ci: prune dead/duplicate workflows, owner-guard publishing, document secrets, first release-nuget dry run - #344
Merged
Merged
Conversation
…ormant ones
Roughly a third of the 62 workflow files were dead weight. Each file was
classified from `gh run list --workflow <f> --limit 15` plus its `on:` block
(active-green / active-flaky / dead / duplicate / always-red); the full table
is in the PR and the summary lives in docs/CiGateInventory.md ("Pruning").
Only `cert-gate` is required by branch protection, so nothing here changes
what blocks a merge.
Deleted (recoverable at 7196305):
- core-domain-coverage.yml: identical Domain=100% step to the first leg of
scripts/ci/kernel-coverage-gate.sh, same PR/push paths -> duplicate.
- runtime-studio-playground.yml / test-persistence-multi-os.yml: byte-for-byte
the `scope=playground` / `scope=persistence` legs of cross-platform-tests.yml
(same 3-OS matrix, same filters); 4/4 and 15/15 red. The persistence
failures were the publish-unit-test-result-action 403ing on check-runs,
not the tests.
- test-caching-multi-env.yml: 14 red + 1 cancelled of 15, muted since
2026-08-11, dispatch-only. compose-gate still validates the
Dockerfile.test-caching* images.
- mapbox-tile-helpers-ci.yml: 15/15 red, dispatch-only; the job-level
`if: secrets.MAPBOX_ACCESS_TOKEN != ''` is not a valid context there.
- runtime-studio-forge-smoke.yml: dispatch-only, last run 2026-06-14, no refs.
- mesh-lab-remote-gate.yml: never dispatched, five secrets + tailnet runner;
scripts/mesh-lab-verify-remote.sh is the supported path.
Marked `# DORMANT: <reason>, <date>` and left dispatchable:
cross-platform-tests, mesh-lab-gate (both muted 2026-08-11),
mesh-lab-stress-gate (weekly schedule REMOVED after eight consecutive red
runs 2026-06-22..2026-08-10), runtime-release-promotion (rc-gate-tier-d
lists it as optional), test-air-gapped-no-network (never green; MSB1011 from
the CLI step), test-trust-multi-env and workflow-regression-gate (dead by
the 60-day rule but cited by hardening plans / only e2e of `nexo workflow`).
Kept although rarely run: compat-gate, dr-gate (path-triggered),
composition-mesh-gate, waterproofing-gate, perf-certification,
installer-bruteforce-gate (dispatched by rc-gate-tier-d), nuget-consumer-verify,
setup-smoke-suite (docs/CiFirstHardwareSecond.md), mesh-lab-tls-gate.
Not folded: the four CLI-image builds differ in platform/output/smoke and
three are protected workflows; a shared reusable job is its own PR.
Docs: every backtick path and Markdown link to a deleted file was updated
(onboarding-docs-guard's referenced-path check and lychee would both go red
otherwise), and `domain-coverage` branch-protection recommendations now say
`kernel-coverage`. docs/CiGateInventory.md gets a short "Pruning" subsection
rather than a rewrite because PR #338 (docs/repo-map-refresh) already
rewrites that file.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>… secret and variable A fork of this repository inherits container-image-publish.yml, release.yml, release-nuget.yml and release-staging-on-label.yml with no owner check, so a fork's path-filtered push to master (or a v* tag) would try to publish nexo-cli / nexo-api under the fork's GHCR namespace and walk the NuGet path. Each of those four now carries `if: github.repository_owner == 'IanFrelinger'` on the job every other job depends on (release.yml: `validate`), so a fork's run is skipped rather than half-published. A fork that wants to publish edits that one line; image names already derive from github.repository_owner. docs/CiSecrets.md lists every `secrets.*` / `vars.*` a workflow reads (from `grep -ohE '(secrets|vars)\.[A-Za-z_0-9]+' .github/workflows/*.yml`), which workflow reads it, the condition under which it is read, and what happens without it - including the one hard error (NUGET_STAGING_FEED_URL set without NUGET_STAGING_API_KEY). Nothing is required for PR/push/schedule gates; NUGET_PUBLISH_MODE unset means artifact-only, which is the state upstream has always been in (`gh variable list` is empty). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ts.md release-nuget.yml had zero runs since it was written. Dispatched from this branch with version=0.1.0-ci.1 (run 31991505114): pack, manifest, consumer sample restore and artifact upload all green; every nuget.org / staging / SBOM step skipped because no NUGET_PUBLISH_MODE variable exists. Noting it where the variable is documented so the next reader knows the harness has been exercised at least to the push boundary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Contributor
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
…ites, re-apply pruning subsection and domain-coverage removals; drop a stray edit artifact from TestingModel.md
Uh oh!
