Revert "ci: sync-fork-dev uses the narrowed sync-fork key and scoped order lookup (#31)" - #32

Research Review

Verified

• Exact revert: blob SHA of .github/workflows/sync-fork-dev.yml at PR head (c444b51) is 207c4b99eb2008b232a3d93efe76419acaaea318, identical to the file at the parent of #31's merge commit efe088b. The PR restores the pre-#31 file byte for byte.
• Sibling parity: Eyevinn/golang-runner sync-fork-dev.yml on main uses MAKER_API_KEY: ${{ secrets.OSC_DEV_MAKER_API_KEY }} and curl -sf -G "$MAKER_URL/maker", the same form this PR restores.
• Dependency in PR body: osaas-maker-manager#257 is CLOSED. Its PR #258 ("dedicated sync-fork key may do the order lookup on GET /maker?repositoryUrl=") merged 2026-11-02T00:46:54Z as 92e3db9, and the "Continous deploy to dev environment" run for 92e3db9 concluded success. The architect triage on #257 describes the workflow-side calls (GET /maker with only repositoryUrl, reading .[0].order.orderId and .[0].order.status.phase), which match what this file sends.
• Lessons section present and filled in.

Adjacent Stubs Detected

• None. Swept the touched workflow for TODO|FIXME|undefined : undefined|\|\| undefined. The || echo '{}' and || echo '[]' fallbacks are existing poll-loop behaviour and unchanged by this PR.

Orphaned Files Detected

• None. The only file touched is a workflow, which is an entry point.

Escape Hatch Coverage

• No new terminal-rejection branch. The PR removes the found $COUNT multi-order failure and keeps the existing exit 1 paths (empty key, missing job id, FAILED/ERROR).

Contract diff

• No request handler or timeout changed. Files checked: .github/workflows/sync-fork-dev.yml. The workflow's poll limits (60 and 120 iterations at 20s) are identical to the pre-#31 file.

Impact Analysis

• Blast radius: only python-runner's dev sync-fork workflow. This is a CI workflow and not a request path.
• Downstream consumers: none in code. The workflow calls maker-manager on dev, whose GET /maker?repositoryUrl= now accepts the dedicated key (#258).
• Coordinated changes needed: the repo secret OSC_DEV_MAKER_API_KEY must hold the narrowed key (claimed in the PR body, not verifiable here). web-runner is not covered by this PR.
• Breaking change risk: low. This restores the file that ran before #31 and that sibling runners still use.

Risks Not Tested

• I could not read the repo secret OSC_DEV_MAKER_API_KEY or confirm it holds the narrowed key. If it holds the old platform key, the workflow still works. If it holds the narrowed key, it works only because #258 is deployed on dev, which I confirmed by workflow conclusion only. I did not curl dev.
• No live run of the reverted workflow was executed (no checks on the branch).
• Prod workflow sync-fork-prod.yml was not reviewed; it is out of scope for this PR (tracked in osaas-maker-manager#256).

Research Suggestions

• After merge, dispatch Sync fork in dev once on python-runner and confirm it gets past "Order before sync" with a 200 on GET /maker.

Verdict

No blocking issues found.

Reviewed by PR Research Validator. This review checks whether code is based on verified sources rather than assumptions.