HANZO_CI_TRUSTED is spelled out in each job, because the forge keeps env as a raw node per job

.github/workflows/build.yml

@@ -253,8 +253,12 @@ jobs:
     env:
       # 'true' only when this run's code came from this repository. Every step
       # that reads a credential requires it, so an empty or unevaluated value
-      # withholds the credential rather than handing it out.
-      HANZO_CI_TRUSTED: &trusted ${{ !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) }}
+      # withholds the credential rather than handing it out. Spelled out in each
+      # job, not aliased: Hanzo Git re-encodes every job as its own document and
+      # keeps `env` as a raw node, so an alias to another job's anchor arrives
+      # with no definition and the run is never created. `steps` survives an
+      # alias only because it is decoded into structs first.
+      HANZO_CI_TRUSTED: ${{ !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) }}
       # corepack fetches the pnpm/yarn TARBALL ITSELF from registry.npmjs.org,
       # and it does not read .npmrc to do it — so 317 repos that pin
       # `packageManager` reach out to npmjs on every install no matter how
@@ -3399,7 +3403,7 @@ jobs:
     env:
       COREPACK_NPM_REGISTRY: https://pkg.hanzo.ai
       HANZO_CI_ROLE: test
-      HANZO_CI_TRUSTED: *trusted
+      HANZO_CI_TRUSTED: ${{ !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) }}
     steps: *steps
 
   # The advisory leg: the same test on `advisory-runners`, reported and never
@@ -3413,7 +3417,7 @@ jobs:
     env:
       COREPACK_NPM_REGISTRY: https://pkg.hanzo.ai
       HANZO_CI_ROLE: test
-      HANZO_CI_TRUSTED: *trusted
+      HANZO_CI_TRUSTED: ${{ !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) }}
     steps: *steps
 
   cicd:
@@ -3461,7 +3465,7 @@ jobs:
     env:
       COREPACK_NPM_REGISTRY: https://pkg.hanzo.ai
       HANZO_CI_ROLE: publish
-      HANZO_CI_TRUSTED: *trusted
+      HANZO_CI_TRUSTED: ${{ !(startsWith(github.event_name, 'pull_request') && github.event.pull_request.head.repo.full_name != github.repository) }}
       HANZO_CI_TESTED: ${{ needs.test.result == 'success' && 'success' || needs.test-amd64.result }}
       HANZO_CI_GATED: ${{ inputs.test-runners }}
     # The same steps as `test`; HANZO_CI_ROLE decides which of them run here.

hanzo.yml

@@ -120,9 +120,11 @@ test:
   - name: fork-is-sandboxed
     # A pull request from a fork runs code no member wrote, so it gets a one-job
     # sandboxed runner, no credential, and no publish job. Three properties, one
-    # predicate, and the predicate is read off HANZO_CI_TRUSTED's definition so
+    # predicate, and the predicate is read off the first HANZO_CI_TRUSTED so
     # every copy must match it byte for byte — two spellings of "is this a fork"
-    # are two answers:
+    # are two answers. No copy is a YAML alias: Hanzo Git re-encodes each job as
+    # its own document and keeps `env` raw, so an alias there has no anchor and
+    # the forge creates no run at all:
     #
     #   RUNNER — every job's `runs-on` sends the fork to an `ephemeral-` label,
     #     which only the platform's one-job runners advertise.
@@ -134,8 +136,12 @@ test:
     run: |
       set -e
       f=.github/workflows/build.yml
-      def=$(grep -m1 "^      HANZO_CI_TRUSTED: &trusted " "$f") || {
-        echo "::error::HANZO_CI_TRUSTED is not defined under the anchor &trusted — the predicate has no one definition"; exit 1; }
+      def=$(grep -m1 '^      HANZO_CI_TRUSTED: ' "$f") || {
+        echo "::error::no job defines HANZO_CI_TRUSTED — the predicate has no definition"; exit 1; }
+      [ "$(grep '^      HANZO_CI_TRUSTED: ' "$f" | sort -u | wc -l)" = 1 ] || {
+        echo "::error::HANZO_CI_TRUSTED is spelled more than one way — every job must carry the same predicate"; exit 1; }
+      ! grep -nE '^ +[A-Za-z_-]+: [&*][A-Za-z]' "$f" | grep -v '^[0-9]*:    steps: [&*]steps$' || {
+        echo "::error::a YAML anchor or alias outside \`steps\` — Hanzo Git keeps env, if, runs-on and the rest as raw nodes per job, where an alias has no anchor"; exit 1; }
       p=${def#*'${{ !('}; p=${p%') }}'}
       [ -n "$p" ] && [ "$p" != "$def" ] || { echo "::error::cannot read the predicate out of: $def"; exit 1; }
       echo "predicate: $p"