feat!: drop the config-path input and fail on pull request lookup errors

.github/workflows/internal--claude-code-action.yaml

@@ -74,9 +74,6 @@ on:
       passed:
         description: 'Verdict of a docs-sync run'
         value: ${{ jobs.claude.outputs.passed }}
-      backend:
-        description: 'Backend that produced the output (subscription or bedrock)'
-        value: ${{ jobs.claude.outputs.backend }}
 
 jobs:
   claude:
@@ -92,7 +89,6 @@ jobs:
     outputs:
       body: ${{ steps.check.outputs.body }}
       passed: ${{ steps.check.outputs.passed }}
-      backend: ${{ steps.check.outputs.backend }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -297,7 +293,6 @@ jobs:
             backend=bedrock
             output="$BEDROCK_OUTPUT"
           fi
-          echo "backend=${backend}" >> "$GITHUB_OUTPUT"
           if verdict="$(STRUCTURED_OUTPUT="$output" bash .shared-workflows/scripts/review-output/check.sh "$OUTPUT_KIND")"; then
             body="$(jq -r '.body' <<<"$verdict")"
             if [ "$backend" = "bedrock" ]; then

.github/workflows/reusable--label-base-deploy--dispatcher.yaml

@@ -8,11 +8,6 @@ on:
         required: true
         type: string
         description: 'GitHub App ID for authentication'
-      config-path:
-        required: false
-        type: string
-        default: 'workflow-config.yaml'
-        description: 'Path to the workflow config that maps stack paths to services'
     secrets:
       private-key:
         required: true
@@ -38,12 +33,10 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           state: all
-        continue-on-error: true
 
       - name: Dispatch Labels
         uses: panicboat/deploy-actions/label-dispatcher@9c5aea836b982c12d283c4bea8fac965d7242eda # v0.1.0
         with:
           pr-number: ${{ steps.pr-info.outputs.number }}
           repository: ${{ github.repository }}
           github-token: ${{ steps.app-token.outputs.token }}
-          config-path: ${{ inputs.config-path }}

.github/workflows/reusable--label-base-deploy--resolver.yaml

@@ -8,11 +8,6 @@ on:
         required: true
         type: string
         description: 'GitHub App ID for authentication'
-      config-path:
-        required: false
-        type: string
-        default: 'workflow-config.yaml'
-        description: 'Path to the workflow config that defines the stacks and services'
     secrets:
       private-key:
         required: true
@@ -43,7 +38,6 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           state: all
-        continue-on-error: true
 
       # Flux pushes image updates to main with no pull request, and the action rejects an empty pr-number.
       - name: Label Resolver
@@ -54,7 +48,6 @@ jobs:
           repository: ${{ github.repository }}
           pr-number: ${{ steps.pr-info.outputs.number }}
           github-token: ${{ steps.app-token.outputs.token }}
-          config-path: ${{ inputs.config-path }}
 
   deploy-terragrunt:
     name: 'Deploy Terragrunt (${{ matrix.target.service }}:${{ matrix.target.environment }})'

scripts/workflows/test.sh

@@ -115,6 +115,25 @@ test_renovate_keeps_production_out_of_automerge() {
     assert_eq "production" "$(jq -r '[.packageRules[] | select(.automerge != null)] | last | if (.matchFileNames // [] | index("**/production/**")) != null then "production" else "other" end' "${repo_root}/default.json")"
 }
 
+test_label_base_deploy_fails_when_the_pull_request_lookup_fails() {
+    local name
+    for name in dispatcher resolver; do
+        assert_eq "null" "$(yq '.jobs[].steps[] | select(.id == "pr-info") | .continue-on-error' "${workflows_dir}/reusable--label-base-deploy--${name}.yaml")"
+    done
+}
+
+test_label_base_deploy_reads_the_default_config_path() {
+    local name
+    for name in dispatcher resolver; do
+        assert_eq "null" "$(yq '.on.workflow_call.inputs["config-path"]' "${workflows_dir}/reusable--label-base-deploy--${name}.yaml")"
+    done
+}
+
+test_claude_job_does_not_expose_the_backend() {
+    assert_eq "null" "$(yq '.on.workflow_call.outputs.backend' "${claude_workflow}")"
+    assert_eq "null" "$(yq '.jobs.claude.outputs.backend' "${claude_workflow}")"
+}
+
 test_workflows_do_not_read_apply_trigger() {
     assert_eq "" "$(grep -rl --exclude='*test.sh' 'apply_trigger\|validate-apply-trigger' "${workflows_dir}" "${repo_root}/scripts" || true)"
 }