Repository navigation
refactor(ci): give every red gate a distinctive, self-describing context - #53
Conversation
Prerequisite for making the 🔴 Gate: checks actually required. A required status check matches on the CONTEXT string, which is the JOB name — not the workflow name — and the job names here could not carry that weight. The blocking problem was a collision: guix-nix-policy.yml and security-policy.yml BOTH declared a job called `check`, so two different red gates emitted the same context. Requiring `check` would have been ambiguous about which gate was being enforced. The rest were merely generic — `lint`, `docs`, `validate`, `scan` — which is worse than it sounds for a required context. The string is what appears on the checks board, what a branch rule is written against, and what anyone greps for when a merge is blocked. "validate" tells a reader nothing. check -> guix-only-policy (guix-nix-policy.yml) check -> security-policy-present (security-policy.yml) lint -> code-quality (quality.yml) docs -> docs-present (quality.yml) validate -> wellknown-rfc9116 (wellknown-enforcement.yml) scan -> secret-scan (secret-scanner.yml) Verified: no `needs:` refers to any renamed job, and after the change every red-gate context in this repo is distinct. Renaming a job changes the context it emits, which strands any branch rule naming the old one. That is safe here precisely BECAUSE these gates are not yet required — the repo's rulesets were read first and none of these strings appears. Doing the rename before the requirement is the only safe order; the reverse creates a phantom that blocks every pull request. Next step, once these report on the default branch under their new names: add them to the ruleset, closing the gap the invariant lint measured — 21 of 21 red gates across the estate currently required by nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRefactors CI workflow job names to use distinctive, self-describing contexts in preparation for making them required status checks. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
Prerequisite for making the
🔴 Gate:checks actually required.A required status check matches on the context string, which is the job name — not the workflow name. The job names here could not carry that weight.
The blocking problem: a collision
guix-nix-policy.ymlandsecurity-policy.ymlboth declared a job calledcheck, so two different red gates emitted the same context. Requiringcheckwould have been ambiguous about which gate was being enforced — and silently so.The rest were generic, which matters more than it sounds
lint,docs,validate,scan. For a required context the string is what appears on the checks board, what a branch rule is written against, and what someone greps for when a merge is blocked. "validate" tells a reader nothing.checkguix-only-policyguix-nix-policy.ymlchecksecurity-policy-presentsecurity-policy.ymllintcode-qualityquality.ymldocsdocs-presentquality.ymlvalidatewellknown-rfc9116wellknown-enforcement.ymlscansecret-scansecret-scanner.ymlVerified: no
needs:refers to any renamed job, and after the change every red-gate context in this repo is distinct (checked programmatically, not by eye).Why this order, and only this order
Renaming a job changes the context it emits, which strands any branch rule naming the old one — the phantom-requirement failure that blocks every PR indefinitely.
That is safe here precisely because these gates are not yet required. The repo's rulesets were read first and none of these strings appears in them. Rename first, require second is the only safe sequence; the reverse creates the phantom.
Next step
Once these report on the default branch under their new names, they go into the ruleset — closing the gap the invariant lint measured: 21 of 21 red gates across the estate are currently required by nothing.
Companion to metadatastician/standards#578 (the lint) and #576 (the tier definitions).
🤖 Generated with Claude Code