clue

Document M-003 higher-score findings #69

	# The caller is deliberately small. The validation logic lives in Cliewen's
	# reusable workflow, so an adopter changes only this reference and the local
	# runner or binary-source choices when its repository policy requires it.
	# The reference is replaced with the binary's source commit when build VCS
	# metadata is available; a released module build falls back to its protected
	# release tag.
	name: clue

	on:
	pull_request:
	types: [opened, synchronize, reopened, edited, ready_for_review]
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	validate:
	name: validate
	uses: cliewen/cliewen/.github/workflows/clue-validation.yml@12ca1063247e60d7d241bd2a9f35c5f27849f122
	with:
	runner: '["ubuntu-latest"]'
	clue-version: 0.21.0
	# release rather than vendored: the binary is downloaded and its checksum
	# verified per run, so a multi-megabyte executable stays out of a repository
	# whose whole purpose is comparing robot behaviour. The version is pinned
	# exactly as generated and is never `latest`.
	clue-source: release
	clue-install-directory: ''
	# Safe only because the trigger list above includes ready_for_review:
	# that is what guarantees a strict run when a draft becomes a candidate.
	draft-aware: true

Navigation Menu