From 8be5dca42382743c7a39741bec909050e5c92c0e Mon Sep 17 00:00:00 2001
From: randypanding <66171646+randypanding@users.noreply.github.com>
Date: Thu, 20 Aug 2026 18:24:04 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=C2=A715=20=E6=94=B9=E6=8B=89=20ruleset?=
 =?UTF-8?q?=20detail=EF=BC=88LIST=20=E7=AB=AF=E7=82=B9=E6=97=A0=20rules=20?=
 =?UTF-8?q?=E6=95=B0=E7=BB=84=EF=BC=8C=E5=AE=9E=E6=B5=8B=E6=AF=8F=E5=B0=8F?=
 =?UTF-8?q?=E6=97=B6=E5=BF=85=E8=AF=AF=E6=8A=A5=EF=BC=89+=20OK=20=E8=A1=8C?=
 =?UTF-8?q?=E5=8F=97=E6=BC=82=E7=A7=BB=E9=97=A8=E6=8E=A7=EF=BC=88P3-1?=
 =?UTF-8?q?=EF=BC=8CADR-0046=EF=BC=8C#95=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 governance/drift-check.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/governance/drift-check.sh b/governance/drift-check.sh
index 88f32cf..0fb62e8 100644
--- a/governance/drift-check.sh
+++ b/governance/drift-check.sh
@@ -590,10 +590,12 @@ if [[ -n "$ORW_CFG" ]]; then
   WANT_REF=$(jq -r '.ref' <<<"$ORW_CFG")
   WANT_COMMIT=$(jq -r '.ref_commit' <<<"$ORW_CFG")
   ORW_LIST=$(api "https://api.github.com/orgs/$ORG/rulesets?per_page=100")
-  ORW_ROW=$(jq -c --arg n "$WANT_RULESET" '.[] | select(.name == $n)' <<<"$ORW_LIST" 2>/dev/null)
-  if [[ -z "$ORW_ROW" || "$ORW_ROW" == "null" ]]; then
+  ORW_ID=$(jq -r --arg n "$WANT_RULESET" '.[] | select(.name == $n) | .id' <<<"$ORW_LIST" 2>/dev/null | head -1)
+  if [[ -z "$ORW_ID" || "$ORW_ID" == "null" ]]; then
     drift "org-required-workflows ruleset '$WANT_RULESET' 线上不存在——中心审判失效，全部受管仓回落本地 gate（P3-1 枢轴脱离，ADR-0046）"
   else
+    # LIST 端点不含 rules 数组（同 §1 教训）——须拉 detail 才能取 workflows 规则
+    ORW_ROW=$(api "https://api.github.com/orgs/$ORG/rulesets/$ORW_ID")
     GOT_WF=$(jq -c '.rules[] | select(.type == "workflows") | .parameters.workflows[0] // empty' <<<"$ORW_ROW")
     GOT_PATH=$(jq -r '.path // empty' <<<"$GOT_WF")
     GOT_REF=$(jq -r '.ref // empty' <<<"$GOT_WF")
@@ -613,6 +615,8 @@ if [[ -n "$ORW_CFG" ]]; then
       drift "org-required-workflows 钉点 tag $WANT_REF 解引用失败（fail-closed，ADR-0046 §15）"
     elif [[ "$TAGCOMMIT" != "$WANT_COMMIT" ]]; then
       drift "org-required-workflows 钉点 tag $WANT_REF 已移动：${TAGCOMMIT:0:8} ≠ 声明 ${WANT_COMMIT:0:8}——审判内容被换（ADR-0046 §15；还原或走发布流程+expected-state 更新）"
+    elif [[ -n "$BAD" ]]; then
+      :   # 钉点漂移已上报，不再输出 OK 行（避免同段 OK/DRIFT 并存的误导）
     else
       ok "org-required-workflows 钉点完整（$WANT_REF == ${TAGCOMMIT:0:8}，path/repository_id 一致）"
     fi