From 559da1813244abc0f0c694dedbbed47a4017e9b2 Mon Sep 17 00:00:00 2001
From: ethernet <arilotter@gmail.com>
Date: Fri, 4 Sep 2026 04:05:42 -0400
Subject: [PATCH] =?UTF-8?q?fix(ci):=20move=20runner.temp=20job-env=20to=20?=
 =?UTF-8?q?step=20level=20=E2=80=94=20graph=20dispatch=20killer?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bootstrap-installer.yml declared job-level env with ${{ runner.temp }},
which GitHub only allows at step level. Any ci.yaml dispatch validated
the whole reusable-workflow graph incl. this callee and failed with
0 jobs (invisible silent failure — no jobs, no logs). Our merge wired
this lane into ci.yaml, surfacing the latent bug. Actionlint flagged it;
moved INSTALL_DIR/HERMES_HOME/HERMES_RUNTIME_DIR to the steps that use
them.
---
 .github/workflows/bootstrap-installer.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bootstrap-installer.yml b/.github/workflows/bootstrap-installer.yml
index 3e9a00846f..44efc2b5d0 100644
--- a/.github/workflows/bootstrap-installer.yml
+++ b/.github/workflows/bootstrap-installer.yml
@@ -26,10 +26,9 @@ jobs:
     name: install.sh sandbox install + stamp verification
     runs-on: ubuntu-24.04
     timeout-minutes: 15
-    env:
-      INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
-      HERMES_HOME: ${{ runner.temp }}/hermes-home
-      HERMES_RUNTIME_DIR: ${{ runner.temp }}/hermes-tools
+    # NOTE: `runner.temp` is only available in step-level env, not job-level
+    # env — a job-env `${{ runner.temp }}` makes GitHub reject the workflow
+    # graph at dispatch (0 jobs). Each step that needs these exports them.
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -68,6 +67,9 @@ jobs:
       - name: Run the installer stages against the PR checkout
         shell: bash
         env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
+          HERMES_HOME: ${{ runner.temp }}/hermes-home
+          HERMES_RUNTIME_DIR: ${{ runner.temp }}/hermes-tools
           HERMES_REPO_URL: ${{ steps.source.outputs.mirror }}
         run: |
           set -euo pipefail
@@ -91,6 +93,8 @@ jobs:
 
       - name: Verify the shipped version stamp
         shell: bash
+        env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
         run: |
           python3 scripts/verify-bootstrap-version-stamp.py \
             --stamp "$INSTALL_DIR/.hermes-bootstrap-complete" \
@@ -100,6 +104,8 @@ jobs:
 
       - name: The pinned commit is on the branch the installer cloned
         shell: bash
+        env:
+          INSTALL_DIR: ${{ runner.temp }}/bootstrap-install
         run: |
           # The stamp must describe the bytes actually checked out: the
           # installed repo's HEAD is exactly the commit the installer pinned.