Merge pull request #9 from baskduf/fix/ci-fable-source-fetch

baskduf · web-flow · commit 8ef46e76e284 · 2026-06-18T15:51:14.000+09:00
ci: fix pinned FABLE source fetch
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -42,18 +42,14 @@ jobs:
           sh -n plugins/codex-fable5/bin/codex-goals
 
       - name: Fetch pinned FABLE-5 source
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           mkdir -p build/fable5
           # The pin lives in the coverage matrix's preamble. Hardcode the
           # commit SHA from the matrix's source note for explicit traceability.
           PIN="dc626fed52b06d687cdc812d51090c95ed03d575"
           curl -fsSL \
-            -H "Authorization: Bearer ${GH_TOKEN}" \
-            -H "Accept: application/vnd.github.raw" \
-            "https://api.github.com/repos/elder-plinius/CL4R1T4S/contents/ANTHROPIC/CLAUDE-FABLE-5.md?ref=${PIN}" \
+            "https://raw.githubusercontent.com/elder-plinius/CL4R1T4S/${PIN}/ANTHROPIC/CLAUDE-FABLE-5.md" \
             -o build/fable5/CLAUDE-FABLE-5.md
           # Sanity check: file must contain a Fable 5 marker.
           grep -q "Fable 5" build/fable5/CLAUDE-FABLE-5.md \
diff --git a/tests/test_scripts.py b/tests/test_scripts.py
@@ -293,6 +293,24 @@ def test_ci_workflow_validates_against_pinned_source(self) -> None:
         workflow = (ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8")
         self.assertIn("CLAUDE-FABLE-5.md", workflow)
         self.assertIn("elder-plinius/CL4R1T4S", workflow)
+        fetch_step = re.search(
+            r"      - name: Fetch pinned FABLE-5 source\n(?P<body>.*?)(?:\n      - name: |\Z)",
+            workflow,
+            re.DOTALL,
+        )
+        self.assertIsNotNone(fetch_step, "CI workflow must define the pinned source fetch step")
+        assert fetch_step is not None  # for type checkers
+        fetch_step_body = fetch_step.group("body")
+        self.assertIn(
+            "raw.githubusercontent.com/elder-plinius/CL4R1T4S/${PIN}/ANTHROPIC/CLAUDE-FABLE-5.md",
+            fetch_step_body,
+            "CI should fetch the public pinned source directly, matching the release checklist",
+        )
+        self.assertNotIn(
+            "Authorization: Bearer",
+            fetch_step_body,
+            "CI source fetch should not rely on a hand-built Authorization header; malformed quoting can hide curl failures",
+        )
         pin_match = re.search(r'PIN="([0-9a-f]{40})"', workflow)
         self.assertIsNotNone(pin_match, "CI workflow must define the pinned upstream SHA")
         assert pin_match is not None  # for type checkers
