Conversation
…t nits (#323) Incorporates the four post-sync leftovers from the Financial-Modeling standup (#322). 1. **Publisher TOCTOU** - `publish` now checks out `github.sha` (the dispatch-time commit) instead of `github.ref_name` (a moving pointer), so a commit landing between dispatch and checkout can no longer be released unvalidated. NBGV classification is unaffected (`GITHUB_REF` still names the branch). Matches the pin Financial-Modeling ships. 2. **`.github/` wording** - "GitHub-consumed configuration - workflows, Dependabot" (Dependabot config is not Actions-owned). 3. **Tasks snippet** - header says every *command-executing* task is `type: process` (aggregators are `dependsOn`-only), and `Python Format`/`Python Test` use the object group form (`isDefault`) so **Run Build/Test Task** runs the gate as CODESTYLE documents. 4. **Carry policy** - the Downstream Carry section blesses the owner-directed shape as standard: a downstream repo carries locally adapted, repo-scoped `AUDIT.md` + `spec/secrets.json` for self-audit against its committed `repo-config/` baseline; the hub's fleet-wide audit stays authoritative and the hub is never linked. (A `spec/files.json` baseline entry for these is deliberately deferred until more of the fleet adopts the shape.) Validation: actionlint clean, markdownlint 0 errors, editorconfig clean, snippet JSONC parses, EOLs preserved. Closes#322. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…324) The "runner next" half of the #310 roadmap decision (docs + matrix landed in #311). Scope per owner direction: **on-demand only, owner-initiated** (onboarding, suspected drift, deliberate changes) - no scheduled workflow, no App-token machinery; it runs under the local `gh` auth. ## What it does `python3 spec/audit.py [RepoName ...]` (default: all 21 cataloged repos) executes the deterministic subset of `AUDIT.md` per repo, read-only: - **Settings** vs `repo-config/settings.json` (+ computed `has_discussions`/`default_branch`) - **Rulesets** vs the model's payloads (normalized diff; missing/stray/duplicate flagged; `operational` repos compare `operational/develop.json`) - **Secrets (names only)** vs `spec/secrets.json`: baseline + per-mechanism required in the right stores, forbidden anywhere, unclaimed flagged as stale - **File presence** on the ground-truth branch per `spec/files.json` (model-aware `develop` payload path) - **Branch facts**: main/develop existence, registry `hasDevelop` vs reality, and content divergence via **tree compare** - commit counts mislead under merge-commit promotions, so only a `develop...main` diff with changed files (main carries content develop lacks) reports Findings are typed `DEFECT` / `LETTER` (file absent, intent unverified per AUDIT.md section 7) / `DRIFT`; exit is non-zero on defect/letter. `AUDIT.md` section 0 references the runner. ## Live-tested (read-only) - **Financial-Modeling** - reports exactly its known standup state: the #14 files (`WORKFLOW.md`, `version.json`, `repo-config/*`, `dependabot.yml`) absent on `main` pending PR #15; settings/rulesets/secrets clean (as applied). - **ProjectTemplate / PlexCleaner / HomeAutomation-Config** - exercised the release, docker-secrets, and operational paths. Genuine drift surfaced (stale hub secrets incl. `NINJA_API_KEY`/`NUGET_API_KEY`; HomeAutomation-Config missing the baseline App pair; PlexCleaner missing the repo-config carry) - reported to the maintainer separately, not acted on. Refs #310 (the cold-start self-test matrix remains the roadmap's open acceptance item). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR promotes develop to main while incorporating two main increments: (1) hardening the release publisher against TOCTOU by pinning checkout to the dispatch-time commit, and (2) introducing an owner-run, read-only live fleet audit runner (spec/audit.py) that checks settings/rulesets/secrets/file presence/branch facts against the hub's ground truth.
Changes:
- Add
spec/audit.pyto run a deterministic, on-demand fleet audit usinggh api(read-only) and wire it intoAUDIT.md. - Pin the publish workflow checkout to
${{ github.sha }}to prevent releasing an unvalidated commit that landed after dispatch. - Update carry/docs and snippet guidance (repo-config wording + downstream self-audit carry note; VS Code Python tasks default build/test groups) and pin LF handling for the new audit runner.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| spec/audit.py | Adds the live fleet audit runner that compares live repos to hub ground truth via gh api. |
| repo-config/README.md | Rewords .github/ description and documents the standard downstream self-audit carry shape. |
| catalog/snippets/configs/vscode-tasks-python.json | Adjusts Python task comments and makes Verify/Test the default build/test task groups. |
| AUDIT.md | Links to and references the new deterministic audit runner as the mechanized subset of the audit. |
| .github/workflows/publish-release.yml | Pins checkout to the dispatch-time commit (github.sha) to avoid TOCTOU releases. |
| .gitattributes | Pins spec/audit.py to LF to match the shebang-executed script policy. |
| .editorconfig | Pins spec/audit.py to LF alongside spec/validate.py. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Copilot findings on the #326 promotion, fixed forward: the rulesets and secrets endpoints return empty collections for the legitimate none-case, so `ok404` there converted access failures into false missing-ruleset/missing-secret DEFECTs. A 404 now raises and becomes the repo's per-repo ERROR finding. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Aug 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes two squashed increments:
Refs #310 (the cold-start self-test matrix remains the open acceptance item).
Closes#322.
🤖 Generated with Claude Code