[rhuanbarreto]

Included

• Composite Bash/jq action with GitHub runner API and HTTP capacity service sources, pagination, label matching, preferred overflow, and safe self-hosted fallback.
• Optional SHA-pinned Tailscale federated identity connection using userspace networking and an HTTP proxy.
• Dependency-free Python capacity service example, standalone documentation, tests, linting and maintenance workflows.

Review round 1 fixes

• P1 federation: supply audience: api.tailscale.com/${{ inputs.tailnet-client-id }}. Checked the pinned upstream validation and OIDC token path; regression asserts the audience setting. Live federation requires a caller identity and was not exercised locally.
• P1 service compatibility: send blacksmith as the offer parameter, using the first label for array targets, and send org only with that offer. Translate wire choice blacksmith to public choice overflow while preserving the complete configured runs-on target. Updated the example service and contract documentation.
• P2 HTTP status: require HTTP 200 for both capacity and runner API calls. Regression cases cover other statuses, including a real local HTTP 302 response containing valid decision JSON.
• P2 major tags: publish older releases without moving the major tag. Only the highest stable version in the same major series can advance it. Local Git-repository tests cover numeric patch/minor ordering, separate majors and prerelease exclusion.

Regression tests were added and observed failing before their respective fixes.

Validation

• Bash decision tests: 24 passed.
• Python service tests: 3 passed.
• Python request/configuration/HTTP tests: 9 passed.
• Python release-policy tests: 2 passed, with version-ordering subcases.
• ShellCheck 0.11.0: passed, including the release helper.
• actionlint 1.7.7: passed.
• Zizmor 1.31.1 offline: no findings (one documented local-action exception).
• git diff --check: passed.
• GitHub CI on this revision: push and pull-request checks passed, including both no-token fallback jobs.
• Whole-tree, commit-history and PR-text scans: no prohibited strings or IPv4 addresses.

The initial main commit contains only the MIT license and a one-line README. This PR remains open for maintainer review. No merge, tags or repository settings changes have been performed.

[rhuanbarreto]

CHANGES

Two P1 issues block adoption:

• P1 — Federated network authentication cannot succeed (action.yml:70). The pinned Tailscale action requires audience together with client ID and tags for federation; no audience or client secret is provided here. Its authentication validation therefore rejects every documented federated setup, and the picker always falls back. Pass the appropriate audience (for example, api.tailscale.com/${{ inputs.tailnet-client-id }} for that identity configuration) and verify the real upstream authentication path. See the pinned upstream validation.
• P1 — Preserve the existing capacity-service overflow protocol (src/pick.sh:90, src/pick.sh:95). The existing integration offers the alternate provider using the blacksmith query parameter and receives choice: "blacksmith". Sending only overflow and accepting only overflow breaks compatibility: the service cannot see the offer, and an existing valid provider decision is rejected. A fixture response {"choice":"blacksmith","reason":"capacity available"} with a configured overflow reproduces the unwanted self-hosted fallback. Retain compatibility at the service boundary while keeping the public input/output naming generic, and cover both request and response translation.

Non-blocking:

• P2 — Check HTTP status explicitly (src/pick.sh:91). curl --fail accepts 3xx. A local server returning HTTP 302 with {"choice":"hosted","reason":"redirected"} selected hosted instead of the documented self-hosted error fallback. Require the intended successful status before interpreting the body; apply the same protection to the runner API request.
• P2 — Avoid moving a major tag backwards (.github/workflows/release.yml:35). Publishing an older patch/minor release after a newer one unconditionally force-moves the major tag to the older commit. Compare release versions before advancing the major tag. Release permissions and checkout credential handling are otherwise scoped correctly.

Validation at cc67228: 24 Bash decision checks, 3 Python service tests, and 4 Python request tests passed. ShellCheck 0.10.0, actionlint 1.7.7, Zizmor 1.31.1 offline, the repository content self-check, and git diff --check passed. Independent scans of the complete tree, git log -p --all, branch names, and PR title/body/comments found no prohibited content or IPv4 literals; commit author identities matched the requirement. Both push/PR CI checks and fallback jobs passed. Additional probes covered missing jq (successful JSON fallback), the existing provider response, and HTTP 302. Runner response fields were checked against the documented REST response shape. No repository code, branch, commit, tag, or settings were changed.

[rhuanbarreto]

Verdict: APPROVE

Round 2 reviewed at c80026b. No remaining P0/P1 findings; all four previous findings are resolved.

• action.yml:71 supplies the federated identity audience required by the pinned upstream action. The regression assertion passes, and the upstream authentication validation/token path was checked. No live identity connection was attempted.
• src/pick.sh restores the provider offer query convention, includes the owner only with that offer, and translates the service provider response into public choice: overflow while preserving the complete configured target. Request/response and example-service tests pass.
• Both network request paths use the shared HTTP helper requiring status 200. Tests cover non-200 statuses for both sources, plus real HTTP 200/302 service responses.
• scripts/is-latest-release.sh gates major-tag advancement on the highest stable version within that major. Real local Git tag tests cover older releases, numeric version ordering, separate majors, and prerelease exclusion; the workflow invokes the gate before updating the major tag.

Validation: 24 Bash decision checks, 3 Python service tests, 9 Python request tests, and 2 Python release tests passed. ShellCheck 0.10.0, actionlint 1.7.7, Zizmor 1.31.1 offline, python3 scripts/check-public.py, and git diff --check passed. Independent scans of the complete tree, full git log -p --all, branch names, and PR title/body/comments/reviews found no prohibited vocabulary, other repository names, or IPv4 literals. Commit author identities match the requirement. gh pr checks 1 reports passing checks and fallback jobs for both push and pull request.

No new P2/P3 findings. Review only; no code, branches, commits, tags, or repository settings changed.