docs: summarise generated pipeline workflow and hook files - #1012
Merged
Merged
Conversation
Closing deliverable of the zero-cost quality/security/coverage/mirroring
pipeline brief: a single inventory of every generated hook and workflow
file, what each actually checks, and how to enable the hooks locally.
Covers .githooks/ (18 files, all 100755 -- a 100644 validator passes
locally and dies in CI at exit 126), the ten jobs of ci-pipeline.yml
mapped onto the brief's four, and the mirroring workflows.
States two limitations rather than smoothing them over:
- Job 3 appends its table to $GITHUB_STEP_SUMMARY and uploads nothing,
so a code_coverage ruleset rule is unsatisfiable against this pipeline
BY DESIGN -- the mirror image of a vacuous gate, a gate that can never
say yes. code_coverage is one of the four retired rule types.
- core.hooksPath is per-clone local config, so a fresh clone has no hooks
until the setup command is run. CI is the only unskippable enforcement.
Records the Part-3 safety rules as implemented: CI formatters run only in
--check form, no --fix anywhere in CI, secrets referenced solely as
${{ secrets.NAME }} and never inlined into a run: body, never --no-verify.
Written as AsciiDoc per ADR-004 (canonical estate-wide); the brief's
Markdown rendering is delivered to the owner separately.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
Contributor
|
Warning Review limit reachedNext included review available in 15 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
docs/PIPELINE-AND-HOOKS-SUMMARY.adoc— the closing deliverable of thezero-cost quality / security / coverage / mirroring pipeline brief, which asked
for "a concise summary of all generated workflow and hook files". It had never
been produced.
One document, no code changes, no workflow changes.
What it covers
.githooks/— all 18 files, the four entry-point hooks and the ten validators each invokes, which two are required at commit (validate-gitleaks.sh,validate-lint-format.sh) and which eight are advisoryci-pipeline.yml— its ten jobs mapped onto the brief's four, plus the mirroring workflowsIt includes the local setup line the brief mandates verbatim:
git config core.hooksPath .githooksTwo limitations it states rather than smooths over
Job 3's coverage table cannot satisfy a
code_coverageruleset rule. Thebrief required no external coverage service, so
reportappends a Markdowntable to
$GITHUB_STEP_SUMMARYand uploads nothing to GitHub. Acode_coveragerule demanding e.g.
minimum_coverage: 95against these repos is thereforeunreachable by design — the mirror image of a vacuous gate: a gate that can
never say yes. This is why
code_coverageis one of the four retired ruletypes, and the document says so at the point where a reader would otherwise
assume the number was merely not yet met.
Hook enablement is per clone.
core.hooksPathis local configuration; afresh clone has no hooks until the command above is run. CI is the only
enforcement that cannot be skipped by forgetting a setup step.
It also records why a green mirror run is not evidence mirroring authenticated:
a secret that does not exist resolves to the empty string silently.
Format
AsciiDoc, per ADR-004 (canonical estate-wide — 1072
.adocvs 135.mdintree), with the estate's two SPDX header lines. The brief's Markdown rendering
is delivered to the owner separately; committing a
.mdunderdocs/wouldhave contradicted the repo's own documentation-format gate.
Verification
docs/is.adoc-only in tree; header matchesdocs/CICD-SIGNAL-DISCIPLINE.adocorigin/main, not recalledGood "git" signature)🤖 Generated with Claude Code
https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR