[LukasAud]

Summary

Replaces #402 with the same end result and a clean 2-commit history (identical final diff, verified — #402 accumulated some since-corrected mistakes across iterative review rounds that don't need to stay in permanent history). The Puppet-8-nightly-CI fixes that were bundled into #402 are split out to #404, since they're an unrelated, pre-existing problem.

• Fork PRs don't receive secrets (e.g. PUPPET_FORGE_TOKEN, CODECOV_TOKEN) via the normal pull_request trigger, so CI silently skips secret-dependent steps for external contributors.
• Adds pr_number/ref inputs to the existing workflow_dispatch trigger, plus a resolve-ref job that resolves either into an immutable commit SHA (or empty string, meaning "no override, behave exactly as before").
• For pr_number, resolves the PR's merge commit SHA (not the mutable refs/pull/<n>/merge ref, and not the raw head SHA) via the GitHub API, failing explicitly if the PR isn't mergeable yet or has conflicts — this matches the normal pull_request trigger's test semantics while staying immutable across job boundaries, since spec and acceptance check out independently and acceptance only starts once spec finishes (a mutable ref could let a fork author push a new, unreviewed commit in that window and have it silently execute with secrets in scope).
• Threads that SHA into the spec job (gem_ci.yml@main, which gained a ref input in Add optional ref input to gem_ci and gem_acceptance cat-github-actions#191) and the acceptance job (the repo-local custom_acceptance.yml, which needed the same ref input added since it isn't one of the shared cat-github-actions workflows).
• workflow_dispatch is already gated to users with repo write access — that's the trust boundary. No label/approval system layered on top, intentionally lightweight for this low-traffic tool repo.

Test plan

• Dispatch ci manually with ref set to a branch/SHA and confirm spec/acceptance check out that ref
• Dispatch ci manually with pr_number set to a fork PR and confirm both jobs run against the resolved merge commit SHA with secrets available
• Confirm normal push/pull_request runs on main are unaffected (ref input is empty, behaving exactly as before)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.98%. Comparing base (7d33bd2) to head (683c8fb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #405   +/-   ##
=======================================
  Coverage   88.98%   88.98%           
=======================================
  Files           6        6           
  Lines         853      853           
=======================================
  Hits          759      759           
  Misses         94       94           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gavindidrichsen]

LGTM