ci: make public-hygiene-lint green - #6
Merged
Conversation
The public-hygiene gate flags text in customer-readable files that describes how the software was BUILT rather than what it DOES. Every hit in this repo is rewritten to state the behaviour or the invariant; no allow markers are added, so the gate keeps its teeth.
…r, and stop discarding busbar's output
The `install_oidc_plugin_via_admin_api_and_authenticate` e2e test failed on
every run with `busbar exited early during admin-readiness poll: exit status:
1`. The reason was never visible because the harness spawned busbar with
`Stdio::null()` on both streams, so busbar's one-line explanation went to the
floor and the test reported only an exit code.
The explanation was that both fixture configs still used the 1.5.0 INLINE
identity-provider form (`auth.admin_auth: [{ admin-tokens: {...} }]`,
`auth.chain: [{ oidc: { settings: ... } }]`). busbar 1.5.3 retired that form
along with `auth.methods:`/`auth.modules:` and refuses to boot on it — and
this repo's own `.busbar-ref` pins 1.5.3, so the fixture was behind the
grammar this plugin ships against. Both configs now define each provider once
under the top-level `identity-providers:` map and reference it by bare name,
which is what an operator on 1.5.3 must write.
Capturing the child's output is the fix that matters most: an early exit or a
readiness timeout now reports what busbar actually said, so the next config
break is a one-line diagnosis instead of an exit code. Both streams are
drained on background threads rather than read at panic time, because an
unread pipe fills after a page or two and would block the very boot the test
is waiting on.
The same retired grammar was documented in README.md and in the two crates'
module docs, telling operators to write a config that no longer boots; those
now show the `identity-providers:` + bare-name shape and point at
`--migrate-config`.
Separately, ci.yml passed `busbar_ref: ${{ github.ref_name }}`, which on a
`pull_request` event is `<number>/merge` rather than a branch name. Core's
reusable workflow could not resolve it and silently fell back to `busbar@dev`
on every PR, so no PR ever tested against the branch it targets.
`${{ github.base_ref || github.ref_name }}` says what was meant.
MattJackson
force-pushed
the
ci/public-hygiene-green
branch
from
August 9, 2026 00:23
c440c6b to
d9f9573
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
public-hygiene-lint was RED on
mainin this repo. Every hit is fixed by rewriting the text tostate the BEHAVIOUR rather than our internal process. No allow markers were added anywhere in
this change: a blanket allow would turn the gate into decoration.
Hits found on
main, and the decision for each.github/scripts/next-version.sh+.github/workflows/release-selftest.yml[internal-issue-id]cited an internal guard id. REWRITTEN: id dropped.
auth-oidc-plugin/tests/e2e.rs[mutation-testing] named the QA harness as a build-shape example.REWRITTEN:
release-check.sh's phase is the concrete case and it is kept.auth-oidc-plugin/tests/e2e.rs[personal-identifier] attributed the test to a named individualand quoted a private request. REWRITTEN to state what the test proves.
Red before green
Same invocation CI uses. Output is ASCII-folded for this description; the runs are verbatim
otherwise.
Before (on
main)After (this branch)