From 54810c5dd0ad9db6fa898596ddeb8161c5f9ac4d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 5 Aug 2026 09:35:59 +0100 Subject: [PATCH] refactor(ci): give every red gate a distinctive, self-describing context MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prerequisite for making the 🔴 Gate: checks actually required. A required status check matches on the CONTEXT string, which is the JOB name — not the workflow name — and the job names here could not carry that weight. The blocking problem was a collision: guix-nix-policy.yml and security-policy.yml BOTH declared a job called `check`, so two different red gates emitted the same context. Requiring `check` would have been ambiguous about which gate was being enforced. The rest were merely generic — `lint`, `docs`, `validate`, `scan` — which is worse than it sounds for a required context. The string is what appears on the checks board, what a branch rule is written against, and what anyone greps for when a merge is blocked. "validate" tells a reader nothing. check -> guix-only-policy (guix-nix-policy.yml) check -> security-policy-present (security-policy.yml) lint -> code-quality (quality.yml) docs -> docs-present (quality.yml) validate -> wellknown-rfc9116 (wellknown-enforcement.yml) scan -> secret-scan (secret-scanner.yml) Verified: no `needs:` refers to any renamed job, and after the change every red-gate context in this repo is distinct. Renaming a job changes the context it emits, which strands any branch rule naming the old one. That is safe here precisely BECAUSE these gates are not yet required — the repo's rulesets were read first and none of these strings appears. Doing the rename before the requirement is the only safe order; the reverse creates a phantom that blocks every pull request. Next step, once these report on the default branch under their new names: add them to the ruleset, closing the gap the invariant lint measured — 21 of 21 red gates across the estate currently required by nothing. Co-Authored-By: Claude Fable 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/guix-nix-policy.yml | 2 +- .github/workflows/quality.yml | 4 ++-- .github/workflows/secret-scanner.yml | 2 +- .github/workflows/security-policy.yml | 2 +- .github/workflows/wellknown-enforcement.yml | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index d52f21d..dc28f1e 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -15,7 +15,7 @@ concurrency: permissions: contents: read jobs: - check: + guix-only-policy: runs-on: ubuntu-latest timeout-minutes: 15 permissions: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 155fc1f..321ed35 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -16,7 +16,7 @@ concurrency: permissions: contents: read jobs: - lint: + code-quality: runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -38,7 +38,7 @@ jobs: - name: Gate falsifiability canaries (R10) run: bash scripts/test-gate-falsifiability.sh - docs: + docs-present: runs-on: ubuntu-latest timeout-minutes: 15 permissions: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 26520f9..a523aa6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,6 @@ concurrency: permissions: contents: read jobs: - scan: + secret-scan: uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 secrets: inherit diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 9fe9fb5..d0c991d 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -15,7 +15,7 @@ concurrency: permissions: contents: read jobs: - check: + security-policy-present: runs-on: ubuntu-latest timeout-minutes: 15 permissions: diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 96345b4..fda2830 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -9,7 +9,7 @@ on: permissions: contents: read jobs: - validate: + wellknown-rfc9116: runs-on: ubuntu-latest timeout-minutes: 15 permissions: