Merge main into dogfood self-test (pick up Gitea runner fixes)

action.yml

@@ -48,16 +48,33 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Node (stdlib only)
-      uses: actions/setup-node@v4
-      with:
-        node-version: "20"
+    # Do not uses: actions/setup-node — many Gitea forges have no mirror (404).
+    # Runner image / consumer workflow must provide Node >= 18.
+    - name: Require Node.js
+      shell: bash
+      run: |
+        if ! command -v node >/dev/null 2>&1; then
+          echo "::error::Node.js >= 18 required for Gatekeep (merge-findings.js / publish.js)."
+          echo "Preinstall Node on the runner, or add a mirrored setup-node step before uses: ./."
+          exit 1
+        fi
+        node --version
 
+    # PEP 668 blocks pip --user on many runners; use a workspace venv instead.
     - name: Install PyYAML (providers.yaml)
       shell: bash
       run: |
-        python3 -m pip install --user pyyaml -q
-        python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+        if python3 -c "import yaml" 2>/dev/null; then
+          python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+          exit 0
+        fi
+        VENV="${{ github.workspace }}/.gatekeep/.venv"
+        mkdir -p "$(dirname "$VENV")"
+        python3 -m venv "$VENV"
+        "$VENV/bin/pip" install -q pyyaml
+        echo "$VENV/bin" >> "$GITHUB_PATH"
+        echo "VIRTUAL_ENV=$VENV" >> "$GITHUB_ENV"
+        "$VENV/bin/python" -c "import yaml; print('pyyaml ok', yaml.__version__)"
 
     - name: Discover entry points
       id: discover

docs/dogfood.md

@@ -8,6 +8,9 @@ The Action repo itself runs Gatekeep on its own pull requests.
 | Action | `uses: ./` (repo-root `action.yml`) |
 | Secret | `OPENROUTER_API_KEY` → step `env` |
 | Trigger | `pull_request` (non-draft) + `workflow_dispatch` |
+| Proven | [PR #2](https://git.potatolab.uk/layue13/gatekeep/pulls/2) got `<!-- gatekeep-review -->`; run 15833 **success** |
+
+Gitea notes: no `actions/setup-node` mirror — Action requires runner Node ≥18. PyYAML installs via workspace venv (PEP 668). Free OpenRouter models may 429; review still posts (fail-closed tier).
 
 ## How to see a review
 

scripts/review.sh

@@ -176,11 +176,14 @@ set -e
 
 META=$(cat "$OUT/merge-meta.json")
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  python3 -c 'import json,os,sys
-m=json.loads(sys.argv[1])
-open(os.environ["GITHUB_OUTPUT"],"a").write(
-  f"risk_tier={m[\"risk_tier\"]}\nsecurity_blocking={str(m[\"security_blocking\"]).lower()}\nagreed_count={m[\"agreed_count\"]}\n"
-)' "$META"
+  python3 - "$META" <<'PY'
+import json, os, sys
+m = json.loads(sys.argv[1])
+with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
+    fh.write(f"risk_tier={m['risk_tier']}\n")
+    fh.write(f"security_blocking={str(m['security_blocking']).lower()}\n")
+    fh.write(f"agreed_count={m['agreed_count']}\n")
+PY
 fi
 
 exit "$pub_ec"