README.md

@@ -22,25 +22,40 @@ this repo has no flake.
 
 ## Using it
 
-`with-nixpkgs.sh` reads the **consuming** repo's `flake.lock` relative to the
-working directory, so it keeps working from a subdirectory.
-
 ```yaml
 - uses: actions/checkout@v4
-- name: fetch the shared CI tools
-  run: git clone --depth 1 https://git.chaosbit.de/weblib/weblib-ci.git .ci
-- run: bash .ci/with-nixpkgs.sh python3 python3 .ci/report_job_log.py /tmp/build.log
+- id: ci
+  uses: https://git.chaosbit.de/weblib/weblib-ci@main
+- run: bash ${{ steps.ci.outputs.path }}/with-nixpkgs.sh python3 \
+         python3 ${{ steps.ci.outputs.path }}/report_job_log.py /tmp/build.log
 ```
 
-No credentials: the repo is public, which is the whole point of it being so.
+No credentials anywhere: the repo is public, which is the point of it being so.
 
-### Why not `uses:`
+`with-nixpkgs.sh` reads the **consuming** repo's `flake.lock` relative to the
+working directory, so it keeps working when invoked by absolute path from
+outside the checkout.
 
-`uses:` pointing at a repo on this instance was measured on weblib-archive#44
-and did not work, in either the bare `weblib/weblib-ci@main` form or with a
-full URL — while a plain clone with the same access did. `action.yml` is kept
-here so the question can be re-checked cheaply if the instance changes; the
-README records the answer so nobody has to re-derive it.
+### Use the full URL, not `weblib/weblib-ci@main`
+
+Measured on weblib-archive#44 (2026-09-07), one job per form because Gitea
+posts one commit status per job and job logs return 500:
+
+| form | result |
+|---|---|
+| `uses: https://git.chaosbit.de/weblib/weblib-ci@main` | **works** |
+| `uses: weblib/weblib-ci@main` | **fails** |
+| `git clone https://…/weblib-ci.git` with no credentials | works |
+| `steps.<id>.outputs.path`, then running a tool through it | works |
+
+The bare `owner/repo` form resolves against the instance's default actions URL
+rather than this host, so it has to be the full URL. Both forms failed while
+this repo was **private**, which is the other half of why it is public — the
+alternative was a deploy key and an ssh setup step in four repos.
+
+The `outputs.path` row is listed separately on purpose: the action *running* and
+its output *reaching the caller* are different claims, and a composite action
+returning an empty string is exactly the sort of thing that looks green.
 
 ### Why not a flake input
 

action.yml

@@ -1,10 +1,9 @@
 # Makes the shared tools available to a workflow and reports where they are.
 #
-# Whether this is usable at all depends on `uses:` resolving a repo on this
-# Gitea, which is instance configuration rather than something a repo controls.
-# Measured on weblib-archive#44 while weblib-ci was still private: it did not
-# work. Re-measured once the repo was public - see the README for the outcome
-# and for the fallback, which is a plain clone and always works.
+# Consume it with the **full URL** - `uses: https://git.chaosbit.de/weblib/
+# weblib-ci@main`. The bare `weblib/weblib-ci@main` form resolves against the
+# instance's default actions URL rather than this host and fails. Both forms
+# failed while this repo was private; see the README table.
 name: weblib CI tools
 description: Shared CI scripts for the weblib repos.