feat: populate the org defaults for mzizi-dev - #1
Merged
Merged
Conversation
Until now this repo held a one-line README, so the eight other repos in
the org inherited nothing: no CODEOWNERS, no issue or PR templates, no
security policy, and no shared CI. Only `mzizi-registry` had any of those,
and it has them locally, which means they cover one repo out of nine.
Everything here was read off the GitHub API before it was written down.
ORG_STANDARDS.md describes the CI that actually runs in each repo today
and lists twelve things that do not exist, rather than describing the
intended state as if it were the current one.
Three reusable workflows, chosen for what this org actually is — Rust
first, not npm first:
- reusable-rust-ci.yml takes a `target` input and a separate
`clippy-on-target` boolean. Two of the three Rust repos ship as WASM
(mzizi-console in a browser, mzizi-api-gateway on workerd) and code
can pass every native check and still fail to compile for the target
that ships. The two repos need different answers — mzizi-console
lints on the host and checks wasm32, mzizi-api-gateway must lint
against wasm32 because the `worker` crate's API is cfg'd for it — so
one knob would have forced them onto the same wrong answer.
- reusable-gitleaks.yml runs the MIT binary directly. The
gitleaks/gitleaks-action wrapper needs a paid licence for org repos.
- reusable-pr-title-lint.yml enforces Conventional Commits on the PR
title.
Third-party actions are pinned by commit SHA, not tag; a tag can be moved
to point at different code. The resolved versions are recorded in
ORG_STANDARDS.md so a future reader can tell a pin from a guess.
No repo calls these yet. Publishing and adopting in one change would move
nine repos with no baseline to compare against; adoption is a small PR per
repo, and this repo's own ci.yml dogfoods two of the three by local path
so a change to a reusable is tested by the PR that makes it.
github-rulesets/*.json are proposals and are NOT applied. Note that the
org-wide one deliberately omits `required_linear_history`: that rule
blocks merge commits, and a merge commit is the only merge this org
permits. mzizi-registry's existing ruleset has exactly that combination
today, which is gap 4.
The docs reflect the merge-only convention throughout, per MIGRATION.md
§1.1 — "Squash discards the per-commit reasoning this project depends on".
One correction to the brief this was written against: the org has two
members, @bryanfawcett (admin) and @michellellawson (member), not one.
There are no teams, which is why CODEOWNERS names users.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
"is the second workflow" told a reader nothing. It dispatches to a held-out runner named by a repo variable, and it is fork-guarded — both worth knowing, because the held-out task set is withheld on purpose (MIGRATION.md §5: "withheld so the benchmark measures the language rather than memorisation") and a reader who does not know that might reasonably try to make the dispatch target public. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
actionlint's shellcheck pass failed on `cargo test $EXTRA` with SC2086. The word splitting was intentional — test-args is an argument list — but the unquoted form also glob-expands, which was not intentional, so the warning was correct and the original comment defending the line was wrong. `read -ra` splits and does not glob. An empty input yields an empty array, which is safe under `set -u` from bash 4.4 onward; ubuntu-latest ships bash 5. Worth recording how this got through: actionlint was run locally before pushing and reported clean, because shellcheck is not installed on this machine and actionlint silently skips the shellcheck rules when the binary is missing. A clean local actionlint is therefore weaker evidence than it looks. The CI job, which runs on a runner that has shellcheck, is the one that counts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The settings sweep behind those two rows iterated eight repos and missed mzizi-site, so the counts were taken over a sample that did not include it. mzizi-site has has_wiki false and an Apache-2.0 licence, which moves wikis to four-off/five-on and licences to seven-of-nine. Small numbers, but this page's whole claim is that it reports what is there rather than what is expected, so an off-by-one from an incomplete sweep is exactly the defect it should not have. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This repo pins third-party actions by SHA, but GitHub has an org setting that enforces it (`sha_pinning_required`) and it is false. A convention that only lives in review comments is weaker than one the platform checks, so the setting belongs in the gap list next to the convention. Noting honestly that it cannot simply be switched on: every existing workflow in the org uses floating tags, so enabling it would break them all until they are pinned. The same endpoint shows `default_workflow_permissions: write`, which gives every workflow a read-write token by default. Recorded alongside it because it is the same one-line admin decision and the same argument. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Turns this repo from a one-line README into the org's actual defaults:
CODEOWNERS, PR and issue templates,SECURITY.md/CONTRIBUTING.md/CODE_OF_CONDUCT.md/SUPPORT.md, three reusable workflows, versioned ruleset JSON, andORG_STANDARDS.md.Why
GitHub falls back to this repo for any repo in the org lacking its own community-health files. Until now it held
# .github, so eight of the nine repos inherited nothing.mzizi-registryis the only repo with its own — and two of its files are broken (gaps 1 and 2 below), so review routing and the security-report path currently work in zero repos.Everything was verified before it was written down
ORG_STANDARDS.mddescribes the CI that actually runs per repo today, read off the API, and lists twelve things that do not. Claims checked rather than assumed: merge settings on all nine repos, every workflow file, org and repo rulesets, branch protection, org membership and teams, secret-scanning and private-vulnerability-reporting state per repo, action tag→SHA resolutions, gitleaks' licence, andnyuchi/.github's Rust reusable.One correction to the brief: the org has two members —
@bryanfawcett(admin) and@michellellawson(member) — not one. There are no teams, which is whyCODEOWNERSnames users, not a@mzizi-dev/...handle.The reusable workflows
Rust-first, not npm-first.
reusable-rust-ci.yml— fmt / clippy / test, plus atargetinput and a separateclippy-on-targetboolean. Two of the three Rust repos ship as WASM (mzizi-consolein a browser,mzizi-api-gatewayon workerd), and code can pass every native check and fail to compile for the target that ships. The two repos need different answers —mzizi-consolelints on the host then checks wasm32;mzizi-api-gatewaymust lint against wasm32 because theworkercrate's API iscfg'd for it — so one knob would have forced them onto the same wrong answer. Aworking-directoryinput coversmzizi, whose crate is incompiler/.reusable-gitleaks.yml— runs the MIT binary directly;gitleaks/gitleaks-actionrequires a paid licence for org repos. Defaults to 8.21.2, the version every repo already runs, so adopting it changes no behaviour.reusable-pr-title-lint.yml— Conventional Commits on the PR title.Third-party actions are pinned by commit SHA, not tag. Resolutions recorded in
ORG_STANDARDS.mdso a reader can tell a pin from a guess.No repo calls these yet, deliberately — publishing and adopting at once would move nine repos with no baseline. This repo's own
ci.ymldogfoods two of the three by local path (uses: ./...), so a change to a reusable is tested by the PR that makes it, not by the already-merged copy.Merge-only
Reflected throughout, per
mzizi/MIGRATION.md§1.1 — "Squash discards the per-commit reasoning this project depends on." The docs also get specific about a consequence that is easy to miss: every repo ismerge_commit_message=PR_TITLE, so the PR title is the merge commit body, not its subject — which changes what the title lint is actually guarding.Rulesets are NOT applied
github-rulesets/*.jsonare reviewable proposals; the apply command is in each file's_comment. Note the org-wide one deliberately omitsrequired_linear_history: that rule blocks merge commits, and a merge commit is the only merge this org permits.mzizi-registry's existing ruleset has exactly that combination today — gap 4.Gaps documented rather than fixed
They live in other repos or need an admin decision. Highlights:
mzizi-registry'sCODEOWNERSnames@nyuchi/core— wrong org, andnyuchihas nocoreteam. It assigns nobody, and it overrides this repo's.SECURITY.mdroutes around it tomzizi.mzizi-registry's ruleset requires linear history while the repo allows only merge commits — the next merge-button merge there should be rejected.mzizi-registryfilters PR triggers on[main]alone, so stacked PRs above the bottom layer get zero checks.Full list with evidence in
ORG_STANDARDS.md.Checks
actionlintclean on all five workflow files.rulesets parsestep was executed locally, not just eyeballed.🤖 Generated with Claude Code