CRITICAL: CD guard self-defeats — every child repo skips all CI (fake green) #9

Open
opened 2026-07-19 12:39:58 +00:00 by mathias · 0 comments
Owner

Severity: critical — silent, affects every generated repo

.gitea/workflows/cd.yml guard job:

- id: detect
  run: |
    if grep -q 'git.d-ma.be/mathias/__PROJECT_NAME__' go.mod; then
      echo "is_template=true" >> "$GITHUB_OUTPUT"
    ...

The grep pattern contains __PROJECT_NAME__, which the template generator substitutes at create time along with every other placeholder. So in a generated repo the guard becomes grep -q 'git.d-ma.be/mathias/<name>' go.mod, and go.mod is module git.d-ma.be/mathias/<name>always matchesis_template=truecheck, build, and deploy all have if: needs.guard.outputs.is_template != 'true'all skip.

Net: every child repo's CI is fake-green — runs report success because all real jobs are skipped, nothing is ever built, tested, or deployed. Found in cad-atlas (runs 16–18 "green", but namespace/image/pod never existed).

Fix

Detect leftover placeholders by a pattern that is NOT itself substituted:

if grep -qE '__[A-Z_]+__' go.mod; then
  echo "is_template=true" >> "$GITHUB_OUTPUT"

Verified in cad-atlas: substituted repo → is_template=false (CI runs); raw __PROJECT_NAME__ go.mod → is_template=true (skips). Applied there as a stopgap; the template is the real fix so future children aren't born with rubber-stamp CI.

Sibling bugs from the same dogfooding pass: #8 (templ version skew + gitignore pattern).

## Severity: critical — silent, affects every generated repo `.gitea/workflows/cd.yml` guard job: ```yaml - id: detect run: | if grep -q 'git.d-ma.be/mathias/__PROJECT_NAME__' go.mod; then echo "is_template=true" >> "$GITHUB_OUTPUT" ... ``` The grep pattern contains `__PROJECT_NAME__`, which the template generator **substitutes** at create time along with every other placeholder. So in a generated repo the guard becomes `grep -q 'git.d-ma.be/mathias/<name>' go.mod`, and `go.mod` is `module git.d-ma.be/mathias/<name>` → **always matches** → `is_template=true` → `check`, `build`, and `deploy` all have `if: needs.guard.outputs.is_template != 'true'` → **all skip**. Net: every child repo's CI is **fake-green** — runs report success because all real jobs are skipped, nothing is ever built, tested, or deployed. Found in `cad-atlas` (runs 16–18 "green", but namespace/image/pod never existed). ## Fix Detect leftover placeholders by a pattern that is NOT itself substituted: ```yaml if grep -qE '__[A-Z_]+__' go.mod; then echo "is_template=true" >> "$GITHUB_OUTPUT" ``` Verified in cad-atlas: substituted repo → `is_template=false` (CI runs); raw `__PROJECT_NAME__` go.mod → `is_template=true` (skips). Applied there as a stopgap; the template is the real fix so future children aren't born with rubber-stamp CI. Sibling bugs from the same dogfooding pass: #8 (templ version skew + gitignore pattern).
Sign in to join this conversation.
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/template-go-web#9