Per operator guidance: the required-status-checks config gates merge
on the nix flake check only, not this lint. So drop the warn|deny
mode — the lint just fails (exit 1, error annotations) when it finds
tracker tags, and runs as its own CI job so that failure shows red on
the PR without failing the required nix flake check job or blocking
merge. Once the legacy backlog is cleaned up, promoting this job to a
required check flips it to a hard gate — no code change.
The hive convention is prose, not tracker tags, in code, but it was
enforced only at review time — three PRs this session needed
request-changes purely for stray tags in new comments.
Add scripts/check-issue-refs.sh: scans tracked source (rust, nix, js,
ts, css, html; markdown exempt) for a hash followed by an issue number
and emits a CI warning annotation per hit. The pattern is a hash, 2-5
digits, then a non-hex char or end-of-line, so it skips CSS hex
colours (letter-bearing or six/eight-digit) while catching tags; a
pure-numeric short hex is the only residual false positive (dodge with
the six-digit form).
Wire it into the CI workflow as a fast pre-check before nix flake
check. It runs in warn mode (exit 0) so it does not block while the
legacy backlog is cleaned up; the script takes a warn|deny arg so the
later flip to a hard gate is a one-word change, not a rewrite — the
same rollout shape as tightening a clippy lint.
home-manager / nix-managed git configs ship the file from the nix
store, so `git config --global` errors out. catch the failure and
print the equivalent home-manager snippet instead of aborting — the
tea + netrc steps still want to run.
forge-create-token.sh mints an access token for an existing user
(prints to stdout — forgejo only shows it once). forge-login.sh
configures the operator's shell: git config --global user.name /
user.email, ~/.netrc entry for HTTP clones, and `tea login add`
when tea is on PATH. takes the token interactively (hidden input)
so it doesn't land in shell history.
