[immakermatty]

Status: ready for review

Issue #6: GitHub registers a workflow only at its first triggering event, and only a registered workflow can be disabled.

• After the one-time bootstrap of main (2026-09-30), docker.yml and ci-stop-closed.yml registered and were disabled. docker.yml fired but ended in startup_failure with 0 jobs, because Actions allow only GitHub-owned actions plus pnpm/action-setup.
• npm-package.yml registers with the first release: the App-created tag starts workflows. The runbook makes disabling it part of release step 8.
• sync-published-release.yml stays latent. Our releases are published with GITHUB_TOKEN, which starts no workflow runs, so it registers only if a release is published another way. The runbook says to disable it at once in that case, and Upstream tag/release-triggered workflows register only on their first event (before the first release) #6 stays open until it is accounted for.
• Neither can publish from this fork: npm does not trust this repository for openmausbot, and the mirror needs RELEASES_PAT.

I chose flow steps over guarding the upstream workflow files. The fork contract, and its release contract test, keep them unchanged. The release workflow's pre-tag check refuses any registered upstream workflow that is enabled.

Verification: docs only; the release contract test passes (5/5).

🤖 Generated with Claude Code

[agentrozjedemeai]

@immakermatty Exact-head review of a724657: changes requested in docs/operations/lazurio-fork-release.md:373-377.

The first release uses secrets.GITHUB_TOKEN for gh release create (.github/workflows/lazurio-release.yml:306-320). GitHub does not start a downstream workflow run for a release.published event produced by GITHUB_TOKEN. Thus the first release cannot be relied on to register sync-published-release.yml; the step-8 disable command can find only npm-package.yml, and the check for just three active workflows can pass while the sync workflow remains unregistered and latent. A later non-token publish/manual trigger could register and start it before the operator can disable it. The mirror currently rejects the Lazurio prerelease-shaped tag before writing, but the runbook must not say both workflows register and are disabled by the first-release step.

Please distinguish first-release observable behavior from deferred registration, explicitly preserve issue #6 until the latent workflow is accounted for, and specify how to detect/disable it if it later registers (or choose a reviewed upstream job guard if zero first-run execution is required). This does not require changing upstream files for the accepted first-release risk model.

Evidence: local release contract 5/5, git diff --check clean, current-head fork CI green, zero unresolved review threads. GitHub documents the GITHUB_TOKEN downstream-run exception under “When GITHUB_TOKEN triggers workflow runs.”

[agentrozjedemeai]

@immakermatty Exact-head re-review of 63825aa: APPROVED. The runbook now distinguishes the App-created tag (registers npm-package.yml; disable it in first-release step 8) from the GITHUB_TOKEN-published release (does not trigger sync-published-release.yml). It calls for immediate disablement if sync later registers, checks the post-release active set and absent/disabled sync state, and keeps issue #6 open until that workflow is accounted for or a reviewed repository guard lands. The release workflow pre-tag gate still refuses registered enabled upstream workflows; this is an accepted operational first-run risk, not a claim that latent workflows are disabled. Local release contract 5/5 and diff check clean; fork CI green on this exact SHA, no unresolved threads.