a documented example is not an expression to evaluate

`v1` has failed at load, on every caller in the fleet, since 0e1a56b. Not a
test failure — a startup failure: zero jobs, zero seconds, and GitHub showing
the file's PATH where its name should be, because it never got far enough to
read `name:`.

The `tests:` input's description quotes what a caller writes, and quoted it
literally:

    `tests: ${{ github.ref_type != 'tag' }}`

Prose or not, that is an expression, and it sits under `on.workflow_call.inputs`
where NO context exists. GitHub validates the whole file before it schedules
anything, refuses `github` there, and drops the run — so every repo importing
`hanzoai/ci@v1` stopped running CI entirely while reporting only a red X with
nothing inside it to read.

The irony is exact: 0e1a56b is titled "the test step has never run, and the gate
that would have said so never ran either." It made that true of every gate at
once.

Say it without the sigil. Same meaning to a reader, nothing to evaluate.
Confirmed with actionlint: clean at 23862e5c (before the break), the same error
at v1, v1.0.34 and v2, clean here.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

.github/workflows/build.yml

@@ -73,7 +73,7 @@ on:
           A string sidesteps it on both planes with identical meaning, and the
           comparison is against 'false' rather than a truthiness test so that the
           expression callers already write — hanzoai/cloud's
-          `tests: ${{ github.ref_type != 'tag' }}`, which renders the strings
+          `tests:` set from `github.ref_type != 'tag'`, which renders the strings
           "true"/"false" — keeps working unchanged.
         type: string
         default: 'true'
@@ -867,6 +867,15 @@ jobs:
         # from github.com. Both rules are optional and independent: no FORGE_TOKEN
         # (or a github.com-hosted run, where the server IS github.com) leaves the
         # old behaviour exactly as it was.
+        #
+        # SPLIT THE SERVER, do not strip a scheme you assumed. GITHUB_SERVER_URL
+        # on this fleet's runners is `http://hanzo-git.hanzo.svc` — the forge's
+        # in-cluster address, plain http — and a `${SERVER#https://}` that only
+        # knows the https spelling passes it through whole, producing
+        # `https://http://hanzo-git.hanzo.svc/...` and a git that resolves the host
+        # `http`. Take the scheme and the host as the two values they are, and
+        # compare the HOST against github.com so the guard cannot be fooled by a
+        # spelling either.
         if: inputs.mode != 'delegate' && hashFiles('go.mod') != ''
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
@@ -876,13 +885,14 @@ jobs:
           set -uo pipefail
           CFG="$RUNNER_TEMP/gitconfig-go-test"; : > "$CFG"
           SERVER="${GITHUB_SERVER_URL:-https://github.com}"
+          SCHEME="${SERVER%%://*}"; HOST="${SERVER#*://}"; HOST="${HOST%/}"
           wrote=0
 
-          if [ -n "${FORGE_TOKEN:-}" ] && [ "$SERVER" != "https://github.com" ]; then
+          if [ -n "${FORGE_TOKEN:-}" ] && [ "$HOST" != "github.com" ]; then
             GIT_CONFIG_GLOBAL="$CFG" git config --global \
-              url."https://x:${FORGE_TOKEN}@${SERVER#https://}/${OWNER}/".insteadOf \
+              url."${SCHEME}://x:${FORGE_TOKEN}@${HOST}/${OWNER}/".insteadOf \
               "https://github.com/${OWNER}/"
-            echo "${OWNER}/* modules resolve from ${SERVER}"
+            echo "${OWNER}/* modules resolve from ${SCHEME}://${HOST}"
             wrote=1
           fi
 

.hanzo/workflows/build.yml

@@ -73,7 +73,7 @@ on:
           A string sidesteps it on both planes with identical meaning, and the
           comparison is against 'false' rather than a truthiness test so that the
           expression callers already write — hanzoai/cloud's
-          `tests: ${{ github.ref_type != 'tag' }}`, which renders the strings
+          `tests:` set from `github.ref_type != 'tag'`, which renders the strings
           "true"/"false" — keeps working unchanged.
         type: string
         default: 'true'
@@ -867,6 +867,15 @@ jobs:
         # from github.com. Both rules are optional and independent: no FORGE_TOKEN
         # (or a github.com-hosted run, where the server IS github.com) leaves the
         # old behaviour exactly as it was.
+        #
+        # SPLIT THE SERVER, do not strip a scheme you assumed. GITHUB_SERVER_URL
+        # on this fleet's runners is `http://hanzo-git.hanzo.svc` — the forge's
+        # in-cluster address, plain http — and a `${SERVER#https://}` that only
+        # knows the https spelling passes it through whole, producing
+        # `https://http://hanzo-git.hanzo.svc/...` and a git that resolves the host
+        # `http`. Take the scheme and the host as the two values they are, and
+        # compare the HOST against github.com so the guard cannot be fooled by a
+        # spelling either.
         if: inputs.mode != 'delegate' && hashFiles('go.mod') != ''
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
@@ -876,13 +885,14 @@ jobs:
           set -uo pipefail
           CFG="$RUNNER_TEMP/gitconfig-go-test"; : > "$CFG"
           SERVER="${GITHUB_SERVER_URL:-https://github.com}"
+          SCHEME="${SERVER%%://*}"; HOST="${SERVER#*://}"; HOST="${HOST%/}"
           wrote=0
 
-          if [ -n "${FORGE_TOKEN:-}" ] && [ "$SERVER" != "https://github.com" ]; then
+          if [ -n "${FORGE_TOKEN:-}" ] && [ "$HOST" != "github.com" ]; then
             GIT_CONFIG_GLOBAL="$CFG" git config --global \
-              url."https://x:${FORGE_TOKEN}@${SERVER#https://}/${OWNER}/".insteadOf \
+              url."${SCHEME}://x:${FORGE_TOKEN}@${HOST}/${OWNER}/".insteadOf \
               "https://github.com/${OWNER}/"
-            echo "${OWNER}/* modules resolve from ${SERVER}"
+            echo "${OWNER}/* modules resolve from ${SCHEME}://${HOST}"
             wrote=1
           fi