Dotta b88fadb039 fix(ci): emit one runner route (#12444) ...

## Summary

- emit exactly one `runner` job output from the trusted gate
- write `ubuntu-latest` only inside fail-closed paths
- write the Fleet label only after every identity, PR-state,
merge-equivalence, and rerun-actor check passes

## Canary finding

The live gate reached the trusted success notice, but GitHub retained
the first of two duplicate `runner=` outputs, so policy still requested
`ubuntu-latest`. No EC2 instance launched. Routing was disabled
immediately.

## Validation

- `actionlint .github/workflows/pr-trusted.yml .github/workflows/pr.yml`
- `node --test ./scripts/__tests__/e2e-shard.test.mjs`
- internal routing harness passes and now requires exactly one runner
output in all cases
- AWS routing remains disabled during rotation

2026-08-28 11:22:05 -05:00

..

ISSUE_TEMPLATE

chore(github): expand issue forms (#7628)

2026-06-05 22:27:12 -07:00

scripts

ci: enforce migration order against PR target (#12433)

2026-08-28 08:47:22 -05:00

workflows

fix(ci): emit one runner route (#12444)

2026-08-28 11:22:05 -05:00

CODEOWNERS

chore: add @nickyleach to CODEOWNERS (#8289)

2026-06-18 13:34:55 -07:00

dependabot.yml

fix(observability): pin the Sentry browser SDK and gate the optional Sentry server peer on the exact version (#12270)

2026-08-27 07:20:03 -07:00

PULL_REQUEST_TEMPLATE.md

fix(ci): make PR-template inline-description contract explicit (#10558)

2026-07-31 09:46:26 -07:00