Fleet gate-drift detection has never run: FLEET_DISPATCH_TOKEN is not provisioned

[rubenvdlinde]

Answer to "is the Friday routine enough to turn development red when the GATES change?"

Design: yes. Reality: no — the routine has never successfully run.

Measured 2026-08-20:

workflow	runs ever	last result
fleet-drift-sweep.yml	1	failure (2026-08-19)
fleet-cve-release.yml	1	failure (2026-08-19)
fleet-friday-merge.yml	0	never executed

All three stop at the same line:

##[error]FLEET_DISPATCH_TOKEN is not set, so this sweep can dispatch nothing.

Why the design is right

A gate change reaches every app without any commit in that app, because each app's Code Quality calls ConductionNL/.github/.github/workflows/quality.yml@main and the gate package is resolved at run time. So the only missing ingredient is a run.

The sweep handles the subtle part correctly: schedule: cannot choose a branch — GitHub runs cron from the repository's DEFAULT branch, and the fleet's defaults are split (11 apps default to development, the rest to main). A per-app cron would therefore measure the wrong branch on roughly half the fleet. The sweep instead dispatches centrally with --ref development stated explicitly for every app.

Why it produces nothing today

FLEET_DISPATCH_TOKEN does not exist. The sweep fails loudly on the first step rather than dispatching a partial fleet, which is the correct behaviour — but the net effect is that no gate-drift detection has ever run.

This is the failure mode the fleet keeps hitting in other forms: a check that did not run looks exactly like one that passed. The routine exists, reads as complete, and has produced exactly zero verdicts.

Remediation (needs an org admin — I cannot provision a secret)

1. Mint a fine-grained PAT with Actions: read and write on the ConductionNL org, or a GitHub App installation token with the same.
2. Add it as an org-level secret named FLEET_DISPATCH_TOKEN, visible to ConductionNL/.github.
3. Verify with a manual dispatch:

   gh workflow run fleet-drift-sweep.yml --repo ConductionNL/.github --ref main -f ref=development
   

4. Confirm it dispatched rather than merely "succeeded" — count the workflow_dispatch runs it started:

   gh api "repos/ConductionNL/<app>/actions/runs?event=workflow_dispatch&per_page=5" \
     --jq '.workflow_runs[]|"\(.head_branch) \(.created_at) \(.status)"'
   

   A green sweep job that dispatched zero runs is the same non-event as today's failure, just quieter.

Known follow-on, already handled

Sweep runs are workflow_dispatch, and shields.io badges filter event=push — so a sweep that finds drift moves no badge. That is why fleet-drift-sweep.yml carries a collect job: it reads the dispatched runs' conclusions directly instead of relying on badges.

Related, unblocked separately

Four apps went red today on a transient HTTP/2 504 from GitHub's zipball CDN during the sibling-app composer install (decidesk 5 legs, scholiq 6, pipelinq 4, larpingapp 1 — each naming a different package). Fixed in #522 with a bounded 3-attempt retry that still hard-fails if the install genuinely cannot complete.

[rubenvdlinde]

Necessary but not sufficient — see #526

Provisioning FLEET_DISPATCH_TOKEN unblocks the sweep from dispatching, but the dispatched runs will then be cancelled by ordinary release merges.

quality.yml sets:

concurrency:
  group: quality-${{ github.ref }}
  cancel-in-progress: true

The group is keyed on the branch only, so a workflow_dispatch run on development shares a group with every push run on development. Measured today, merges into development land every 8–12 minutes while a Code Quality run takes 14–23 — 69% of push runs fleet-wide are already cancelled (139 of 200).

So a Friday drift sweep would, as things stand, mostly produce cancellations — which report as neither pass nor fail and are invisible in any failure count.

Suggested pairing with the token: key the group by event as well, e.g.

group: quality-${{ github.ref }}-${{ github.event_name }}

so a deliberate drift sweep is never cancelled by routine merge traffic. Full data and options in #526.