Repository navigation
ci(governance): call the standards DEED and K9 lanes directly - #320
Merged
Merged
Conversation
Owner decision 2026-11-10: permit metadatastician/standards reusable workflows in this repository's Actions policy and stop keeping fork-local copies of them. - The `deed` and `k9` jobs of `Governance (fork)` now call metadatastician/standards at f85b6c11, one full commit SHA for both. - The two fork-local copies are deleted (deed at 75bd5994, k9 at c6d78606), with the test that covered one K9-copy delta. - The contract check now requires both calls at a full commit SHA and at the same commit. It permits exactly those two cross-owner reusables. The mutation tests cover an unpinned DEED call, an unpinned K9 call, split pins and a call to any other owner. Not changed: the Hypatia lane and the comment poster. The Hypatia copy has two fork behaviours that the standards lane does not offer yet (no SARIF upload on pull requests, the inherited-TypeScript exception). Scorecard and the secret scanner are also still fork-local. This run needs `metadatastician/standards/.github/workflows/*@*` in Settings, Actions, General. Without it the run fails at plan time with zero jobs. Local: scripts/check-governance-contract.sh, 89 checks pass; scripts/tests/test-governance-contract.sh, 37 mutations rejected; the other five shell tests of the workflow-contract job pass. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZoTPXfxg1C85rVNx78
|
Caution Review failedThe pull request is closed. Walkthrough
Merge Risk:
 |
`lane_pin` ended in a `grep` that matched nothing when a lane had no full commit SHA. Under `set -euo pipefail` the script then stopped with exit 1 and no message, before the check that names the fault. The mutation tests still passed, because they only asked for a non-zero exit. - `lane_pin` now prints nothing for a missing call and never fails. - The tests now require the named error for the three lane-pin mutations. They fail against the earlier script. - The new lines use `[[ ]]` and a local variable, which clears the five SonarCloud findings on pull request 320 (shell:S7679, shell:S7688). Local: check-governance-contract.sh, 89 checks pass; test-governance-contract.sh, 37 mutations rejected. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZoTPXfxg1C85rVNx78
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
3 of 4 tasks
hyperpolymath
added a commit
that referenced
this pull request
Nov 10, 2026
…rectly (#321) ## Change and reason Owner decision, 2026-11-10. This completes the move that [#320](#320) started. After this change, no governance lane is a fork-local copy. - The `hypatia` job calls the standards Hypatia lane. The fork-local copy existed for two behaviours. Both are now opt-in inputs of the standards lane ([metadatastician/standards#1456](metadatastician/standards#1456)): - `sarif-upload-on-pull-request: false`. A pull request scan does not create a separate, blocking code-scanning check. - `inherited-language-paths: config/hypatia/upstream-typescript-allowlist.txt`. Only the banned-language finding on those exact upstream files is excused. The grid reports each one as excluded. - The `verdict` job calls the standards posting engine. The pull request comment gets the layout that the fork-governance SPEC fixes: summary, K9-DEED conformance, Hypatia grid, and the external reviewer coverage section. - A new `previous-grid` job hands the previous bot-authored grid to the lane, so the revision comparison column stays. - All four standards calls use one commit, `d73229d8`. - Deleted: `hypatia-scan-reusable.yml` (906 lines), `scripts/filter-hypatia-inherited-language.sh` and its test. **Before merge:** Settings → Actions → General must list `metadatastician/standards/.github/workflows/*@*`. The `Governance (fork)` run on `main` already fails at start for this reason. Do not merge this pull request until its own `Governance (fork)` run shows jobs. ## Validation Run locally at `a3aea2e`: - `bash scripts/check-governance-contract.sh`: all 59 checks pass. - `bash scripts/tests/test-governance-contract.sh`: 35 of 35 mutations rejected. The new mutations remove or flip each of the two inputs, unpin the Hypatia lane or the posting engine, split or float `canon-ref`, make the lane blocking, restore a local copy, and let the previous grid come from any author. - The other four shell tests of the `workflow-contract` job pass. - `bash scripts/maintenance/check-pr-freshness.sh --base origin/main` passes. - The upstream list (110 paths) passes the standards helper `inherited-language.sh paths`. - The workflow file parses as YAML. Not run: the workflows. The first real run needs the policy entry. ## Scope and behaviour changes - The comment changes its layout and wording. The Hypatia row now grades the changed files of a pull request, and it grades only the gating rows. Fleet rows are advisory. - The excused upstream findings are no longer removed from the report. The grid shows them as excluded. - The lane uses the standards pins for Hypatia, panic-attack and pons asinorum. They are newer than the pins of the deleted copy, so finding counts can change. - The copy validated the raw findings with `ijson-jcs`. The standards lane does not have that step. - The SARIF upload action is `github/codeql-action/upload-sarif` v4.38.0 in the standards lane. The copy used v4.39.0. - Not changed: the fleet job, the badge job, the Scorecard and secret-scanner copies, and `.gitbot-fleet/enrolment.json` (the `panicbot` row still repeats `panic-attack assail`). - No lockfile change. ## Contribution checks - [x] I followed [CONTRIBUTING.md](../CONTRIBUTING.md). - [x] This branch starts at current fork `main` (`1c6a731`). It is a fork-only governance change and is not for upstream. - [ ] CI has run and passes. (Pending. It needs the policy entry above.) - [x] Existing licensing, citation and acknowledgement text is unchanged. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZoTPXfxg1C85rVNx78)_ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Workflow Changes** * Hypatia scanning and verdict posting now run through pinned workflows from the standards repository. Pull requests can compare against the latest available Hypatia grid comment. * The repository’s local Hypatia reusable workflow and inherited-language filtering scripts have been removed. * **Documentation** * Maintenance notes now describe the shared workflow setup and updated governance checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude <noreply@anthropic.com>
3 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change and reason
Owner decision, 2026-11-10: permit
metadatastician/standardsreusable workflows in this repository's Actions policy, and stop keeping fork-local copies of them.This is the first step, and it is also the test of the policy.
deedandk9jobs ofGovernance (fork)now callmetadatastician/standardsatf85b6c11. Both jobs use the same full commit SHA.deed-conformance-reusable.yml(from75bd5994) andk9-conformance-reusable.yml(fromc6d78606). The testtest-k9-log-copy.shcovered one change in the K9 copy, so it is deleted too.scripts/check-governance-contract.shnow requires both calls at a full commit SHA and at the same commit. It permits exactly those two cross-owner reusables.scripts/tests/test-governance-contract.shrejects an unpinned DEED call, an unpinned K9 call, split pins, and a call to any other owner.docs/maintenance/repository-hygiene.mdrecords the decision.Before merge: Settings → Actions → General must list
metadatastician/standards/.github/workflows/*@*. Without that entry, theGovernance (fork)run on this pull request fails at plan time with zero jobs. A run with jobs proves that the policy permits the calls.Validation
Run locally at
e1f5645:bash scripts/check-governance-contract.sh: all 89 checks pass (94 before; the checks on the deleted copies are gone).bash scripts/tests/test-governance-contract.sh: 37 of 37 mutations rejected.workflow-contractjob pass.bash scripts/maintenance/check-pr-freshness.sh --base origin/mainpasses.Not run: the workflows. The run on this pull request is the first real test.
Scope
DEED syntax / DEED syntax / linttoDEED syntax / lint. The K9 check name staysK9 conformance / validate. If theBranch-Floorruleset requires the old DEED name, change the ruleset first.Contribution checks
main(dee1be3). It is a fork-only governance change and is not for upstream.Generated by Claude Code
Summary by CodeRabbit