--- registry secretsMap per trigger
--- build_finished registry mapping and defaults
--- buildFinished maps to an unguarded event with literal argv and only its own secrets
--- buildFinished defaults grant no secrets and append no revision
--- buildFinished missing declared secret fails before the program runs
error: CLOUDFLARE_API_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- buildFinished missing forge token fails before the program runs
error: GITHUB_FORGE_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- main execs the program with --rev and its secrets
CI-RUN-CONTEXT: branch=main is_main=true
--- main on a non-main token is skipped
EFFECT-GUARD: skipping outside a push to main (event=push ref=refs/heads/gitea-mq/batch/7)
--- main on a pull_request token is skipped
EFFECT-GUARD: skipping outside a push to main (event=pull_request ref=)
--- main without the id-token endpoint is refused
EFFECT-GUARD: NIXBOT_ID_TOKEN_REQUEST_URL and NIXBOT_ID_TOKEN_REQUEST_TOKEN are required; declare idTokenAudiences on the effect
--- main whose id-token fetch fails is refused
EFFECT-GUARD: failed to obtain an id token from nixbot
--- missing secret fails before the program runs
CI-RUN-CONTEXT: branch=main is_main=true
error: GITHUB_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- null secret fails before the program runs
CI-RUN-CONTEXT: branch=main is_main=true
error: GITHUB_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- pullRequest runs unguarded, without --rev, with the forge token
--- missing forge token fails before the program runs
error: GITHUB_FORGE_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- pullRequestClosed runs unguarded, without --rev, without the forge token
--- missing secret fails a pullRequestClosed run before the program runs
error: CLOUDFLARE_API_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- pullRequest never receives the main trigger's secrets
--- main never receives the pullRequest trigger's secrets or forge token
CI-RUN-CONTEXT: branch=main is_main=true
--- registry: release-packages pullRequest runs the plan with the forge token and never GITHUB_TOKEN
--- registry: release-packages pullRequest without the forge token fails before the program runs
error: GITHUB_FORGE_TOKEN missing from $HERCULES_CI_SECRETS_JSON
--- registry: release-packages main receives GITHUB_TOKEN and not the forge token
CI-RUN-CONTEXT: branch=main is_main=true
--- registry: docs pullRequestClosed receives Cloudflare and not the forge token
--- registry: browser-evidence buildFinished uploads with the R2 secrets and nixbot's API token, without --rev
--- registry: browser-evidence buildFinished without an R2 secret fails before the program runs
error: R2_EVIDENCE_ACCESS_KEY_ID missing from $HERCULES_CI_SECRETS_JSON
--- registry: browser-evidence pullRequest uploads with the R2 secrets and nixbot's API token, without --rev
--- registry: browser-evidence pullRequest without an R2 secret fails before the program runs
error: R2_EVIDENCE_ACCESS_KEY_ID missing from $HERCULES_CI_SECRETS_JSON
--- registry: browser-evidence main appends --rev and receives the R2 secrets and nixbot's API token
CI-RUN-CONTEXT: branch=main is_main=true