yadflow 2.4.1 → 2.4.2

package/CHANGELOG.md

@@ -1,9 +1,9 @@
-## [2.4.1](https://github.com/abdelrahmannasr/yadflow/compare/v2.4.0...v2.4.1) (2026-06-14)
+## [2.4.2](https://github.com/abdelrahmannasr/yadflow/compare/v2.4.1...v2.4.2) (2026-06-14)
 
 
 ### Bug Fixes
 
-* migrate pre-2.0 sdlc-* skills during `yad setup` ([5b53e40](https://github.com/abdelrahmannasr/yadflow/commit/5b53e40480b3049d4efc596792f2630597d837fd))
+* route GitLab CI gate jobs to tag-locked runners via $YAD_RUNNER_TAGS ([a0311c5](https://github.com/abdelrahmannasr/yadflow/commit/a0311c5af647f63968f3f34e8e6e6fa48b7423d8)), closes [#50](https://github.com/abdelrahmannasr/yadflow/issues/50)
 
 # [2.2.0](https://github.com/abdelrahmannasr/yadflow/compare/v2.1.0...v2.2.0) (2026-06-14)
 

package/cli/doctor.mjs

@@ -162,9 +162,43 @@ export function projectChecks(checks, root) {
     }
     if (!registry.repos.length) check(checks, 'repos', 'project', 'warn', 'no code repos registered', 'run `yad setup` to connect one');
   }
+
+  ciTagsChecks(checks, root, hub, registry);
   return { hub, registry };
 }
 
+// GitLab CI runner tags: the wired fragments run docker-image jobs. On instances whose runners are
+// all tag-locked (run_untagged: false), an untagged image job matches no runner and sits `pending`
+// forever — silently blocking the gates (issue #50). A current fragment carries
+// `tags: [$YAD_RUNNER_TAGS]`; warn on any wired GitLab fragment that sets an `image:` but has no
+// `tags:` (an old install, or one hand-reverted by a sync). Pure local read — no API calls.
+export function ciTagsChecks(checks, root, hub, registry) {
+  const untagged = (p) => {
+    try {
+      const txt = fs.readFileSync(p, 'utf8');
+      return /^\s*image:/m.test(txt) && !/^\s*tags:/m.test(txt);
+    } catch { return false; } // absent fragment is not this check's concern
+  };
+  const fragments = [];
+  if (hub?.platform === 'gitlab' && (hub.bridge_enabled === true || hub.bridge === true)) {
+    fragments.push(
+      { scope: 'hub', file: '.gitlab/ci/yad-gate-sync.yml', path: path.join(root, '.gitlab/ci/yad-gate-sync.yml') },
+      { scope: 'hub', file: '.gitlab/ci/yad-verified-commits.yml', path: path.join(root, '.gitlab/ci/yad-verified-commits.yml') },
+    );
+  }
+  for (const repo of registry?.repos || []) {
+    if (repo.platform !== 'gitlab' || !repo.path) continue;
+    fragments.push({ scope: repo.name, file: '.gitlab/ci/yad-checks.yml', path: path.join(path.resolve(root, repo.path), '.gitlab/ci/yad-checks.yml') });
+  }
+  for (const f of fragments) {
+    if (untagged(f.path)) {
+      check(checks, `ci-tags:${f.scope}`, 'project', 'warn',
+        `${f.scope}: ${f.file} runs a docker job with no \`tags:\` [YAD-CI-001]`,
+        'tag-locked runners (run_untagged: false) will strand it at `pending` — run `yad update`, then set the `YAD_RUNNER_TAGS` CI/CD variable');
+    }
+  }
+}
+
 export function epicChecks(checks, root) {
   const epicsDir = path.join(root, 'epics');
   if (!exists(epicsDir)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yadflow",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "Yadflow — the gated, team, multi-repo SDLC: author → review → build with a PR-driven review gate and a zero-dependency `yad` CLI (setup, gate, commit, open-pr, repo). A BMAD module + 22 yad-* skills.",
   "type": "module",
   "author": "AbdelRahman Nasr",

package/skills/yad-checks/SKILL.md

@@ -88,6 +88,13 @@ Copy from this skill's `templates/`:
     human to paste (graceful degradation — never guess-edit a pipeline you cannot parse).
   - The legacy standalone `templates/gitlab/.gitlab-ci.yml` is retained only for a clean greenfield repo
     that prefers a single self-contained file; the include path above is the default.
+  - **Tag-locked runners** (`run_untagged: false`, common on self-hosted): the fragment's jobs run a
+    docker image, so set a `YAD_RUNNER_TAGS` CI/CD variable (e.g. `dind_runner`) to route them — the
+    `default:` block emits `tags: [$YAD_RUNNER_TAGS]`. When unset, current GitLab (≥15) drops the
+    empty-expanded tag so the jobs run untagged (gitlab.com shared runners); older versions may
+    strand them `pending`, in which case set the variable to a real tag. The variable lives in
+    project settings, so it survives every `yad` sync. Single value only — `tags: [$VAR]` is one tag
+    equal to the whole variable, not a comma-split.
 
