No token needed: every yukart repo is public; document the caller's runs-on

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
2026-10-13 00:38:27 +09:00
parent 2b902b12d9
commit 93e198f85e
2 changed files with 9 additions and 3 deletions
@@ -37,6 +37,13 @@ fails that push's run: the commit that made two repos disagree is the one marked
 A new repo is checked as soon as it exists in the org; it needs the caller only to
 trigger checks on its own pushes.

+- ⚠ **The caller must say `runs-on: flutter-android`.** Gitea hands a reusable-workflow
+  call to a runner chosen by the *caller's* `runs-on`; the called workflow's own is not
+  consulted for that. Without it, the instance-wide `pi5-runner` on the Gitea host takes
+  the job, and its jobs see the server as `http://gitea:3000`, which does not resolve.
+- All yukart repos are public, so cloning needs no token. A private one would need a
+  read-only org secret `YUKART_READ_TOKEN`, which the workflow already uses if set.
+
 ## Adding to it

 - **A false positive** is fixed in the rule, not silenced per line. Shapes that look