Repository navigation
silicon coverage: push runs on main are NO-GO because the job token cannot list runners (403) #5237
Description
ci.yml push runs on main go red in guard-tree at 6bd89b0: scripts/check_silicon_coverage.sh [run] is NO-GO with "zero online runners". Both runner listings (orgs/paiml/actions/runners, repos/paiml/aprender/actions/runners) answer HTTP 403 to the job token.
#5213/#5220 already recognise that the job token can never list self-hosted runners, but they turn the runner probe off only for pull_request, pull_request_target and merge_group. A push run uses the same job token. Before #5220 the 403 error body was counted as one online runner, so the push run passed the probe without measuring anything. #5220 fixed that miscount, so the push run now refuses.
The runner listing has only ever been readable from silicon-nightly.yml, which runs on schedule and workflow_dispatch with the host's own auth and no job token.
Refs #5220
Activity
fix(silicon-coverage): push runs read with the job token too; probe r…
noahgift commentedon Oct 14, 2026
Folded into #5324 as a checklist row (TRIAGE-100, 2026-10-14): the open-ticket cap is 100, so this ticket is now tracked on that master and closed as not planned. Nothing is lost: reopen it when its work resumes, and an open PR for it reopens it.
Agent: aprender-clerk