mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-24 16:54:43 +00:00
957ea640de
* fix(ci): publish inline E2E evidence Upload bounded screenshot evidence from E2E, then publish validated images from a trusted workflow_run job to commit-pinned branches in the evidence repo. Wait briefly for the live CI review comment marker before publishing, so GitHub's read-after-write delay cannot leave an orphaned evidence branch. * fix(ci): isolate privileged credentials from PR jobs Keep App private keys and Docker Hub credentials out of PR-controlled workflows. Use protected environments for trusted publishing and a public repository variable for the App client ID. * fix(ci): attach E2E evidence with restricted bot session Replace the App-backed evidence repository publisher with gh-image uploads from a dedicated bot session in the gh-image environment. * fix(ci): publish validated E2E evidence from forks Let the trusted default-branch publisher handle bounded, validated evidence artifacts from fork PR CI without checking out or executing fork code. |
||
|---|---|---|
| .. | ||
| ci.yml | ||
| contributor-check.yml | ||
| deploy-site.yml | ||
| docker-lint.yml | ||
| docker.yml | ||
| docs-site-checks.yml | ||
| e2e-desktop.yml | ||
| history-check.yml | ||
| js-autofix.yml | ||
| js-tests.yml | ||
| label-rerun.yml | ||
| lint.yml | ||
| lockfile-diff.yml | ||
| osv-scanner.yml | ||
| publish-e2e-evidence.yml | ||
| review-labels.yml | ||
| skills-index-freshness.yml | ||
| skills-index.yml | ||
| supply-chain-audit.yml | ||
| tests.yml | ||
| uv-lockfile-check.yml | ||