Incorporate #313: robustness on partial downstream repo-config carry - #314
Merged
Conversation
Template-side fixes for the gaps the Financial-Modeling carry surfaced (ptr727/Financial-Modeling#15 review): - configure.sh: abort on a missing or nameless ruleset payload instead of silently skipping it and reporting success - a downstream repo carries only its own model's develop variant, so a partial apply is easy to hit. - repo-config/README.md: downstream-neutral carry. New "Downstream Carry" section (carry only your model's develop variant; never URL-link the private hub from downstream - plain-text mentions only; regen targets the current repo). Hub-only links (AUDIT.md, spec/secrets.json) become plain text, the ruleset-regen snippet parameterizes the repo, and the Secrets section states per-mechanism applicability (source-only needs none). - publish-release.yml: drop the vestigial exists-check and release-create gate - every trigger is a dispatch, so the skip leg can never fire; the comment states create-or-refresh. No behavior change. - WORKFLOW.md D4 (5A): a dispatch-only publisher may omit the gate; record it N/A, not missing. Closes#313. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the template governance docs and scripts to be more robust when downstream repos carry only a subset of repo-config/ and use a dispatch-only (source-only) publisher, aligning guidance and behavior with the #313 findings.
Changes:
- Make
repo-config/configure.shfail fast when a required ruleset payload is missing or lacks aname, avoiding silent partial application. - Make
repo-config/README.mdmore downstream-carry-friendly (add carry rules, avoid hub-only links, and regenerate rulesets against the current repo). - Simplify
.github/workflows/publish-release.ymlby removing the vestigial “exists” check and making release creation unconditional for dispatch-only publishing; document the audit N/A case inWORKFLOW.md.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| WORKFLOW.md | Clarifies D4 auditing expectations for dispatch-only publishers (gate/exists-check can be N/A). |
| repo-config/README.md | Adds downstream carry guidance and updates regen snippet and hub-only references. |
| repo-config/configure.sh | Aborts on missing/nameless ruleset payloads to prevent silent partial configuration. |
| .github/workflows/publish-release.yml | Removes vestigial release “exists” gate for dispatch-only, source-only publishing. |
Uh oh!
There was an error while loading. Please reload this page.
The top-level bullet implied main.json and develop.json always coexist; a carried copy has only its own model's develop payload. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Comment on lines
+5
to
6
| - `main.json` plus one `develop` variant - the branch rulesets as the writable API subset (`name`, `target`, `enforcement`, `bypass_actors`, `conditions`, `rules`). The `develop` payload is `develop.json` (`release` repos) or `operational/develop.json` (`operational` repos); the hub keeps both, a carried copy only its own model's (see "Downstream Carry"). These are the canonical expected payload the hub's audit (`AUDIT.md`, hub-only) diffs each repo's live rulesets against. | ||
| - `operational/develop.json` - the `develop` ruleset for **operational** repos (registry `workflowModel: operational`): direct signed pushes, no PR gate. `main.json` is shared by both models. See "Rulesets" below. |
ptr727 added a commit
that referenced
this pull request
Jul 16, 2026
…carry robustness (#315) Promotes two squashed increments: - **#311** - onboarding governance (part of the #310 roadmap): `STANDUP.md` (create-to-conformance, inverse of `AUDIT.md`), the cold-start self-test + `reports/conformance-matrix.md`, `AUDIT.md` section 0 (when to run / definition of done), and the `AGENTS.md` "Repository Onboarding and Conformance" obligations. Maintainer-reviewed and approved. - **#314** - #313 incorporation (Financial-Modeling carry findings): `configure.sh` fails fast on a missing/nameless ruleset payload; `repo-config/README.md` is downstream-neutral (Downstream Carry section, no private-hub URL links from downstream, parameterized regen snippet, per-mechanism secrets applicability); `publish-release.yml` drops the vestigial exists-gate (dispatch-only = create-or-refresh, no behavior change); `WORKFLOW.md` D4 records the gate N/A on dispatch-only publishers. Refs #310 (roadmap - slice D, the live fleet-audit runner, remains queued). Closes#313. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Incorporates the template-side robustness gaps the Financial-Modeling standup carry surfaced (#313, from ptr727/Financial-Modeling#15 review).
Changes (mapped to #313)
configure.shfails fast on a missing ruleset payload (and on a nameless one - same silent-partial risk): a downstream repo carries only its own model'sdevelopvariant, so running the wrong model silently skipped the ruleset and still reported "Configuration applied".repo-config/README.mdis downstream-neutral. New Downstream Carry section: carry only your model'sdevelopvariant; never URL-link the private hub from a downstream repo (plain-text mentions only - the owner-directed fleet policy from repo-config + source-only publisher: robustness gaps on partial downstream carry #313); the regen snippet targets the current repo. Hub-only links (AUDIT.md,spec/secrets.json) become plain-text mentions, the ruleset-regen snippet parameterizes the repo viagh repo view, and the Secrets section states per-mechanism applicability (a source-only repo needs none of the publish credentials).publish-release.ymldrops the vestigial exists-check + gate. Every trigger is a dispatch, soexists == 'false' || workflow_dispatchwas always true and the "skip create" comment described a path that can never run; the step is now unconditional create-or-refresh with an accurate comment. No behavior change.WORKFLOW.mdD4 (5A) gains one clause: a dispatch-only publisher may omit the gate/exists-check - record it N/A, not missing - so audits do not flag simplified dispatch-only instances (this repo and Financial-Modeling).Validation
bash -n configure.shOK;actionlintclean;markdownlint0 errors;editorconfig-checkerclean; EOL verified (workflow/sh LF, md CRLF); no orphaned link defs.Closes#313.
🤖 Generated with Claude Code