Repository navigation
fix(ci): wrapper permission union + standards re-pin to bd0df9e (post-lockfile follow-up) - #31
Conversation
…lint) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
At standards >= fcb8669 the governance/hypatia/mirror/scorecard reusables declare actions: read (hypatia adds security-events: write; scorecard adds id-token/security-events write). A reusable requesting more than its caller grants is a startup_failure — the third enforcement layer after the lockfile and the caller entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedGrants CI wrappers the permission union demanded by reusables and updates the standards pin to bd0df9e for lockfile-aware governance linting. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 6 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
#35) ## Summary Closes the banned-Python violation tracked in #31. `bitfuckit/integrations/git-cola/actions.py` was the last `.py` file in the repo. Python is banned and the SaltStack carve-out no longer applies (infra is Terraform/Ansible). git-cola's *plugin* API is Python-only, but the plugin only did thin `bitfuckit` CLI wrappers, so it's reimplemented as declarative git `guitool.*` config — git-cola's built-in Actions menu, no code — matching the existing lazygit/tortoisegit/lazygit integration pattern (declarative per-tool config files). - Deleted `git-cola/actions.py` - Added `git-cola/guitool.config` (5 actions: Create PR, List PRs, Mirror, Pipeline Status, Auth Status — under a `Bitbucket/` submenu) - Updated `integrations/README.adoc` install instructions - **Repo now contains zero `.py` files** ## CI note `antipattern-check`'s Python step will now pass (no `.py` anywhere). The `Hypatia Neurosymbolic Analysis` job is the separate pre-existing flaky scanner (unrelated; maintainer is patching it). Follow-up #32 will strip the now-dead SaltStack carve-out from the workflow/policy. ## Test plan - [ ] `git ls-files | grep '\.py$'` returns nothing - [ ] `git config include.path` pointing at `guitool.config` makes the actions appear in git-cola's Actions menu - [ ] Each action invokes the correct `bitfuckit` subcommand Refs #31 https://claude.ai/code/session_01LKw5BvbbxFUWi9YMogGJTL --- _Generated by [Claude Code](https://claude.ai/code/session_01LKw5BvbbxFUWi9YMogGJTL)_ Co-authored-by: Claude <noreply@anthropic.com>
1 participant
The lockfile PR merged before this branch's final commits. This carries the remainder: reusable wrappers granted the permission union their reusables demand at standards >= fcb8669 (actions: read; hypatia adds security-events: write; scorecard adds id-token + security-events: write — a reusable requesting more than its caller grants is a startup_failure), and the standards re-pin bumped to bd0df9e (lockfile-aware governance lint via standards#574).
🤖 Generated with Claude Code