ci: standards ci-pipeline dry-run caller (observation, do not merge yet) - #121
Conversation
Adds a pinned caller for hyperpolymath/standards ci-pipeline.yml as part of the deliberate dry-run wave that seeds .machine_readable/pipeline-allow.txt by OBSERVATION rather than by inference. no actions.lock in this repository. Discloses hyperpolymath/standards#976 in the workflow header. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (23)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request adds a GitHub Actions workflow for standards checks. The workflow runs on pull requests and manual dispatch, uses read-only contents access, and calls a pinned reusable workflow without secrets. ChangesStandards pipeline
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Feature Merge Risk: ⚪ Minimal · up to This adds a read-only, pinned standards check with no evidenced production or data-integrity risk. The expected refusal is an intentional observation outcome. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit reads each line, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
What this is
A deliberate observation, not an adoption.
hyperpolymath/standardscarries a reusable pipeline,.github/workflows/ci-pipeline.yml, which as of today has zero callersanywhere in the estate. Its exemption ledger,
.machine_readable/pipeline-allow.txt, is seeded empty on purpose. Theledger's own text is explicit about how it may be filled:
This PR is one of five in that dry-run wave.
Expected verdict in this repository
detectcounts ecosystem markers on the default branch. Measured todayacross 93 tracked files:
So the pipeline is expected to REFUSE on a zero denominator: there is no
supported ecosystem here, and no unsupported one either. Rather than pass
vacuously, the workflow refuses and says nothing was checked. The workflow's
own reasoning:
A red run here is the correct outcome and is exactly what this wave is for.
Known defect, disclosed up front
⚠ hyperpolymath/standards#976 —
detectcounts*.nclinto its ecosystemdenominator, and the RSR template ships a six-file k9 Nickel set into every
seeded repository.
TOTALcan therefore be lifted above zero by templateboilerplate alone, which silences the zero-denominator refusal while nothing
meaningful has been checked. On a 24-repo sample, 9 would go vacuously
green that way.
This repository was chosen precisely because its verdict does not depend on
that contaminated signal. It has zero
.nclfiles, so the #976 template-boilerplate inflation cannot reach its denominator. The observation therefore surviveswhichever cure for #976 is chosen.
Deliberate choices
2eb9bb19,ci-pipeline.ymlblobd2583657), never@main— followingmainwould let one push instandardschange the verdict of every already-pinned caller with no reviewhere.
secrets:block at all.ci-pipeline.ymldeclaresworkflow_call.inputsonly, has nosecrets:block and references nosecrets.*anywhere.secrets: inheritwould hand the entire store to aworkflow that consumes none of it.
pull_request+workflow_dispatchonly, so the PR itself is theobservation.
.github/workflows/actions.lock, so no lock key was added.Please do not merge yet
The verdict is the deliverable. Once the run completes, the result is recorded
against the ledger, and only repositories that actually went red are added
— in a commit carrying a column-0
Ratchet-exception: .machine_readable/pipeline-allow.txt — <why>trailer.🤖 Generated with Claude Code
https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR