ci: the three SDLC gates (decisions, verification, review) - #475
Open
rita-aga wants to merge 9 commits into
Open
ci: the three SDLC gates (decisions, verification, review)#475rita-aga wants to merge 9 commits into
rita-aga wants to merge 9 commits into
Conversation
The enforced stages of the loop as required CI checks: - sdlc-decisions: no PR without a shaped decision log - sdlc-verification: no merge without proof (skips PRs that change no app code) - sdlc-review: no merge without a review record; cost-tiered (computer > cursor > model APIs), the computer runs the panel on flat subscriptions Pilot on temperpaw. All three fetch their gate logic from arni-labs/stack. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+38
to
+39
| CODE=$(git diff --name-only "${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}" | grep -vE '^(\.github/|docs/|\.agents/|\.claude/|\.cursor/|README|.*\.md$)' || true) | ||
| if [ -z "$CODE" ]; then echo "needs=false" >> "$GITHUB_OUTPUT"; echo "No app code changed - proof not required."; else echo "needs=true" >> "$GITHUB_OUTPUT"; fi |
There was a problem hiding this comment.
When the base commit is absent from the default depth-one checkout, git diff fails, but the pipeline suppresses the error and leaves CODE empty. The workflow then sets needs=false, allowing an application-code PR to pass without requiring or validating proof.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/sdlc-verification.yml
Line: 38-39
Comment:
**Diff failures bypass proof**
When the base commit is absent from the default depth-one checkout, `git diff` fails, but the pipeline suppresses the error and leaves `CODE` empty. The workflow then sets `needs=false`, allowing an application-code PR to pass without requiring or validating proof.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Comment on lines
+57
to
+61
| if: ${{ env.VERCEL_TOKEN != '' }} | ||
| env: | ||
| VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} | ||
| VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} | ||
| VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} |
There was a problem hiding this comment.
When the documented Vercel secrets are configured, this condition still sees an empty VERCEL_TOKEN because the variable is defined only in the same step's env block. The deployment is therefore always skipped, and the PR comment incorrectly falls back to the artifact while reporting that Vercel secrets are unset.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/sdlc-verification.yml
Line: 57-61
Comment:
**Deployment condition always skips**
When the documented Vercel secrets are configured, this condition still sees an empty `VERCEL_TOKEN` because the variable is defined only in the same step's `env` block. The deployment is therefore always skipped, and the PR comment incorrectly falls back to the artifact while reporting that Vercel secrets are unset.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Review — ci the three SDLC gates decisions verification review: FAILPanel: grok, codex, fable, greptile Full effort report (proof + review) linked from the verification comment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vendors the enforced SDLC-loop gates into temperpaw as required CI checks. This is the pilot that runs all three gates on a real PR (ARN-411).
Decisions & Tradeoffs
Verification
Workflow-only change — the verification gate skips by design. The decisions gate reads this PR body (this section satisfies it). The review gate runs the computer panel on the diff. Watching the checks on this PR is the proof.
Authored by Fable 5 via Claude Code.
Greptile Summary
The PR adds three GitHub Actions workflows enforcing decision records, implementation proof, and review records.
Confidence Score: 3/5
The PR is not yet safe to merge because application changes can bypass proof validation and configured Vercel report deployments are still skipped.
The verification workflow suppresses failures when diffing against a base commit absent from its shallow checkout, classifying application changes as not requiring proof. Its deployment condition also reads a token unavailable at that evaluation scope, preventing the configured protected report deployment.
Files Needing Attention: .github/workflows/sdlc-verification.yml
Important Files Changed
Reviews (6): Last reviewed commit: "ci: re-trigger review (all reviewers lea..." | Re-trigger Greptile