispatch_only", "delta_kind": "env_switch_value_change", "auto_branch_event_delta_allowed": False, @@ -149,11 +160,16 @@ def load_latest_awoooi_gitea_onboarding_warning_step_runtime_enablement_gate() - "fail_closed_execution_switch_present": ( receipt_rollups.get("fail_closed_execution_switch_present") is True ), + "runtime_execution_switch_controlled": ( + receipt_rollups.get("runtime_execution_switch_controlled") is True + ), + "runtime_execution_switch_value": switch_value, + "runtime_execution_switch_enabled": switch_enabled, "runner_pressure_guard_required": True, "controlled_runtime_enablement_ready": not active_blockers, "active_blocker_count": len(active_blockers), "workflow_trigger_performed": False, - "runtime_switch_changed": False, + "runtime_switch_changed": switch_enabled, }, "active_blockers": active_blockers, "operation_boundaries": { @@ -184,8 +200,8 @@ def _active_blockers( blockers.append("auto_branch_event_present_in_workflow") if receipt_rollups.get("generic_runner_label_count") != 0: blockers.append("generic_runner_label_present_in_workflow") - if receipt_rollups.get("fail_closed_execution_switch_present") is not True: - blockers.append("fail_closed_execution_switch_missing") + if receipt_rollups.get("runtime_execution_switch_controlled") is not True: + blockers.append("runtime_execution_switch_not_controlled") if receipt_boundaries.get("workflow_trigger_performed") is not False: blockers.append("workflow_trigger_already_performed") return _unique(blockers) diff --git a/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py b/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py index 3080e4331..e5b54171d 100644 --- a/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py +++ b/apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py @@ -17,7 +17,7 @@ _SCHEMA_VERSION = "awoooi_gitea_onboarding_warning_step_template_copy_receipt_v1 _RECEIPT_SCHEMA_VERSION = ( "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1" ) -_EXPECTED_WORKFLOW_SHA256_12 = "70ecac9e4b59" +_EXPECTED_WORKFLOW_SHA256_12 = "23b59f29cb77" _TEMPLATE_RELATIVE_PATH = ( "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml" ) @@ -36,7 +36,7 @@ _GENERIC_LABEL_PATTERNS = ( def load_latest_awoooi_gitea_onboarding_warning_step_template_copy_receipt( repo_root: Path | None = None, ) -> dict[str, Any]: - """Return the fail-closed warning-step workflow copy receipt.""" + """Return the warning-step workflow copy receipt.""" root = repo_root or resolve_repo_root(Path(__file__)) template_path = root / _TEMPLATE_RELATIVE_PATH workflow_path = root / _WORKFLOW_RELATIVE_PATH @@ -54,6 +54,9 @@ def load_latest_awoooi_gitea_onboarding_warning_step_template_copy_receipt( effective_workflow_sha = ( _short_content_sha(effective_workflow_text) if effective_workflow_text else "" ) + runtime_switch_value = _runtime_execution_switch_value( + receipt, effective_workflow_text + ) template_copy_recorded = _template_copy_recorded( receipt=receipt, template_sha=template_sha, @@ -137,7 +140,7 @@ def load_latest_awoooi_gitea_onboarding_warning_step_template_copy_receipt( "workflow_matches_source_template_or_receipt_hash_matches", "workflow_has_no_auto_branch_event", "workflow_has_no_generic_runner_label", - "workflow_runtime_execution_switch_defaults_off", + "workflow_runtime_execution_switch_controlled", "runner_pressure_guard_required", "git_diff_check_required", ], @@ -182,6 +185,12 @@ def load_latest_awoooi_gitea_onboarding_warning_step_template_copy_receipt( effective_workflow_text ) or receipt.get("fail_closed_execution_switch_present") is True, + "runtime_execution_switch_controlled": _runtime_execution_switch_controlled( + receipt, effective_workflow_text + ), + "runtime_execution_switch_value": runtime_switch_value, + "runtime_execution_switch_enabled": runtime_switch_value == "1", + "runtime_enablement_switch_changed": runtime_switch_value == "1", "apply_gate_ready": _gate_ready(gate_readback), "active_blocker_count": len(active_blockers), "active_workflow_file_created": template_copy_recorded, @@ -233,11 +242,8 @@ def _active_blockers( blockers.append("auto_branch_event_present_in_workflow") if _generic_runner_label_count(receipt, effective_workflow_text) > 0: blockers.append("generic_runner_label_present_in_workflow") - if not ( - _fail_closed_switch_present(effective_workflow_text) - or receipt.get("fail_closed_execution_switch_present") is True - ): - blockers.append("fail_closed_execution_switch_missing") + if not _runtime_execution_switch_controlled(receipt, effective_workflow_text): + blockers.append("runtime_execution_switch_not_controlled") return blockers @@ -357,5 +363,26 @@ def _fail_closed_switch_present(template_text: str) -> bool: ) +def _runtime_execution_switch_value(receipt: dict[str, Any], template_text: str) -> str: + match = re.search( + r'AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED:\s*"([01])"', + template_text, + ) + if match: + return match.group(1) + value = receipt.get("runtime_execution_switch_value") + return value if value in {"0", "1"} else "" + + +def _runtime_execution_switch_controlled( + receipt: dict[str, Any], + template_text: str, +) -> bool: + return ( + _runtime_execution_switch_value(receipt, template_text) in {"0", "1"} + and "AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED == '1'" in template_text + ) or receipt.get("runtime_execution_switch_controlled") is True + + def _dict(value: Any) -> dict[str, Any]: return value if isinstance(value, dict) else {} diff --git a/apps/api/src/services/delivery_closure_workbench.py b/apps/api/src/services/delivery_closure_workbench.py index 660e1b6dd..f9ffd587c 100644 --- a/apps/api/src/services/delivery_closure_workbench.py +++ b/apps/api/src/services/delivery_closure_workbench.py @@ -898,7 +898,10 @@ def build_delivery_closure_workbench( ), "runtime_enablement_gate_ready": ( cicd_runtime_enablement_gate.get("status") - == "controlled_warning_step_runtime_enablement_gate_ready" + in { + "controlled_warning_step_runtime_enablement_gate_ready", + "controlled_warning_step_runtime_enabled", + } ), "runtime_enablement_gate_active_blocker_count": _int( cicd_runtime_enablement_rollups.get("active_blocker_count") @@ -1380,7 +1383,10 @@ def build_delivery_closure_workbench( ), "p0_cicd_warning_step_runtime_enablement_gate_ready": ( cicd_runtime_enablement_gate.get("status") - == "controlled_warning_step_runtime_enablement_gate_ready" + in { + "controlled_warning_step_runtime_enablement_gate_ready", + "controlled_warning_step_runtime_enabled", + } ), "p0_cicd_warning_step_runtime_enablement_active_blocker_count": _int( cicd_runtime_enablement_rollups.get("active_blocker_count") diff --git a/apps/api/tests/test_delivery_closure_workbench_api.py b/apps/api/tests/test_delivery_closure_workbench_api.py index 08acb7a44..9df38d051 100644 --- a/apps/api/tests/test_delivery_closure_workbench_api.py +++ b/apps/api/tests/test_delivery_closure_workbench_api.py @@ -372,7 +372,7 @@ def _assert_delivery_workbench_shape(data: dict): assert data["summary"]["p0_cicd_template_copy_active_workflow_file_created"] is True assert data["summary"]["p0_cicd_template_copy_workflow_trigger_performed"] is False assert data["summary"]["p0_cicd_warning_step_runtime_enablement_gate_status"] == ( - "controlled_warning_step_runtime_enablement_gate_ready" + "controlled_warning_step_runtime_enabled" ) assert data["summary"]["p0_cicd_warning_step_runtime_enablement_gate_ready"] is True assert ( @@ -385,7 +385,7 @@ def _assert_delivery_workbench_shape(data: dict): data["summary"][ "p0_cicd_warning_step_runtime_enablement_controlled_apply_allowed" ] - is True + is False ) assert ( data["summary"][ @@ -400,7 +400,7 @@ def _assert_delivery_workbench_shape(data: dict): data["summary"][ "p0_cicd_warning_step_runtime_enablement_current_switch_default" ] - == "0" + == "1" ) assert ( data["summary"][ diff --git a/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py b/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py index 4b05722ed..9a74738fd 100644 --- a/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py +++ b/apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py @@ -286,7 +286,7 @@ def test_warning_step_template_copy_is_fail_closed_and_pressure_guarded(): assert "workflow-shape:" in workflow assert "Confirm fail-closed warning-step workflow shape" in workflow assert "runs-on: awoooi-non110-host" in workflow - assert 'AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "0"' in workflow + assert 'AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "1"' in workflow assert "ops/runner/guard-gitea-runner-pressure.py --root ." in workflow @@ -377,7 +377,7 @@ def _assert_template_copy_receipt(payload: dict): assert payload["status"] == "controlled_template_copy_receipt_ready" assert payload["active_blockers"] == [] assert payload["readback"]["template_copy_performed"] is True - assert payload["readback"]["workflow_content_sha256_12"] == "70ecac9e4b59" + assert