Follow-up to #45 (audit teahub #109, remaining High + Medium items).
Self-certified green.checks() no longer lets the worker's own time/worker-run status earn a merge; it can only block or delay one. With no other check on the PR head, Time now dispatches the project's CI on the PR branch (dispatch_ci, TIME_CI_WORKFLOW default ci.yml, which gains workflow_dispatch) and waits for that; GitHub skips pull_request runs for pushes made with the Actions token, which is why the self-status existed. Beat ci-dispatched, once. TIME_CI_WORKFLOW=off keeps the old "no checks" stop.
.github/ is protected from auto-merge whatever TIME_PROTECTED says (closes the update.yml supply-chain path).
labs-aicharts.yml passes the deploy URL through env instead of ${{ }} in the script.
Tests: worker-status-only no longer merges and triggers one CI dispatch; a real context merges; the fake GitHub accepts workflow dispatches. python3 .github/time/test_time.py green.
Follow-up to #45 (audit teahub #109, remaining High + Medium items).
- **Self-certified green.** `checks()` no longer lets the worker's own `time/worker-run` status earn a merge; it can only block or delay one. With no other check on the PR head, Time now dispatches the project's CI on the PR branch (`dispatch_ci`, `TIME_CI_WORKFLOW` default `ci.yml`, which gains `workflow_dispatch`) and waits for that; GitHub skips `pull_request` runs for pushes made with the Actions token, which is why the self-status existed. Beat `ci-dispatched`, once. `TIME_CI_WORKFLOW=off` keeps the old "no checks" stop.
- `.github/` is protected from auto-merge whatever `TIME_PROTECTED` says (closes the `update.yml` supply-chain path).
- `labs-aicharts.yml` passes the deploy URL through `env` instead of `${{ }}` in the script.
Tests: worker-status-only no longer merges and triggers one CI dispatch; a real context merges; the fake GitHub accepts workflow dispatches. `python3 .github/time/test_time.py` green.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #45 (audit teahub #109, remaining High + Medium items).
checks()no longer lets the worker's owntime/worker-runstatus earn a merge; it can only block or delay one. With no other check on the PR head, Time now dispatches the project's CI on the PR branch (dispatch_ci,TIME_CI_WORKFLOWdefaultci.yml, which gainsworkflow_dispatch) and waits for that; GitHub skipspull_requestruns for pushes made with the Actions token, which is why the self-status existed. Beatci-dispatched, once.TIME_CI_WORKFLOW=offkeeps the old "no checks" stop..github/is protected from auto-merge whateverTIME_PROTECTEDsays (closes theupdate.ymlsupply-chain path).labs-aicharts.ymlpasses the deploy URL throughenvinstead of${{ }}in the script.Tests: worker-status-only no longer merges and triggers one CI dispatch; a real context merges; the fake GitHub accepts workflow dispatches.
python3 .github/time/test_time.pygreen.🤖 Generated with Claude Code
https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6