From ec82fee4008f02f1aeeb1ac034b848d6b0cdebdf Mon Sep 17 00:00:00 2001
From: claude <no-reply+claude@chaosbit.de>
Date: Wed, 9 Sep 2026 12:50:34 +0000
Subject: [PATCH] DEBUG: throwaway workflow to probe weblib-ci#11 cross-repo
 dependency resolution

---
 .gitea/workflows/debug-issue-11.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .gitea/workflows/debug-issue-11.yml

diff --git a/.gitea/workflows/debug-issue-11.yml b/.gitea/workflows/debug-issue-11.yml
new file mode 100644
index 0000000..8ceba2e
--- /dev/null
+++ b/.gitea/workflows/debug-issue-11.yml
@@ -0,0 +1,26 @@
+# THROWAWAY workflow for weblib-ci#11 reproduction. Not merged, will be
+# deleted along with the debug/issue-11-repro branch once the mechanism is
+# established.
+#
+# Runs the (also throwaway-instrumented) sync_blocked_label.py directly, with
+# the token Gitea Actions gives *this* repo -- scoped to weblib-ci only, same
+# as every other repo's reconciler is scoped to itself. That is the exact
+# condition weblib-ci#11 is about: can a token that cannot see weblib-archive
+# or cfbypass still resolve a cross-repo blocker's state.
+name: debug issue 11 repro
+
+on:
+  workflow_dispatch:
+
+jobs:
+  debug:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v4
+      - name: probe cross-repo dependency resolution
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_HOST: ${{ github.server_url }}
+        run: |
+          nix shell nixpkgs#python3 --command python3 sync_blocked_label.py \
+            --repo weblib/weblib-archive --dry-run