Fix: Name the repository on every Gerrit checkout

[ModeSevenIndustrialSolutions]

Summary

Fixes a defect that has failed every ONAP patchset check since the
migration landed. My error in #6.

Root cause

checkout-gerrit-change-action declares:

  repository:
    description: "Repository name with owner. For example actions/checkout"
    required: false
    default: ${{ github.repository }}

Inside a reusable workflow, github.repository names the caller, not the
project under review. All four Gerrit checkout steps omitted repository:, so
a central .github repository calling on behalf of another project seeded the
working tree from itself, then looked for the project's branch there:

/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --depth=1 \
  origin +refs/heads/master:refs/remotes/origin/master
Error: fatal: couldn't find remote ref refs/heads/master

onap/.github carries main, not master, so the fetch could never resolve.

Had the branch names happened to match, the checkout would have succeeded
against the wrong repository — the worse outcome, since the audit would then
have reported on the caller's content.

Impact measured

Lane	Runs since migration	Result
ONAP bypassable verify	8	8 failures
ONAP required merge	40	40 success
O-RAN-SC verify	0 on the new workflow	latent

The merge lane escaped because it passes no gerrit_refspec and so takes the
plain checkout, which already named the repository. Only the Gerrit path was
wrong, and only for a caller that is not the project.

The fix

All four Gerrit checkouts now pass the same expression the plain checkouts
already used:

   delay: '0s'
+  repository: ${{ inputs.repository || github.repository }}
   ref: refs/heads/${{ inputs.gerrit_branch }}

Three sites in docs-build.yaml, one in docs-audit.yaml. The input already
existed and ONAP already supplied it; the value was simply discarded.

Why the tests missed it

The pattern came from python-workflows, where a project calls the workflow
from its own repository, so the default is correct there. That assumption does
not hold for a central caller, and nothing covered the distinction —
testing.yaml calls by local path, where caller and project coincide.

Reproducing properly needs a live Gerrit change ref, which a test workflow
cannot manufacture. So the guard checks the shape instead: it counts checkout
steps against repository inputs in both workflows and fails when they
disagree.

Verified it catches the exact regression:

$ # with one repository input removed
regressed file: gerrit=3 plain=3 named=5 expected=6
  GUARD CATCHES IT ✅

Verification

Check	Result
prek run --all-files	All hooks pass
zizmor --persona auditor	No findings
Guard against current files	Passes (6/6 and 2/2)
Guard against reintroduced bug	Fails, as intended

Follow-up

Needs a v0.0.2 tag, then a pin bump in onap/.github and o-ran-sc/.github.

[Copilot]

Pull request overview

Fixes Gerrit checkouts in reusable documentation workflows so they target the repository under review rather than the calling repository.

Changes:

• Passes the repository input to all four Gerrit checkout steps.
• Adds a CI guard requiring explicit repository inputs for workflow checkouts.
• Includes the guard result in the aggregate test outcome.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/docs-build.yaml	Names the repository in three Gerrit checkouts.
.github/workflows/docs-audit.yaml	Names the repository in the audit Gerrit checkout.
.github/workflows/testing.yaml	Adds and reports the checkout-input guard.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.