Files

T

Jon Chery 9bac2685cb feat(P03 W7): secret rotation scheduled workflow (SPEC §5.9)

workflows-src/rotate-aws-key.yml — daily cron (0 0 * * *) + workflow_dispatch,
wraps scripts/rotate_spike_key.sh (uses NOVA_AWS_* static-key auth to IAM-
rotate the nova-spike-runner key; uploads the new key to the consumer's
Actions secret store; idempotent — deactivates the old key only after the
new propagates, verified by a post-PUT GET). Synced to .github + .gitea.
v0.2 scope: the mechanism exists (SPEC §5.9 — exists-not-ran); the v0.2
deploy uses the currently-active key. Documented in ARCHITECTURE.md §12.9.

The synced workflow file is forge-agnostic (REQ-230): forge base URL /
owner / consumer repo come from repository secrets (NOVA_FORGE_*,
NOVA_CONSUMER_REPO), not literals. rotate_spike_key.sh reads NOVA_FORGE_*
with NOVA_GITEA_* backward-compat fallback. sync_workflows.py PAIRS
extended to include rotate-aws-key.yml (was hardcoded to 3 pairs).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W7
---

2026-08-18 23:39:34 +00:00

ci.yml

fix(P03 W0.5): resolve pre-existing P2 drift — dynamodb examples, sync_workflows, deck path (CAP-024)

2026-08-18 22:00:30 +00:00

deploy.yml

fix(P03 W6): deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2)

2026-08-18 23:30:31 +00:00

modules-lifecycle.yml

feat(P1): remove gitea/gitlab from synced files + simplify docs (REQ-230,231,232)

2026-08-07 18:20:29 +00:00

README.md

Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)

2026-07-29 21:36:37 +00:00

rotate-aws-key.yml

feat(P03 W7): secret rotation scheduled workflow (SPEC §5.9)

2026-08-18 23:39:34 +00:00

slides.yml

test(P5): ci + tests + readme for single-doc dual-pptx pipeline (REQ-273,274,275)

2026-08-12 00:34:23 +00:00

README.md

Gitea Workflows — Limitation Documentation (v1.14, REQ-150)

Shared workflows (byte-identical Gitea + GitHub)

These 3 workflows exist in both .gitea/workflows/ and .github/workflows/ and are byte-identical (asserted by tests/test_pipeline_contract.py):

ci.yml — lint + test + check-only (runs on every PR)
deploy.yml — reusable deploy workflow (invoked by consumer repos)
modules-lifecycle.yml — L1 + L2 module lifecycle pipeline (plan-only default, full on workflow_dispatch override)

GitHub-only workflows (no Gitea mirror)

These 4 workflows exist only in .github/workflows/:

platform-test.yml — PR pipeline: lint + unit + integration + schema validation. Uses GitHub Actions features (reusable workflow composition, environment protection) not available in Gitea Actions.
primitives-plan.yml — PR plan-only matrix over all L1 primitives. Uses GitHub matrix strategy + terraform plan against live AWS.
patterns-plan.yml — PR plan-only matrix over all L2 modules. Same pattern as primitives-plan.
release.yml — release job on merge to main: computes next semver, creates + updates MAJOR.MINOR.PATCH / MAJOR.MINOR / MAJOR floating tags, creates a GitHub release. GitHub-only by design (Gitea releases are created via the ship workflow's API call, not a workflow).

Why no Gitea mirror

Gitea Actions (act_runner) has limited support for reusable workflow composition, environment protection, and the gh CLI used by the release job. The 3 shared workflows are the ones that need to run on both forges (CI + deploy + lifecycle). The 4 GitHub-only workflows are the production-grade platform pipelines that run on GitHub Actions; Gitea is the dev/integration forge. Mirroring them would require feature parity that Gitea Actions does not currently provide.

This is a documented limitation, not a defect. A future milestone may add Gitea mirrors if act_runner gains the required features.