The environment string form carries no url, so the PR timeline showed a
bare deployment entry. Point it at the pr-N preview to get a clickable
"View deployment" button.
actions/checkout v7 refuses to check out fork PR code under
pull_request_target unless allow-unsafe-pr-checkout is set, so every
fork PR failed the preview build.
Opt in, but gate the job on an environment for fork PRs only: a fork
controls the Dockerfile and everything it RUNs, which executes on a
runner holding packages: write. Same-repo PRs use an unprotected
environment and still build without a click.
The stale job only unstales on updated_at, which a push to the head
branch does not bump. A contributor answering with code instead of a
comment kept the label and got auto-closed.
Disables staticcheck SA4023: the nilness analyzer vendored in 2.13.0
(honnef.co/go/tools v0.8.0-rc.1) panics on recover() in pointer-returning
functions, triggered by sentry-go (dominikh/go-tools#1725).
The pinned image (v0.21.12) predates paradedb/paradedb#4338, which fixes
'could not read blocks' errors when a BM25 query with a non-indexed
predicate (our deleted_at filter) hits stale ctids after VACUUM
truncation. Repeated fixture reloads in the feature tests trigger exactly
that, making TestTaskSearchTitleBoost fail intermittently.
The unconditional type=raw,value=latest applied the latest tag to every
pushed git tag, including prereleases like v1.0.0-rc1. Removing it lets
metadata-action's default latest=auto flavor handle it, which only tags
latest for non-prerelease semver versions.
Fixes#2161
The auto-label workflow's LLM call succeeds, but the docker action ran
as a non-root user (`USER appuser` in the Dockerfile) and could not
write the runner's `GITHUB_OUTPUT` file:
```
Error: failed to set output: ... open /github/file_commands/set_output_...: permission denied
```
GitHub docker actions must run as root — the runner's file-command files
are owned by the runner user. Fixed in the fork
(tink-bot/LLM-action@8526bab removes the non-root user) and bumped the
pin here.
Failing run:
https://github.com/go-vikunja/vikunja/actions/runs/30904804523/job/91977288580
Co-authored-by: kolaente <k@knt.li>
Upstream rejects max_tokens/temperature for gpt-5 series models,
breaking auto-label with gpt-5.6-luna. Pin to the fork carrying
appleboy/LLM-action#24 until it is merged and released.
On pull_request_target, github.sha points to the base branch head, so
gh-describe baked main's version string into the preview image while the
code itself was the PR head. Pass the PR head sha explicitly.
Under pull_request_target, github.sha resolves to the base branch tip,
so every PR on the same main tip pushed the same sha-<base> tag and
preview images overwrote each other. DOCKER_METADATA_PR_HEAD_SHA makes
metadata-action use the PR head sha; the deploy comment derives its sha
from the meta output, so its per-commit URLs now match the pushed tag.
Fixes#3407
The job pushes with the SSH deploy key configured by actions/checkout's
ssh-key input, so GITHUB_TOKEN is never used for writes. Scope it down to
contents: read.
renovate[bot]andkolaente