There was an error while loading. Please reload this page.
IanFrelinger pushed a commit
that referenced
this pull request
Aug 17, 2026
…ons, keep 10.0.x setup-dotnet, Orchestration csproj from this branch (master side was renormalization only)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production-readiness audit, L10 + L12 + M31 (fixable half). Ledger: https://claude.ai/code/artifact/15fa4198-97b8-4da6-bea0-0c24d364a7f3
Summary
PR 18 - L10 (fork/secret hygiene) + L12 (dead / duplicate / always-red workflows) + the fixable half of M31 (the release path had never been exercised).
gh run list --workflow <f> --limit 15 --json conclusion,createdAt,event,headBranch+ each file'son:block (table below).# DORMANT: <reason>, <date>(one of them loses its weekly schedule). Nothing on the protected list was deleted; onlycert-gateis required by branch protection (gh api .../branches/master/protection), so merges are unaffected.if: github.repository_owner == 'IanFrelinger'oncontainer-image-publish.yml,release.yml(validate, which every other job needs),release-nuget.yml,release-staging-on-label.yml; newdocs/CiSecrets.mdlists everysecrets.*/vars.*a workflow reads and what a fork gets without it.release-nuget.ymldispatched on this branch in artifact-only mode (noNUGET_PUBLISH_MODEvariable exists upstream) - outcome below.docs/CiGateInventory.mdgets a short Pruning subsection instead of a rewrite because PR docs: make the repo's self-description true - ProjectTiers, README, CI inventory, layer rules #338 (docs/repo-map-refresh) already rewrites that file; the deleted rows /domain-coveragereferences were removed from the current version so onboarding-docs-guard's referenced-path check stays green.release-nuget.yml dry run (M31)
Dispatched from this branch (commit 28e73ad, guards already in place):
Outcome: success on the first attempt, no harness fix needed, no re-dispatch.
Run: https://github.com/IanFrelinger/Nexo/actions/runs/31991505114 (2026-08-17 03:33 -> 03:35 UTC, 2m35s).
