sneak
2d328e759b
Some checks failed
check / check (push) Successful in 10s
Build and Deploy to Cloudflare Pages / build (push) Failing after 15s
probe / p1-bare-alpine-checkout (push) Failing after 3s
probe / p2-alpine-apk-checkout (push) Successful in 5s
probe / p3-alpine-apk-build (push) Successful in 15s
probe / p4-alpine-apk-upload (push) Failing after 11s
probe / p5-node20alpine-checkout (push) Successful in 8s
probe / p6-node20slim-checkout (push) Successful in 11s
Build and Deploy to Cloudflare Pages / deploy (push) Has been skipped
Restores the hash-pinning work reverted in3d17e22(originally3f91a7candb157bfd) verbatim -- all six pinned values were independently re-resolved and confirmed correct twice, so they are reused, not re-derived. What is different this time is that the path is observable before it reaches main. The previous attempt broke the deploy because deploy.yml triggers only on push to main, so every pre-merge check simulated the runner instead of being it, and two adversarial reviews could not catch what neither could execute. Three changes on top of the restored work: - A temporary development-only branch trigger on on.push.branches, so the build job actually executes under act_runner. Removed before merge. - if: github.ref_name == 'main' on the deploy job. Without it, a branch push would run wrangler pages deploy against the real Cloudflare project with the real token on every iteration. This guard is permanent: it is one line and it makes any future branch trigger, deliberate or accidental, unable to reach Cloudflare. - A temporary .gitea/workflows/probe.yml, also deleted before merge. The Actions jobs and logs API is not readable by this account; the commit-status API is, and it reports one entry per job. So the diagnosis is encoded as job topology rather than log output: six jobs, each isolating one hypothesis about the 22s failure (bare alpine vs apk prerequisites, checkout vs site build vs artifact upload, musl node vs glibc node), each surfacing as its own status context so a single push tests them all in parallel. make check is green. No pinned value is touched.