From f4065d1b168ce13fb9b7842fc0f202302f0585d7 Mon Sep 17 00:00:00 2001
From: Brian Charbonneau <github@briancharbonneau.com>
Date: Sat, 1 Aug 2026 18:56:34 -0700
Subject: [PATCH] fix(ci): pass repository to release lifecycle commands

Signed-off-by: Brian Charbonneau <github@briancharbonneau.com>
---
 .github/workflows/private-ca-release.yml    | 20 ++++++++++----------
 scripts/test-private-ca-release-contract.sh |  3 +++
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/private-ca-release.yml b/.github/workflows/private-ca-release.yml
index 459c8119fd..b6279c8b4e 100644
--- a/.github/workflows/private-ca-release.yml
+++ b/.github/workflows/private-ca-release.yml
@@ -94,8 +94,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          gh issue comment "${{ github.event.issue.number }}" --body "Skipped by @BrianInAz; no private-CA package was built."
-          gh issue close "${{ github.event.issue.number }}"
+          gh issue comment "${{ github.event.issue.number }}" --repo "${GITHUB_REPOSITORY}" --body "Skipped by @BrianInAz; no private-CA package was built."
+          gh issue close "${{ github.event.issue.number }}" --repo "${GITHUB_REPOSITORY}"
 
   built:
     if: >-
@@ -112,9 +112,9 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           set -euo pipefail
-          body="$(gh issue view "${ISSUE_NUMBER}" --json body --jq .body)"
+          body="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body --jq .body)"
           grep -Eq '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}" || { echo "not a clean monitor-created ticket" >&2; exit 1; }
-          gh issue comment "${ISSUE_NUMBER}" --body "Built by @BrianInAz on the approved Apple Silicon Mac. Record the immutable artifact, checksum, private WSS gate, and local acceptance evidence before adding \`accepted\`."
+          gh issue comment "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "Built by @BrianInAz on the approved Apple Silicon Mac. Record the immutable artifact, checksum, private WSS gate, and local acceptance evidence before adding \`accepted\`."
 
   accepted:
     if: >-
@@ -131,12 +131,12 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           set -euo pipefail
-          body="$(gh issue view "${ISSUE_NUMBER}" --json body --jq .body)"
+          body="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body --jq .body)"
           grep -Eq '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}" || { echo "not a clean monitor-created ticket" >&2; exit 1; }
-          labels="$(gh issue view "${ISSUE_NUMBER}" --json labels --jq '.labels[].name')"
+          labels="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json labels --jq '.labels[].name')"
           grep -Fxq built <<<"${labels}" || { echo "accepted requires the built lifecycle state" >&2; exit 1; }
-          gh issue comment "${ISSUE_NUMBER}" --body "Accepted by @BrianInAz after private WSS, state-preserving install, restart, reconnect, and history-restoration evidence was recorded."
-          gh issue close "${ISSUE_NUMBER}"
+          gh issue comment "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "Accepted by @BrianInAz after private WSS, state-preserving install, restart, reconnect, and history-restoration evidence was recorded."
+          gh issue close "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}"
 
   approval:
     if: >-
@@ -158,7 +158,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           set -euo pipefail
-          body="$(gh issue view "${ISSUE_NUMBER}" --json body --jq .body)"
+          body="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body --jq .body)"
           marker="$(grep -E '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}")"
           [[ -n "${marker}" ]] || { echo "not a clean monitor-created ticket" >&2; exit 1; }
           tag="$(sed -E 's/.*tag=([^ ]+).*/\1/' <<<"${marker}")"
@@ -218,4 +218,4 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          gh issue comment "${{ needs.approval.outputs.issue_number }}" --body "Remote validation passed. Package on the approved local Mac with scripts/build-private-ca-macos.sh ${{ needs.approval.outputs.tag }} ${{ needs.approval.outputs.source_sha }}. GitHub-hosted macOS runners are intentionally not used."
+          gh issue comment "${{ needs.approval.outputs.issue_number }}" --repo "${GITHUB_REPOSITORY}" --body "Remote validation passed. Package on the approved local Mac with scripts/build-private-ca-macos.sh ${{ needs.approval.outputs.tag }} ${{ needs.approval.outputs.source_sha }}. GitHub-hosted macOS runners are intentionally not used."
diff --git a/scripts/test-private-ca-release-contract.sh b/scripts/test-private-ca-release-contract.sh
index b2a7785647..4fc3e59a02 100755
--- a/scripts/test-private-ca-release-contract.sh
+++ b/scripts/test-private-ca-release-contract.sh
@@ -52,6 +52,9 @@ require "github.event.label.name == 'built'"
 require "github.event.label.name == 'accepted'"
 require 'accepted requires the built lifecycle state'
 require 'not a clean monitor-created ticket'
+require "gh issue view \"\${ISSUE_NUMBER}\" --repo \"\${GITHUB_REPOSITORY}\""
+require "gh issue comment \"\${ISSUE_NUMBER}\" --repo \"\${GITHUB_REPOSITORY}\""
+require "gh issue close \"\${ISSUE_NUMBER}\" --repo \"\${GITHUB_REPOSITORY}\""
 
 forbid 'BUZZ_TEST_WSS_URL'
 forbid 'buzz.bjzy.me'