5eadf0cff6
Some checks failed
Check / eval (push) Has been cancelled
.gitea/workflows/bump.yml: Mondays 05:17 UTC (+ workflow_dispatch for security bumps), nix flake update — within the pinned release branches by construction, never a release jump — gated by nix flake check --no-build, then a pathspec-limited flake.lock commit pushed to main with the update's change list as the body. That push triggers check.yml as a second net. Red gate or push race = a visibly failed run, nothing lands. v1 promotion stays human. py_compile/bash -n deliberately not in the gate: they don't read the lock. Container recipe inherited from check.yml (nixbld, sandbox=false, pinned Nix 2.31.5). Verified: V0 (yq parse, bash -n per run block); the update/commit/push logic simulated end-to-end in a scratch clone with a real nix flake update and a bare remote (changed + unchanged branches, bystander file stays uncommitted, push lands); today's bumped lock evals green. Remains: the first real run (cron pickup + Actions-token push) is not confirmable from a session — BACKLOG item 14 slimmed to that watch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>