nuget / pack-and-publish0.1.0-ci.1).nupkg+ 5.snupkg(Nexo.Abstractions ... Nexo.Transport.Grpc, Nexo.Client, Nexo.Sdk, Nexo.Authoring, Nexo.CLI)nuget-publish-manifest.json(22 packages)scripts/verify-stable-sdk-host-sample-packages.shrestored from the local feednuget-packages-0.1.0-ci.1(125.8 MB)NUGET_PUBLISH_MODE, noNUGET_STAGING_FEED_URL, noNUGET_RELEASE_SBOM)::notice::NUGET_PUBLISH_MODE is not 'oidc' or 'apikey' (artifact-only)Verify NuGet consumer (nuget.org)Observation, not a bug:
Nexo.CLI.0.1.0-ci.1.nupkgis 122.8 MB (PackAsTool embeds every ProjectReference output). nuget.org's limit is 250 MB so it would upload, but it is the artifact's entire weight; worth a look before the first real publish.The remaining unexercised half of M31 is
release.yml(tag push -> GHCR images + draft release), which was deliberately not dispatched, and theNUGET_PUBLISH_MODE=oidc|apikeybranches (need the owner to set the variable + secret).Inventory (62 files at 7196305, 2026-08-16)
Legend:
G/R/c/s= success/failure/cancelled/skipped newest-first over the last 15 runs. Class: active-green, active-flaky, dead (no run in 60 days and nopush/pull_request/scheduletrigger that can fire), duplicate, always-red, manual (dispatch-only but referenced by a script/runbook), never-run.scripts/compat-gate*.sh), dispatchscripts/composition-mesh-gate-tier-*.sh)release: published, dispatchscripts/dr-gate*.sh), dispatchscripts/rc-gate-tier-d.sh**)if: secrets.*is not a valid context)docs/NuGetConsumerVerify.md)docs/production-readiness/PerfHardeningPlan-v1.md)labeledv*.*.*, dispatchworkflow_callworkflow_callworkflow_callrc-gate-tier-d.shscope=playground, always-reddocs/CiFirstHardwareSecond.md)scripts/**), dispatchscope=persistence; red on publish-action 403, tests passwaterproofing-gate-full,scripts/waterproofing-gate.sh)Not done / deferred (with evidence)
container-image-gate: local build +--help+ multi-arch--output type=cacheonly;distribution-matrix-gate: build +--help+pipeline validate --help;full-platform-readiness-gate: image inside a setup->discovery->dry-run matrix;reusable-container-publish: buildx push to GHCR) differ in platform, output and smoke. Three of the four are protected workflows andfull-platform-readiness-gateonly went green on 2026-08-16. A parameterised reusable job is a separate PR.cross-platform-tests.yml/test-persistence-multi-os403.EnricoMi/publish-unit-test-result-actionneedschecks: write;cross-platform-tests.ymlstill lacks apermissions:block, so its Linux job would fail on publish even if the product assertion (Cross-platform: RuntimeStudioBlackBoxSmokeTests.Daemon_extender_claims_objective_from_store_increments_attempts fails on all platforms (net8 + net9) #252) were fixed. Not touched here (out of scope: pruning, not repair) - noted for whoever un-mutes it.test-air-gapped-no-network.ymlfails insidenexo test multi-env(MSB1011), a CLI defect; left DORMANT rather than deleted because three hardening docs and a test comment cite it.CONTRIBUTING.mdline 45 claimscross-platform-tests.ymltriggers onsrc/Nexo.Infrastructure/**andprod-dry-run-pr.ymlruns on PRs; both are dispatch-only. Left alone (not a workflow-inventory file; PR docs: make the repo's self-description true - ProjectTiers, README, CI inventory, layer rules #338 owns the "self-description" pass) - flagging.Merge-order note
PR #338 (
docs/repo-map-refresh) rewritesdocs/CiGateInventory.md,docs/GitHubBranchProtection.md,docs/architecture/TestingModel.md,docs/architecture/TestingStrategyPivot-v1.mdanddocs/production-readiness/CoverageGates-v1.md; this PR touches the same lines (removingdomain-coverage/ deleted-workflow rows). Whichever lands second needs a small rebase: keep #338's text, dropcore-domain-coverage.yml/domain-coverage, and the seven deleted files from its trigger tables (they appear there as short names, so the referenced-path guard will not catch them).Verification
if:per guarded workflow, and the removedschedule:block.actionlintis not on PATH.git grepfor each deleted file name and job name across.github,Makefile,scripts,docs,src,application: only prose mentions remain, all updated to say "deleted" or pointing at the surviving equivalent.0 missing path(s). No Markdown link targets a deleted workflow (lychee-safe).gh api repos/IanFrelinger/Nexo/branches/master/protection --jq .required_status_checks.contexts=["cert-gate"]- no deleted workflow was a required check.🤖 Generated with Claude Code
Note: conflicts with #338 on the CI docs are expected; #338's rewrite wins and this PR's pruning subsection is re-applied on top.