From 78efa37700a58834c54ef8792102d7eec79f4514 Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 7 Sep 2026 11:04:35 +0500
Subject: [PATCH] ci: report self-workflow failures as unassigned issues

Signed-off-by: rldyourmnd <danil@nddev.it.com>
---
 .github/workflows/ci-feedback-events.yml | 25 ++++++++++++++++++++++++
 CHANGELOG.md                             |  5 +++++
 README.md                                |  8 ++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 .github/workflows/ci-feedback-events.yml

diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml
new file mode 100644
index 0000000..94977cd
--- /dev/null
+++ b/.github/workflows/ci-feedback-events.yml
@@ -0,0 +1,25 @@
+name: CI feedback
+
+on:
+  # Trusted publisher reads completed-run metadata only; source-run code and
+  # artifacts are never executed. Its code is fixed by the reviewed caller/ref.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["CI", "codeql", "Release"]
+    types: [completed]
+
+permissions: {}
+
+concurrency:
+  group: ci-feedback-events-${{ github.repository_id }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  feedback:
+    if: ${{ contains(fromJSON('["failure","timed_out","action_required","stale","startup_failure","cancelled"]'), github.event.workflow_run.conclusion) }}
+    permissions:
+      actions: read # Read exact completed run and job metadata.
+      issues: write # Publish bounded failure evidence in this repository.
+    uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@a0dc5592333dcfdf2a3d239ed1f2b128899e5482  # commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482
+    with:
+      run-id: ${{ format('{0}', github.event.workflow_run.id) }}
+      run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 79a64d6..9be439c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes are documented here. The project follows Semantic
 Versioning and uses an unstable `v1alpha1` manifest until its first stable
 contract.
 
+## [Unreleased]
+
+- Publish unsuccessful completed self-workflow attempts as unassigned,
+  repository-local CI evidence; preserve actual conclusions and exact attempts.
+
 ## [0.1.1] - 2026-08-16
 
 First release of `agent-runtime` as an open-source module under
diff --git a/README.md b/README.md
index e61993d..faebb32 100644
--- a/README.md
+++ b/README.md
@@ -234,3 +234,11 @@ contract changes are recorded in [`CHANGELOG.md`](CHANGELOG.md).
 
 Licensed under the GNU Affero General Public License v3.0 only
 (`AGPL-3.0-only`).
+
+
+## CI feedback
+
+The CI feedback workflow reports unsuccessful completed self-workflow attempts
+as unassigned issues in this repository. It uses a pinned publisher and records
+actual job conclusions and attempt identity without executing source-run code.
+Issue publication does not launch a repair agent or authorize deployment.