ci: standards ci-pipeline dry-run caller (observation, not adoption) - #38
Conversation
Adds a pinned caller for hyperpolymath/standards ci-pipeline.yml as part of the deliberate dry-run wave that seeds .machine_readable/pipeline-allow.txt by OBSERVATION rather than by inference. no actions.lock in this repository. Discloses hyperpolymath/standards#976 in the workflow header. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (21)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request adds a GitHub Actions workflow. It runs the reusable standards CI workflow on pull requests and manual dispatch. It pins the reusable workflow to an immutable commit and grants read-only contents access. ChangesStandards CI
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Feature Merge Risk: ⚪ Minimal · up to This adds the intended observation-only standards workflow with bounded permissions and no unresolved merge-blocking risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the workflow gate Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
What this is
A deliberate observation, not an adoption.
hyperpolymath/standardscarries a reusable pipeline,.github/workflows/ci-pipeline.yml, which as of today has zero callersanywhere in the estate. Its exemption ledger,
.machine_readable/pipeline-allow.txt, is seeded empty on purpose. Theledger's own text is explicit about how it may be filled:
This PR is one of five in that dry-run wave.
Expected verdict in this repository
detectcounts ecosystem markers on the default branch. Measured todayacross 105 tracked files:
Project.toml) — unsupportedSo the pipeline is expected to REFUSE — and to say so loudly rather than
reporting a success it did not earn. This repository has real ecosystems; the
pipeline simply does not support any of them, and
detectdeliberately keepsthose markers out of its denominator. The workflow states the reasoning
itself:
A red run here is the correct outcome and is exactly what this wave is for.
Known defect, disclosed up front
⚠ hyperpolymath/standards#976 —
detectcounts*.nclinto its ecosystemdenominator, and the RSR template ships a six-file k9 Nickel set into every
seeded repository.
TOTALcan therefore be lifted above zero by templateboilerplate alone, which silences the zero-denominator refusal while nothing
meaningful has been checked. On a 24-repo sample, 9 would go vacuously
green that way.
This repository was chosen precisely because its verdict does not depend on
that contaminated signal. It has zero
.nclfiles, soTOTALis 0 whether or not the Nickel probe is corrected. The observation therefore surviveswhichever cure for #976 is chosen.
Deliberate choices
2eb9bb19,ci-pipeline.ymlblobd2583657), never@main— followingmainwould let one push instandardschange the verdict of every already-pinned caller with no reviewhere.
secrets:block at all.ci-pipeline.ymldeclaresworkflow_call.inputsonly, has nosecrets:block and references nosecrets.*anywhere.secrets: inheritwould hand the entire store to aworkflow that consumes none of it.
pull_request+workflow_dispatchonly, so the PR itself is theobservation.
actions.lockin this repository, so nothing to hand-edit. Measured separately: a reusable-workflow caller produces no lockfile findings at all —gh actions-lockv0.1.6 does not recognise reusable-workflowuses:paths.Please do not merge yet
The verdict is the deliverable. Once the run completes, the result is recorded
against the ledger, and only repositories that actually went red are added
— in a commit carrying a column-0
Ratchet-exception: .machine_readable/pipeline-allow.txt — <why>trailer.🤖 Generated with Claude Code
https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR