Repository navigation
ci(core): required verify job fails closed on fork PRs; bump Core pin (receipt summary) #520
Description
Problem
- The required check "Nexus Core issue completion" (
verifyjob in.github/workflows/nexus-core-issue-completion.yml) carries a job-levelif:that skips it for fork / cross-repository PRs. GitHub treats a skipped required check as passed, so a fork PR gets a green required check without the gate running (Consumers: required Core verify job is skipped (= success) on fork PRs nexus-core#265). - The Core receipt is invisible on the check run: empty
output, nobody reads the 67 KB artifact (issue-check / receipt-verify: publish a one-screen coverage summary to the check run nexus-core#273).
Change
verify:if: always(); first step fails closed withNEXUS_CORE_UNTRUSTED_EVENT/NEXUS_CORE_UNTRUSTED_PR_SOURCE(compares onlyhead.repo.full_name, neverhead.repo.fork) /NEXUS_CORE_ISSUER_NOT_SUCCESSFUL. Same as the merged nexus-core consumer example (fix(herdr): reconcile stale lifecycle and capacity safely (#256) #278).- Bump the nexus-core pin (issue-gate, receipt-verify, both
nexus-certify-ref) from3f3dc38to current nexus-core main, which adds the one-screen receipt summary (step summary + check-run annotation, Compute Fabric G1: stable local host identity + Host Capability Snapshot v1 #280), the runtime universe fail-closed (fix: terminate confirmed HerdR onboarding blocks #277) and the prefilled binding remedy (fix: reconcile active prepared replacement cutover (#242) #279).
Done when
A fork PR leaves "Nexus Core issue completion" red; same-repo PRs unchanged; the next PR after merge shows a Nexus Core receipt annotation on the Core checks.
Activity
github-actions commentedon Oct 16, 2026
Authority:
RESEARCH_OBSERVATION_ONLY / NO_ENGINEERING_AUTHORITYHybrid replication capture receipt
{ "body_gzip_base64": "H4sIAAAAAAACA31UTXPaMBC98yt2wgUodj5okzQ5NcT9HsJg6PSGhL3GKrLkSDKEf9+VgIZk2h58sHf37e57b91uw9johcSqdR7DtEQw+NgIgzlkJWYrOBnhU2NhqA2CsLZByHRVS3RCqxPosDUaUWwZ/NILEApYvBSubBanG21WhdQbe6o8QJQRQBQAomeAeFtJ1oWMGyPQAvcokcQ1SmCiuGHgSu6g17MrUdteD4SDQhv/rOAUMqOtjQzW2gqnzRbGExvDJ+E+NwtwBrnzkL62pnVe7cUt1NxazPtgNaUFzPEElhiqlgZRva7Z0Gq6cTQVwpI74qpRSqgldL7yCu3g7Pzt0bbti8t33bh1saM1EGgwQ1E7IpK4WgsriHjQKgDuWhDiDWBVuy0walU3jvVB6YXOt1TNcxtyL6/g2x1w40TBM/ev9lcDat9qt2FYcrXEVgQHtW4CvcDlhm9tp8tuoRDGOrAOayi4kBYyqYmcsDKwUfJzls6HD5NkPhtNJ7N0mtzPkx/JaMpIh7+Hx5N5+jCbDBMGHa84N6SwVpIWK2mR2OsWF42Uc0XT+y1Jd/MiSJKQO142+JKms2QyHz1M5+lsOEzS9OPsO4shJRAvqqenQrOk2Z+5IM8q29BnwCfuzQcdouea6IngrqnqUHWUXpOTOzuzep37B+GiHX99WGhPy74CvQ5bMmJB0xZGV8AGxSDPBtdkYA1ZYwwqd4xfcaH6sClFVgLP96JqhZHN9r7b+YRmrjgZuxOEOby92XklIq8AV0o77m+pD+2L67NuP2BRyAkipFGCRrYYRI32mvrdr7pUmofcmgYXUlJgIVTu7WywQvKbz3u/t9A9TUcDo2p9+HMqEvmaNP3/H4Ku5xYsiRMO1Z8oDZUFQ1Jgz7vzcLxwJFDQDmxJfw46Q3aEvSeFHe18uJ0QD6TYuPUbsibBO9MEAAA=", "capture_sha256": "b0609377670369ddfa9884547ca5dbc7256c71620620d91d8864eae0ab484a2a", "captured_at": "2026-10-16T00:46:34Z", "contract_sha256": "c0fbcca25e39f0febee04a02435466b82209888ae6da2a832f67048c49712a4d", "created_at": "2026-10-16T00:46:25Z", "default_branch": "main", "issue_number": 520, "issue_updated_at": "2026-10-16T00:46:25Z", "pre_implementation_revision": "001d163e1411d92cfc064dc7326687ce1f8e10a7", "repository": "James3014/devspace", "schema": "nexus.hybrid_replication.capture.v1", "source_event_id": "actions:38831393200:1", "title": "ci(core): required verify job fails closed on fork PRs; bump Core pin (receipt summary)" }github-actions commentedon Oct 16, 2026
Authority:
RESEARCH_OBSERVATION_ONLY / NO_ENGINEERING_AUTHORITY{ "activation_boundary": "2026-10-13T04:05:51Z", "activation_state": "AUTOMATIC_CAPTURE_READY", "admitted_at": "2026-10-16T00:46:34Z", "capture_sha256": "b0609377670369ddfa9884547ca5dbc7256c71620620d91d8864eae0ab484a2a", "disposition": "CROSS_REPO_SCOPE_GAP", "exclusion_set_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "implementation_pr_numbers": [], "issue_state_at_admission": "open", "receipt_sha256": "2f70ec7f2c2c12cf41506e982dad3eb67e681f7d8e8aa2100e348a1ea62a3a85", "schema": "nexus.hybrid_replication.admission.v1", "task_key": "James3014/devspace#520", "tracked_parent_created_at": null, "tracked_parent_issue_number": null }ci(core): required verify job fails closed on fork PRs; bump nexus-co…