Grouping issue, filed as part of a catalog pass over the 2026-08-28 to 2026-08-31 resync and MTP conversion campaign. This issue records the shared cause and adopts the affected issues as sub-issues. It proposes no fix.
The shared cause
WORKFLOW.md and the workflow tasks it describes were written when every reusable workflow was a same-repository ./.github/workflows/... call. The hub-hosted migration changes that call to ptr727/ProjectTemplate/.github/workflows/...@<sha>, and a cross-repository workflow_call is not the same thing with a longer path. It changes the workflow's identity in an OIDC claim, it changes what secrets: inherit hands over, and it changes which commit a bare actions/checkout gets. Each child is one of those three, and none of them was restated when the call site moved.
Identity. #1126 records the first real publish from ptr727/Utilities after it adopted build-release-task.yml failing token exchange at NuGet.org, because job_workflow_ref names the hub's workflow rather than the publishing repository's, and NuGet validates that claim against the repository the package belongs to. The build succeeded with 0 errors and every later job skipped, so the run published nothing.
Secrets. #1114 finds WORKFLOW.md D1.6 stating that CODECOV_TOKEN reaches the validator via secrets: inherit, where docs/reusable-workflows.md and the live ptr727/PhotoCleaner pilot both map it explicitly. On a cross-repository call inherit passes the caller's whole secret store to the called workflow, which for ptr727/Utilities is four secrets where the validator declares one optional.
Ref. #1134 finds validate-task.yml declaring no ref input, with every actions/checkout in it bare. A publisher that pins the commit it releases, which is D4.6 and D4.2, cannot use it: keeping the input fails workflow_call validation, dropping it silently validates the caller's default ref. ptr727/PlexCleaner is the last repository carrying its own copy, and this is what stands between it and deleting that copy.
Children
| Issue |
What the cross-repository call changed |
| #1126 |
The OIDC job_workflow_ref claim, breaking NuGet trusted publishing |
| #1114 |
What secrets: inherit hands over, and the doc says the opposite of every other surface |
| #1134 |
Which commit a bare actions/checkout gets, plus root-relative Python detection and a missing coverage assertion |
What a fix at this level would have to address
The three fixes are independent and mostly small. What is not small is the question they raise together: which statements in WORKFLOW.md and the task files silently assumed a same-repository call, and whether any of them remain unreviewed. #1126 in particular may not be fixable at the task level at all, since the claim identifies the reusable workflow the job actually ran from.
Grouping issue, filed as part of a catalog pass over the 2026-08-28 to 2026-08-31 resync and MTP conversion campaign. This issue records the shared cause and adopts the affected issues as sub-issues. It proposes no fix.
The shared cause
WORKFLOW.mdand the workflow tasks it describes were written when every reusable workflow was a same-repository./.github/workflows/...call. The hub-hosted migration changes that call toptr727/ProjectTemplate/.github/workflows/...@<sha>, and a cross-repositoryworkflow_callis not the same thing with a longer path. It changes the workflow's identity in an OIDC claim, it changes whatsecrets: inherithands over, and it changes which commit a bareactions/checkoutgets. Each child is one of those three, and none of them was restated when the call site moved.Identity. #1126 records the first real publish from ptr727/Utilities after it adopted
build-release-task.ymlfailing token exchange at NuGet.org, becausejob_workflow_refnames the hub's workflow rather than the publishing repository's, and NuGet validates that claim against the repository the package belongs to. The build succeeded with 0 errors and every later job skipped, so the run published nothing.Secrets. #1114 finds
WORKFLOW.mdD1.6 stating thatCODECOV_TOKENreaches the validator viasecrets: inherit, wheredocs/reusable-workflows.mdand the live ptr727/PhotoCleaner pilot both map it explicitly. On a cross-repository callinheritpasses the caller's whole secret store to the called workflow, which for ptr727/Utilities is four secrets where the validator declares one optional.Ref. #1134 finds
validate-task.ymldeclaring norefinput, with everyactions/checkoutin it bare. A publisher that pins the commit it releases, which is D4.6 and D4.2, cannot use it: keeping the input failsworkflow_callvalidation, dropping it silently validates the caller's default ref. ptr727/PlexCleaner is the last repository carrying its own copy, and this is what stands between it and deleting that copy.Children
job_workflow_refclaim, breaking NuGet trusted publishingsecrets: inherithands over, and the doc says the opposite of every other surfaceactions/checkoutgets, plus root-relative Python detection and a missing coverage assertionWhat a fix at this level would have to address
The three fixes are independent and mostly small. What is not small is the question they raise together: which statements in
WORKFLOW.mdand the task files silently assumed a same-repository call, and whether any of them remain unreviewed. #1126 in particular may not be fixable at the task level at all, since the claim identifies the reusable workflow the job actually ran from.