payload["readback"]["workflow_content_sha256_12"] == "23b59f29cb77" assert payload["target_selector"]["active_workflow_file_created"] is True assert payload["rollups"]["template_file_present"] is True assert payload["rollups"]["receipt_snapshot_present"] is True @@ -385,7 +385,12 @@ def _assert_template_copy_receipt(payload: dict): assert payload["rollups"]["workflow_matches_template"] is True assert payload["rollups"]["auto_branch_event_count"] == 0 assert payload["rollups"]["generic_runner_label_count"] == 0 - assert payload["rollups"]["expected_workflow_sha256_12"] == "70ecac9e4b59" + assert payload["rollups"]["expected_workflow_sha256_12"] == "23b59f29cb77" + assert payload["rollups"]["fail_closed_execution_switch_present"] is False + assert payload["rollups"]["runtime_execution_switch_controlled"] is True + assert payload["rollups"]["runtime_execution_switch_value"] == "1" + assert payload["rollups"]["runtime_execution_switch_enabled"] is True + assert payload["rollups"]["runtime_enablement_switch_changed"] is True assert payload["rollups"]["apply_gate_ready"] is True assert payload["rollups"]["workflow_trigger_performed"] is False assert payload["operation_boundaries"]["controlled_template_copy_only"] is True @@ -403,7 +408,7 @@ def _assert_runtime_enablement_gate(payload: dict): ) assert payload["priority"] == "P0-004" assert payload["scope"] == "gitea_onboarding_warning_step_runtime_enablement" - assert payload["status"] == "controlled_warning_step_runtime_enablement_gate_ready" + assert payload["status"] == "controlled_warning_step_runtime_enabled" assert payload["active_blockers"] == [] assert payload["readback"]["source_receipt_status"] == ( "controlled_template_copy_receipt_ready" @@ -411,17 +416,17 @@ def _assert_runtime_enablement_gate(payload: dict): assert payload["readback"]["runtime_enablement_switch"] == ( "AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED" ) - assert payload["readback"]["current_switch_default"] == "0" + assert payload["readback"]["current_switch_default"] == "1" assert payload["readback"]["desired_switch_value_after_controlled_apply"] == "1" - assert payload["controlled_apply"]["controlled_apply_allowed"] is True - assert payload["controlled_apply"]["workflow_runtime_enablement_authorized"] is True + assert payload["controlled_apply"]["controlled_apply_allowed"] is False + assert payload["controlled_apply"]["workflow_runtime_enablement_authorized"] is False assert payload["controlled_apply"]["workflow_dispatch_authorized"] is False assert payload["controlled_apply"]["auto_push_or_pull_request_trigger_authorized"] is False assert payload["controlled_apply"]["generic_runner_label_authorized"] is False assert payload["target_selector"]["env_key"] == ( "AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED" ) - assert payload["target_selector"]["expected_current_value"] == "0" + assert payload["target_selector"]["expected_current_value"] == "1" assert payload["target_selector"]["desired_value_after_controlled_apply"] == "1" assert payload["source_of_truth_diff"]["delta_kind"] == "env_switch_value_change" assert payload["check_mode"]["enabled"] is True @@ -431,7 +436,10 @@ def _assert_runtime_enablement_gate(payload: dict): assert payload["rollups"]["controlled_runtime_enablement_ready"] is True assert payload["rollups"]["active_blocker_count"] == 0 assert payload["rollups"]["workflow_trigger_performed"] is False - assert payload["rollups"]["runtime_switch_changed"] is False + assert payload["rollups"]["runtime_execution_switch_controlled"] is True + assert payload["rollups"]["runtime_execution_switch_value"] == "1" + assert payload["rollups"]["runtime_execution_switch_enabled"] is True + assert payload["rollups"]["runtime_switch_changed"] is True assert payload["operation_boundaries"]["readback_only"] is True assert payload["operation_boundaries"]["controlled_runtime_enablement_gate_open"] is True assert payload["operation_boundaries"]["workflow_file_modified_by_this_endpoint"] is False diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 162fed818..dcffc5209 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -12,6 +12,20 @@ **邊界**：未重啟主機，未 restart service，未 workflow_dispatch，未操作 host / Docker / K8s / DB / firewall，未使用 GitHub / `gh` / GitHub API，未讀 secret / token / raw sessions / SQLite / `.env`。 +## 2026-06-30 — 01:25 P0-004 warning-step runtime switch controlled apply + +**照優先順序完成的實作**： +- production 已讀回 `/api/v1/agents/awoooi-gitea-onboarding-warning-step-runtime-enablement-gate` 為 `controlled_warning_step_runtime_enablement_gate_ready`，因此推進 P0-004 下一段 controlled apply。 +- 將 `.gitea/workflows/awoooi-onboarding-warning-step.yaml` 與 source template 的 `AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED` 從 `"0"` 改為 `"1"`；workflow 仍只允許 `workflow_dispatch`，runner 仍是 `awoooi-non110-host`，沒有新增 push / pull_request / pull_request_target。 +- 更新 template-copy receipt hash 與 runtime switch readback，runtime gate 現在本地讀回 `controlled_warning_step_runtime_enabled`、`runtime_switch_changed=true`、`workflow_trigger_performed=false`，Delivery Workbench 同步投影 enabled 狀態。 + +**驗證**： +- `py_compile`、ruff focused check、P0-004 / Delivery Workbench / CD profile focused pytest `37 passed`。 +- Gitea runner pressure guard：`auto_branch_events_on_110=0`、`generic_runner_labels=0`。 +- Local readback：receipt ready、switch value `1`、gate active blockers `[]`、controlled apply already consumed、workflow dispatch performed `false`。 + +**邊界**：未 workflow_dispatch，未改 runner，未操作 host / Docker / K8s / DB / firewall，未使用 GitHub / `gh` / GitHub API，未讀 secret / token / raw sessions / SQLite / `.env`。 + ## 2026-06-30 — 00:41 P0-004 template copy receipt runtime-image readback 修正 **照優先順序完成的實作**： diff --git a/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json b/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json index ff24513b8..89c6a8cba 100644 --- a/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json +++ b/docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json @@ -1,16 +1,19 @@ { "schema_version": "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1", - "generated_at": "2026-06-30T00:42:00+08:00", + "generated_at": "2026-06-30T01:27:00+08:00", "workplan_id": "P0-004-TEMPLATE-COPY-CONTROLLED-APPLY", "source_template_path": "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml", "destination_workflow_path": ".gitea/workflows/awoooi-onboarding-warning-step.yaml", - "source_template_content_sha256_12": "70ecac9e4b59", - "destination_workflow_content_sha256_12": "70ecac9e4b59", + "source_template_content_sha256_12": "23b59f29cb77", + "destination_workflow_content_sha256_12": "23b59f29cb77", "template_copy_recorded": true, "destination_workflow_runtime_visible_required": false, "runtime_image_excludes_dot_gitea": true, "workflow_dispatch_declared": true, - "fail_closed_execution_switch_present": true, + "fail_closed_execution_switch_present": false, + "runtime_execution_switch_controlled": true, + "runtime_execution_switch_value": "1", + "runtime_enablement_switch_changed": true, "workflow_trigger_performed": false, "auto_branch_event_count": 0, "generic_runner_label_count": 0, diff --git a/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml b/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml index 4ac65c2e5..0faee9f44 100644 --- a/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml +++ b/docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml @@ -1,9 +1,9 @@ # AWOOOI Gitea Onboarding Warning Step template. # -# Controlled-copy default: +# Controlled-runtime default: # - no push / pull_request / pull_request_target trigger # - no generic runner labels -# - runtime warning-step job is disabled until a separate controlled gate changes the switch +# - runtime warning-step job is enabled only for manual workflow_dispatch # - no secrets, host writes, workflow dispatch from Codex, or runtime apply name: AWOOOI Onboarding Warning Step @@ -12,18 +12,18 @@ on: workflow_dispatch: env: - AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "0" + AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "1" jobs: workflow-shape: # Gitea 1.25 can mark a workflow invalid when every root job has a job-level # `if`. Keep this no-op root job so the template remains parseable while - # the runtime warning-step job below stays fail-closed. + # the runtime warning-step job below is gated by the explicit env switch. runs-on: awoooi-non110-host timeout-minutes: 1 steps: - name: Confirm fail-closed warning-step workflow shape - run: echo "warning-step runtime job remains disabled by default." + run: echo "warning-step runtime job is enabled for manual dispatch only." warning-step: if: ${{ env.AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED == '1' }} @@ -39,5 +39,5 @@ jobs: git diff --check cat <<'SUMMARY' AWOOOI onboarding warning step template is present. - Runtime execution remains disabled until the next controlled gate. + Runtime execution is enabled only for manual workflow_dispatch. SUMMARY