security: a real CI check before auto-merge; .github/ always protected; no shell interpolation in labs-aicharts #46

Merged

teahubxyz merged 1 commits from security/ci-context into main

2026-10-14 04:33:35 +00:00

Author	SHA1	Message	Date
claude	0bbc7af7db	security: a real CI check before auto-merge; .github/ always protected; no shell interpolation in labs-aicharts - checks(): the worker's own time/worker-run status can block or delay a merge but never counts as green - dispatch_ci(): with no other check on the head, Time runs TIME_CI_WORKFLOW (ci.yml, workflow_dispatch) on the PR branch and waits; beat ci-dispatched, once - ci.yml accepts workflow_dispatch - touches_protected(): .github/ is always protected, whatever TIME_PROTECTED says - labs-aicharts.yml: deploy URL via env, not ${{ }} in the script - tests: worker-status-only no longer merges; dispatch once; real context merges Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6	2026-10-13 21:32:14 -07:00

Author

SHA1

Message

Date

claude

0bbc7af7db

security: a real CI check before auto-merge; .github/ always protected; no shell interpolation in labs-aicharts

- checks(): the worker's own time/worker-run status can block or delay a merge but never counts as green
- dispatch_ci(): with no other check on the head, Time runs TIME_CI_WORKFLOW (ci.yml, workflow_dispatch) on the PR branch and waits; beat ci-dispatched, once
- ci.yml accepts workflow_dispatch
- touches_protected(): .github/ is always protected, whatever TIME_PROTECTED says
- labs-aicharts.yml: deploy URL via env, not ${{ }} in the script
- tests: worker-status-only no longer merges; dispatch once; real context merges

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYHXFvWMCs1GUmRmpySqQ6

2026-10-13 21:32:14 -07:00