From 117489ee50d35af63e163bfcb74be46d3b69bb28 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:00:49 +0100
Subject: [PATCH] =?UTF-8?q?fix(ci):=20repair=20boj-build.yml=20=E2=80=94?=
 =?UTF-8?q?=20three=20independent=20faults?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This workflow has never run. It carried three separate faults, any one
of which would have stopped it.

1. Parse: a `permissions:` block was inserted at column 0 *after* the
   job's steps, which terminates the `jobs:` mapping. The
   `K9-SVC Validation` step that a later sweep appended then sat at
   column 2, so YAML met a sequence item inside that permissions
   mapping and the file failed to parse. Actions rejects a workflow
   that does not parse before allocating a runner, so this produced no
   check run and no log at all.

2. Shell: the curl invocation was mis-quoted —

     -d "{... \"engine\": \"casket\\"}"}

   The quotes do not balance. Verified by feeding the line to `eval`,
   which fails outright: this is a bash syntax error, so even if the
   YAML had parsed, the step could not have run.

3. Permissions placement: `permissions:` belongs above `jobs:`. Where a
   file declared the scalar `read-all` alongside an indented key —
   itself invalid YAML — the block has been narrowed to the scopes the
   job actually uses (checkout + curl), preserving any explicitly named
   scope.

Repaired: permissions moved above `jobs:` with the file's own scopes,
the K9-SVC step re-indented into the job's `steps:` list, and the curl
rewritten with proper line continuations so the payload is well-formed
JSON. The checkout SHA pin and any `timeout-minutes` are preserved
exactly as this repository had them; no pin is changed.

KNOWN REMAINING ISSUE, deliberately not changed: the step posts to
`http://boj-server.local:7700`, an mDNS name that cannot resolve from a
GitHub-hosted runner, and `continue-on-error: true` hides the failure.
Once this parses, the step will run and silently fail. Repairing the
syntax is in scope; redesigning the trigger is an owner decision, so a
comment now records it rather than leaving it implicit.

Built with git plumbing directly against origin/HEAD, so no local
working tree was involved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/boj-build.yml | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index d70936f..7814c30 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -4,21 +4,30 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Trigger BoJ Server (Casket/ssg-mcp)
+        # NOTE: boj-server.local is an mDNS name that cannot resolve from a
+        # GitHub-hosted runner, so this request can only fail here; the
+        # continue-on-error below hides that. Left as-is deliberately —
+        # repairing the syntax is in scope, redesigning the trigger is not.
         run: |
-          # Send a secure trigger to boj-server to build this repository
-          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke"             -H "Content-Type: application/json"             -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"}
+          curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\"}"
         continue-on-error: true
-permissions: read-all
-  actions: read
 
-  - name: K9-SVC Validation
-    run: |
-      echo "K9-SVC validation"
-      [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"
+      - name: K9-SVC Validation
+        run: |
+          echo "K9-SVC validation"
+          [ -d .machine_readable/contractiles ] && echo "Contractiles present" || echo "No contractiles"
\ No newline at end of file