chore(governance): adopt wellmanifest new-project 0.20.33 (ticket-172)

.gitattributes

@@ -0,0 +1,3 @@
+# Wellmanifest new-project standard git attributes
+project/TICKETS.md merge=wellmanifest-ticket-index
+TODO.md merge=wellmanifest-ticket-index

.github/workflows/new-project-governance.yml

@@ -66,11 +66,17 @@ jobs:
         shell: bash
         env:
           BRANCH_LIFECYCLE_SNAPSHOT: ${{ runner.temp }}/new-project-branch-lifecycle.json
+          HEAD_REF: ${{ github.head_ref }}
         run: |
-          python3 .governance/branch_lifecycle_check.py \
-            --snapshot "$BRANCH_LIFECYCLE_SNAPSHOT" \
-            --expected-repository "$GITHUB_REPOSITORY" \
+          arguments=(
+            --snapshot "$BRANCH_LIFECYCLE_SNAPSHOT"
+            --expected-repository "$GITHUB_REPOSITORY"
             --format text
+          )
+          if [[ -n "${HEAD_REF:-}" ]]; then
+            arguments+=(--focus-branch "$HEAD_REF")
+          fi
+          python3 .governance/branch_lifecycle_check.py "${arguments[@]}"
 
   enforce:
     name: governance / enforce
@@ -110,7 +116,5 @@ jobs:
           # has no range, so it validates the repository as it stands.
           if [[ -n "${BASE_SHA:-}" && -n "${HEAD_SHA:-}" ]]; then
             arguments+=(--base "$BASE_SHA" --head "$HEAD_SHA")
-          else
-            arguments+=(--changed-file project/TICKETS.md)
           fi
           python3 .governance/governance_check.py "${arguments[@]}"

.governance/branch_lifecycle_check.py

@@ -131,9 +131,10 @@ def parse_snapshot(value: Any, expected_repository: str | None) -> dict[str, Any
     }
 
 
-def evaluate(snapshot: dict[str, Any]) -> list[Finding]:
-    findings: list[Finding] = []
+def evaluate(snapshot: dict[str, Any], focus_branch: str | None = None) -> list[Finding]:
     repository = snapshot["repository"]
+    branch_set = set(snapshot["branches"])
+    findings: list[Finding] = []
     if not snapshot["deleteBranchOnMerge"]:
         findings.append(Finding(
             code="GOV-BRANCH-LIFECYCLE-001",
@@ -143,7 +144,6 @@ def evaluate(snapshot: dict[str, Any]) -> list[Finding]:
             evidence={"repository": repository, "deleteBranchOnMerge": False},
         ))
 
-    branch_set = set(snapshot["branches"])
     internal_heads = {
         item["headRef"]
         for item in snapshot["openPullRequests"]
@@ -162,6 +162,8 @@ def evaluate(snapshot: dict[str, Any]) -> list[Finding]:
 
     allowed = {snapshot["defaultBranch"], *internal_heads}
     orphaned = sorted(branch_set - allowed)
+    if focus_branch is not None:
+        orphaned = [b for b in orphaned if b == focus_branch]
     if orphaned:
         findings.append(Finding(
             code="GOV-BRANCH-LIFECYCLE-002",
@@ -206,6 +208,10 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--snapshot", required=True, type=Path)
     parser.add_argument("--expected-repository")
     parser.add_argument("--format", choices=("text", "json"), default="text")
+    parser.add_argument(
+        "--focus-branch",
+        help="When validating in the context of a pull request, evaluate orphan status specifically for this branch.",
+    )
     args = parser.parse_args(argv)
 
     expected_repository: str | None = None
@@ -220,7 +226,7 @@ def main(argv: list[str] | None = None) -> int:
         with args.snapshot.open("r", encoding="utf-8") as handle:
             raw = json.load(handle)
         snapshot = parse_snapshot(raw, expected_repository)
-        findings = evaluate(snapshot)
+        findings = evaluate(snapshot, focus_branch=args.focus_branch)
     except (OSError, json.JSONDecodeError, SnapshotError) as error:
         findings = [Finding(
             code="GOV-BRANCH-LIFECYCLE-003",

.governance/generate_required_checks.py

@@ -54,6 +54,19 @@ def published_checks_text(text: str, callers: list[str]) -> list[str]:
     """
     if "pull_request" not in text:
         return []  # A workflow that never runs on a PR cannot gate one.
+    # A pull_request trigger with exclusively the 'closed' type publishes
+    # checks that run after the merge decision, never before.  They cannot
+    # gate a pull request and must not inflate the required-checks declaration.
+    has_closed_type = bool(re.search(r"\btypes:\s*\[\s*closed\s*\]", text)) or bool(
+        re.search(r"\btypes:\s*\n\s*-\s*closed\b", text)
+    )
+    has_gating_types = bool(
+        re.search(r"\btypes:\s*\[.*\b(?:opened|synchronize|reopened|ready_for_review)\b", text)
+    ) or bool(
+        re.search(r"\btypes:\s*\n(?:\s*-[^\n]*\n)*\s*-\s*(?:opened|synchronize|reopened|ready_for_review)\b", text)
+    )
+    if has_closed_type and not has_gating_types:
+        return []
     names: list[str] = []
     current: str | None = None
     calls_reusable = False