Repository navigation
ci: read the audit from a git tree and exempt the audit group's cleared members - #237
Open
sylphx-desk-studio[bot] wants to merge 6 commits into
Open
sylphx-desk-studio[bot] wants to merge 6 commits into
sylphx-desk-studio[bot] wants to merge 6 commits into
Conversation
…the pin floor and any merge_group ci-ok workflow as the gate; exemptions for open-source, notebook and hands-off repositories
… floor lists its missed changes; two client packages without CI are no-build
…o-build for a temporary advisory fork
… cleared members The conformance audit reads files on the default branch, so a repository we already keep a clone of needs no API read for R1-R5, R7 and R8. The policy's new trees map names those repositories and trees_worktrees pins which clone is read; origin/<branch> is preferred over a local branch, so a stale worktree cannot change a verdict. R6 stays an API read and is reported unreadable where no API read happens. The pin compare also accepts a pin that is behind the floor when its own component's files are identical at the pin and the floor, so a caller whose red-main.yml or main-red-gate did not change is not forced to repin. The gate workflow is read as ci.yml when present and any workflow otherwise. policy/optimistic-merge.json gains the exemptions for the members of the SylphxAI audit group whose suites already are their gate or that build nothing: SylphxAI/.github, Google-Photos-Delete-Tool, lockdocs, mcp-kit, readme-mark, talos-images, ads-ops, repomap-cloud, oss-checkout, skills (suite-is-gate) and configs, gpdt-test-library, homebrew-tap, owner, scoop-bucket, sylphx-clients, terraform-provider-sylphx (no-build). workflow-templates/rust-check.yml repins to c22aee6 (#225), whose rust-sccache pin the starter pins now match; the tests compared it against a stale caller.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Revives the optimistic-merge policy and audit branch that has sat green, approved
and unqueued since 2026-10-06, brings it up to the current
main, and adds theexemptions the SylphxAI audit group needs.
What changed
policy/optimistic-merge.json: the pin floor moves withmain, and thepolicy gains the exemptions for the group's members whose pull-request suite
already is the whole gate, or that build nothing at all:
suite-is-gate:SylphxAI/.github,Google-Photos-Delete-Tool,lockdocs,mcp-kit,readme-mark,talos-images,ads-ops,repomap-cloud,oss-checkout,skillsno-build:SylphxAI/configs,gpdt-test-library,homebrew-tap,owner,scoop-bucket,sylphx-clients,terraform-provider-sylphxEach entry carries the measured job times it rests on, an owner and a review
date.
scripts/audit_optimistic_merge.py: a pin behind the floor is conformant whenits own component's files (
red-main.ymlfor R4, the action for R5) areidentical at the pin and at the floor, so a caller whose gate did not change is
not forced to repin; the gate workflow is read as
ci.ymlwhen present and anyworkflow otherwise; a repository the policy names under
treesis read from agit tree (
trees_worktreespins which clone), keeping a fleet-wide run off thedesk's live GraphQL cap.
tests/test_audit_optimistic_merge.py: covers the component compare, the gateworkflow lookup and the git-tree read.
workflow-templates/rust-check.yml: repins toc22aee6, whoserust-sccachepin the starter now matches. Without it the
testsjob is red onmain:test_pinned_commit_uses_the_current_rust_sccache_pincompared the templateagainst a caller still pinned at
9e3c877.Why
The conformance audit reported this group as failing R1-R7. The file rows are
what the exemptions and the compare fix address; the remaining members still
need a real adoption PR or a measured exemption, which the per-repository items
own.
How it was tested
python -m unittest discover -s tests: 924 tests, OK (Python 3.11 and 3.14).actionlintover allworkflow-templates/*.ymlwith.github/actionlint.yaml: clean.python -m unittest discover -s tests -p test_rust_check.py: 14 tests, OK.members now resolve to an exemption, the other 9 still report FAIL.