zeekay a8f840f803 fix(kms_test): the login-refusal cases blank the run's own credential ...

bin/kms spends a run's ID token, or a HANZO_API_TOKEN, before a stored
client. A GitHub job of this repository grants id-token: write, so IAM
exchanged a real token and the refusal case met "refused the secret NAME:
HTTP 403" instead of the login's 401. Every run of hanzoai/ci on GitHub
has failed there since 2026-10-15 (run 38748428994 and on), so neither
image has published since. The old test fails the same way with
HANZO_API_TOKEN set locally; this one passes with it and without.

2026-10-20 08:27:59 -07:00

..

alone_test.sh

Seed the PyPI lane's clean venv with pip

2026-09-29 10:11:11 -07:00

cache

perf(cache): parts move eight at a time, and a restore says where its time went

2026-10-20 07:42:29 -07:00

cache_test.sh

perf(cache): parts move eight at a time, and a restore says where its time went

2026-10-20 07:42:29 -07:00

certclaims

perf(certclaims): one grep per rule over every file, not two per file

2026-10-20 07:49:08 -07:00

certclaims_test.sh

a public page says what we hold, and nothing else

2026-08-28 22:00:47 -07:00

conflictmarkers

a fenced code block quotes the shape, it does not commit it

2026-08-08 19:36:20 +00:00

conflictmarkers_test.sh

the suite is executable like its siblings

2026-08-08 12:36:49 -07:00

credential_test.sh

The cut pushes to github.com with a GitHub token and to the forge with the IAM token.

2026-09-28 18:13:13 -07:00

cut_test.sh

fix(cut): a crate's Cargo.lock moves with its Cargo.toml

2026-10-15 08:55:23 -07:00

enqueue_test.sh

Report each enqueue assertion so the tally counts it

2026-09-24 10:47:16 -07:00

get_test.sh

The tools checkout fetches a caller's pinned sha instead of cloning it as a branch.

2026-09-28 18:30:31 -07:00

gocache

fix(cache): a Go cache save keeps what its run used

2026-10-16 23:18:26 -07:00

gocache_test.sh

fix(cache): a Go cache save keeps what its run used

2026-10-16 23:18:26 -07:00

gover

comments state the mechanism, not the day it bit us

2026-08-21 08:04:11 -07:00

gover_test.sh

Hand grep its input instead of piping into grep -q

2026-09-23 01:57:09 -07:00

ignoretracked

comments state the mechanism, not the day it bit us

2026-08-21 08:04:11 -07:00

imgplat

Read arm64 and arm64/v8 as one platform

2026-09-08 21:04:21 -07:00

imgplat_test.sh

Hand grep its input instead of piping into grep -q

2026-09-23 01:57:09 -07:00

imgtags

Let a release be what a bare pull answers

2026-09-10 21:52:45 -07:00

imgtags_test.sh

Hand grep its input instead of piping into grep -q

2026-09-23 01:57:09 -07:00

imgver

imgver reads the published floor with the KMS GitHub token when there is no GH_PAT

2026-09-30 00:48:10 -07:00

imgver_test.sh

imgver reads the published floor with the KMS GitHub token when there is no GH_PAT

2026-09-30 00:48:10 -07:00

kind_test.sh

a delegated build publishes a version, not only a sha

2026-09-08 13:01:52 -07:00

kms

bin/kms writes the ID token's mask to stderr, so what a caller captures is the secret alone, and both callers refuse a capture that holds more without printing it.

2026-10-02 14:26:29 -07:00

kms_test.sh

fix(kms_test): the login-refusal cases blank the run's own credential

2026-10-20 08:27:59 -07:00

modsize

comments state the mechanism, not the day it bit us

2026-08-21 08:04:11 -07:00

narrative

Public repositories' commit messages state the engineering reason

2026-09-29 22:08:48 -07:00

narrative_test.sh

Public repositories' commit messages state the engineering reason

2026-09-29 22:08:48 -07:00

pin

pin: hold a bump back for a REGRESSION, not for a red suite

2026-08-22 16:14:07 -07:00

pin_test.sh

Hand grep its input instead of piping into grep -q

2026-09-23 01:57:09 -07:00

publishable

Let a site declare build_secrets

2026-09-23 19:51:55 -07:00

publishable_test.sh

Let a site declare build_secrets

2026-09-23 19:51:55 -07:00

site

perf(site): ask the origin's sample all at once, hash on every core, and say where the time went

2026-10-20 07:42:29 -07:00

site_test.sh

perf(site): ask the origin's sample all at once, hash on every core, and say where the time went

2026-10-20 07:42:29 -07:00

sitepublish

comments describe present behaviour, not the edit that produced it

2026-08-21 08:06:27 -07:00

sitepublish_test.sh

Hand grep its input instead of piping into grep -q

2026-09-23 01:57:09 -07:00

tally_test.sh

a delegated build publishes a version, not only a sha

2026-09-08 13:01:52 -07:00

vendormark

refuse a site-generator vendor's branding, in all four places it hides

2026-08-05 16:56:10 -07:00

vendormark_test.sh

refuse a site-generator vendor's branding, in all four places it hides

2026-08-05 16:56:10 -07:00