Claude/repo changes review jgvimg - #80
Merged
Merged
Conversation
… this fork bukay was built against an older Workflows version and had already been wired to iamkayleb/Workflows by hand (38 refs, zero to stranske). Syncing the upstream-owned templates into it would have reverted every one of those refs on the first delivery, so the repoint has to land before the registration does. Consumer templates (33 functional refs, 19 files) Repoint `uses:`, `repository:` sparse-checkouts, `runner_ref:`, and the Renovate fleet preset from stranske/Workflows to iamkayleb/Workflows. The three upstream action/workflow SHAs do not exist in this fork, so they are re-pinned to e85edad, which carries all three paths. Prose and comments are untouched, which keeps the three `template_sync: exact` files byte-identical with their root copies. Registration - REGISTERED_CONSUMER_REPOS += iamkayleb/bukay (15 consumers) - pr-00-gate.yml overwrite_repos += iamkayleb/bukay. bukay's Gate carries no generated-delivery-seal job, and a create_only Gate would never receive one, so Maint 71 would never merge its delivery. Its Node CI lives in ci.yml, which stays create_only and repo-owned. - bukay added to the canary set, replacing trip-planner (the validator accepts exactly 2-3 registered repos). A non-canary needs promote plus canary evidence, which this fork cannot produce against stranske repos. Coupled inventories langsmith_fleet.MANAGED_CONSUMER_REPOS, the observability allowlist (not-applicable until bukay produces a conformant artifact), and the generated Renovate ownership preset. Health 74 Eight template fingerprints re-baselined. The checker canonicalizes the pin ref but preserves the action path, so an owner change is real drift. Only the stale fingerprints were rewritten; every hand-written "do not align" rationale is preserved. Tests Count and membership assertions updated where the fleet inventory grew. Three assertions that covered root and template together were made owner-agnostic rather than repointed, since which reusable is called is the contract, not who hosts it. The renovate-ownership test now derives its opt-out set from the manifest instead of a hardcoded repo list, and test_workflow_llm_installs discovery matches `*/Workflows` — it had silently dropped three template workflows. 4375 passed, no new failures. The 9 remaining failures are pre-existing in this sandbox (Python 3.11 vs the repo's >=3.12 pin, and missing langchain deps); verified identical on a clean tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Df2tQ9HcgAW8M3VNrFT3gT
A reusable runs in the CALLER's context. Repointing the consumer templates at
iamkayleb/Workflows got consumers the fork's reusable *logic*, but each reusable
then ran `actions/checkout` against `repository: stranske/Workflows` to vendor its
helper scripts — so bukay would have run fork reusables over upstream scripts, and
a script change in this fork would never have reached it.
Helper layer (27 checkouts, 13 reusables)
reusable-10-ci-python (5), reusable-20-pr-meta (5), reusable-18-autofix (3),
reusable-agents-pr-health (3), reusable-16-agents (2),
reusable-model-profile-trial (2), and one each in
reusable-19-dependency-repair-contract, reusable-agents-verifier,
reusable-backplane-conformance, reusable-{claude,codex,cursor,gemini}-run.
22 of the 27 are reachable from the reusables bukay calls.
The upstream @main-only rationale in these files ("callers ride @main, hence
main IS the pinned ref") holds when the control plane and the helper source are
the same repo. In a fork they are not.
Owner comparisons that were silently dead
reusable-18-autofix derived the owner from github.workflow_ref and compared it
to a literal `stranske/Workflows`. In this fork that branch never fired, so a
SHA-pinned self-test silently degraded to upstream main. Now matches the
repository name. Same fix in two test discovery predicates that had quietly
stopped inspecting anything -- test_reusable_ci_no_hardcoded_ref_main had
fallen to zero inspected checkouts and only its `checked >= 4` floor revealed
it; test_reusable_run_shared_base asserted the literal owner string.
Model-profile-trial is one unit
Its caller `uses:`, its `runner_sha` input, the registry `runner_ref`, and the
runner's own immutable-identity assertion (plus its remote-main freshness
probe) must all name the same repo and commit, or the identity check fails
closed against a fork checkout. Repointed together to e85edad, which carries
the runner. Its assertions stay exact rather than owner-agnostic: for a
read-only pinned trial arm, the owner is part of the guarantee.
Not changed
The 14 refs across 8 root agent workflows that call upstream reusables and
actions. That is a fork-self-CI concern and does not reach consumers; holding
it until the first bukay delivery lands. Documented in
docs/ops/CONSUMER_REPO_MAINTENANCE.md along with the corrected claim that
"root workflows were not repointed", which this commit makes partly false.
4371 passed, no new failures. Template drift 0 unallowlisted, actionlint clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Df2tQ9HcgAW8M3VNrFT3gT
| (needs.resolve.outputs.run_pr_meta == 'true' || | ||
| needs.resolve.outputs.run_bot_comments == 'true') | ||
| uses: stranske/Workflows/.github/workflows/reusable-pr-context.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-pr-context.yml@main |
| needs.resolve.outputs.pr_number != '' && | ||
| needs.resolve.outputs.run_pr_meta == 'true' | ||
| uses: stranske/Workflows/.github/workflows/reusable-20-pr-meta.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-20-pr-meta.yml@main |
| needs.evaluate.outputs.action == 'fix' || | ||
| needs.evaluate.outputs.action == 'conflict') | ||
| uses: stranske/Workflows/.github/workflows/reusable-claude-run.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-claude-run.yml@main |
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@ebef44a616c1da319b1dc96658978fd8f621a00c" # v1 | ||
| uses: "iamkayleb/Workflows/.github/actions/setup-api-client@e85edadb246e41d172a0c79fad147752d1df9ea9" # v1 |
| github.event_name == 'pull_request' && | ||
| steps.api_client_head.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@ebef44a616c1da319b1dc96658978fd8f621a00c" # v1 | ||
| uses: "iamkayleb/Workflows/.github/actions/setup-api-client@e85edadb246e41d172a0c79fad147752d1df9ea9" # v1 |
| jobs: | ||
| health: | ||
| uses: stranske/Workflows/.github/workflows/reusable-agents-pr-health.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-agents-pr-health.yml@main |
| needs.check.outputs.should_run == 'true' && | ||
| needs.check.outputs.fingerprint_should_run == 'true' | ||
| uses: stranske/Workflows/.github/workflows/reusable-agents-verifier.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-agents-verifier.yml@main |
| conformance: | ||
| needs: emit-reference-run | ||
| uses: stranske/Workflows/.github/workflows/reusable-backplane-conformance.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-backplane-conformance.yml@main |
| python: | ||
| name: Python CI | ||
| uses: stranske/Workflows/.github/workflows/reusable-10-ci-python.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-10-ci-python.yml@main |
| needs.detect.outputs.run_core == 'true' | ||
| }} | ||
| uses: stranske/Workflows/.github/workflows/reusable-10-ci-python.yml@main | ||
| uses: iamkayleb/Workflows/.github/workflows/reusable-10-ci-python.yml@main |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Workflow Source
Started from:
Automation intent:
Notes:
Summary
Testing