 - Ensure `<repo>/package.json` defines `lint`, `build`, `test` scripts (see `references/check-gates.md`
   for the canonical scripts). **Only ADD a missing script; never overwrite an existing one.**

package/skills/yad-checks/templates/gitlab/yad-checks.gitlab-ci.yml

@@ -11,6 +11,14 @@
 # colliding with the host project's own job names.
 default:
   image: node:20
+  # Runner selection. These jobs need a docker/dind executor; on instances whose runners are all
+  # tag-locked (run_untagged: false) an untagged image job never starts. Set the YAD_RUNNER_TAGS
+  # CI/CD variable (Settings → CI/CD → Variables, e.g. `dind_runner`) to route them — it lives in
+  # project settings, so it survives every `yad` sync. When unset, current GitLab (>=15) drops the
+  # empty-expanded tag so the job runs untagged (gitlab.com shared runners); some older versions
+  # instead strand it `pending` — if so, set the variable to a real tag. Single value only:
+  # `tags: [$VAR]` is one tag equal to the whole variable, not a comma-split.
+  tags: [$YAD_RUNNER_TAGS]
 
 .sdlc_mr_only:
   rules:

package/skills/yad-checks/templates/gitlab/yad-verified-commits.gitlab-ci.yml

@@ -12,6 +12,11 @@
 # Job name is yad-hub-prefixed so it can coexist with the code-repo fragment in one pipeline.
 yad-hub-verified-commits:
   needs: []
+  # Runner selection: set the YAD_RUNNER_TAGS CI/CD variable (e.g. `dind_runner`) to route this
+  # docker job on instances whose runners are tag-locked (run_untagged: false) — it lives in
+  # project Settings → CI/CD → Variables, so it survives every `yad` sync. When unset, current
+  # GitLab (>=15) runs the job untagged; older versions may strand it — set a real tag if so.
+  tags: [$YAD_RUNNER_TAGS]
   image: node:20
   variables:
     GIT_DEPTH: "0" # full history so the gate can diff against the target branch

package/skills/yad-hub-bridge/SKILL.md

@@ -89,6 +89,14 @@ remains valid and is the fallback whenever CI cannot push.
      `SDLC_GATE_TOKEN` project-access-token variable (`read_api` + `write_repository`). GitLab fires no
      pipeline on an approval alone, so the schedule is the path that picks approvals up (≤ ~15 min
      latency); MR events and the merge are near-immediate.
+   - **If your runners are tag-locked** (`run_untagged: false`, common on self-hosted): set a
+     `YAD_RUNNER_TAGS` CI/CD variable (e.g. `dind_runner`) so the docker-image `yad-gate-sync` job
+     is routed to a runner — otherwise it sits `pending` forever. The fragment emits
+     `tags: [$YAD_RUNNER_TAGS]`. When unset, current GitLab (≥15) drops the empty-expanded tag so the
+     job runs untagged (gitlab.com shared runners); older versions may strand it `pending`, in which
+     case set the variable to a real tag. The variable lives in project settings, so it survives
+     every `yad` sync. Single value only — `tags: [$VAR]` is one tag equal to the whole variable,
+     not a comma-split.
 3. Commit the workflow to the hub. GitHub needs nothing else — the ephemeral `github.token` reads the
    PR and pushes the ledger. If the default branch is protected, see the workflow header for the
    bypass / PAT options; until then the run fails visibly and manual `yad gate sync` still works.

package/skills/yad-hub-bridge/templates/gitlab/yad-gate-sync.gitlab-ci.yml

@@ -31,6 +31,11 @@ variables:
 
 yad-gate-sync:
   needs: []
+  # Runner selection: set the YAD_RUNNER_TAGS CI/CD variable (e.g. `dind_runner`) to route this
+  # docker job on instances whose runners are tag-locked (run_untagged: false) — it lives in
+  # project Settings → CI/CD → Variables, so it survives every `yad` sync. When unset, current
+  # GitLab (>=15) runs the job untagged; older versions may strand it — set a real tag if so.
+  tags: [$YAD_RUNNER_TAGS]
   image: node:20
   rules:
     # MR-event path: fires on MR open / push to the review branch — NOT on approval (see header).