
  # AP-16 B-lite ping (cornerstone only) — after a cornerstone release is verified
  # live on devpi, fan out to every mgf-common-consuming sibling's CI so its
  # compat-matrix runs against the just-published cornerstone. Surfaces a break
  # before a consumer pulls the untested combo — the forcing function behind the wide
  # `mgf-common>=<floor>,<1.0` pin (API_DESIGN §4.4). Tag-gated; the woodpecker_token
  # org secret authorises the triggers, WOODPECKER_URL is the CI server itself. A red
  # here is post-publish + advisory (the release already shipped): it means "some
  # siblings weren't pinged — re-run `mgf-fed ping-siblings`". Spliced only into the
  # cornerstone (mgf-common) pipeline.
  - name: ping-siblings
    image: python:3.12-slim
    when:
      event: tag
      ref: refs/tags/v*
    depends_on: [verify-devpi]
    environment:
      WOODPECKER_TOKEN:
        from_secret: woodpecker_token
    commands:
      # The index is $DEVPI_URL — the Woodpecker server-level variable (PAPER-113;
      # MGF_INFRA.md §2), never a hardcoded IP; the guard fails fast when unset.
      - '[ -n "$DEVPI_URL" ] || { echo "DEVPI_URL is unset -- set the Woodpecker server-level variable (MGF_INFRA.md §2; PAPER-113)"; exit 1; }'
      - pip install --quiet "mgf-fed[cli]" --index-url "$DEVPI_URL"
      - WOODPECKER_URL="$CI_SYSTEM_URL" mgf-fed ping-siblings
