ci: converge on l9-ci-core@v1 kernels + repo hygiene - #31
Open
cryptoxdog wants to merge 3 commits into
Open
Conversation
…orted PyPI release workflow Per the L9 repository instantiation audit and remediation plan: - Move the 12 historical PR-remediation helper scripts (fix-*.sh, push-*.sh, s4036-fix.sh, sonar-fix.sh, transplant.sh, push-results.txt) out of the repository root into tools/pr-remediation/, and document them in a new tools/pr-remediation/README.md. These files had no consumer in package.json, workflows, or docs, so their presence at root wrongly implied they were part of the shipped project surface. - Remove .github/workflows/l9-release.yml. It is a Quantum-L9 org starter that publishes to PyPI (python-version 3.12, publish-to-pypi: true), which is inappropriate for this TypeScript/npm package. npm release is already handled by publish.yml. Nothing references l9-release.yml. No production source, build, or published-package files are changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ
…gate) Adapt the L9 shared CI target model (authored for Python) to this TypeScript/npm package. Routing architecture adopted verbatim; gates map to the repo's own npm scripts. - Add .github/scripts/classify_pr.py: changed-files-primary PR classifier with TS-aware surfaces (providers/vision/budget/control-plane), full L9 output set plus run_* routing booleans, unknown diffs fail closed. Validated across docs, app, security, workflow, dependency, contract, and unknown scenarios. - Add .github/workflows/pr-pipeline.yml: canonical "PR Pipeline Gate" job that classifies then routes to lint / build+types / test / security (npm scripts), aggregates with if: always(), contents: read, concurrency + cancel-in-progress. - Add governance policies: routing_policy, blocking_policy, comment_protocol. - Add .github/labels.yml namespaced taxonomy (automation/type/area/risk) as the provisioning source of truth. - Upgrade actions/checkout v4 -> v6 across all workflows, preserving SHA pinning (Scorecard hardening): 34e1148... -> d23441a... . - Document file-plane changes and the settings-plane roadmap (label provisioning, branch protection requiring the gate, secrets) in docs/ci/convergence.md. No production source is changed. classify_pr.py and every npm gate run clean locally (eslint, boundary probe, tsc build, type-check, declarations, 76 vitest tests, npm audit, package verify). Branch protection, label creation, and secrets are settings-plane actions and are intentionally NOT applied here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ
Reverse the repo-local classifier-first pipeline (a one-repo snowflake that followed the auditor's candidate spec) and align with the org's actual, live source of truth: l9-ci-core's language-aware @v1 compatibility kernels (verified against l9-ci-core HEAD and the @v1 tag — pr-pipeline.yml@v1 already detects Node and runs ESLint/tsc/Vitest; trio-governance.yml@v1 no-ops on non-tiered repos). Cut (divergent classifier architecture): - .github/scripts/classify_pr.py - .github/workflows/pr-pipeline.yml (repo-local canonical gate) - .github/governance/{routing_policy,blocking_policy,comment_protocol}.yaml - .github/labels.yml - docs/ci/convergence.md Rationalize the lint/typecheck/test overlap (was running 4x): - Remove .github/workflows/l9-lint-test-node.yml (copied template; its lint/typecheck/test are already provided by l9-pr-pipeline.yml@v1). - Remove .github/workflows/l9-node-ts-monorepo.yml (repo-local snowflake that duplicated typecheck/test and double-delegated the security/scorecard kernels already called by l9-security.yml / l9-scorecard.yml). Kept: - actions/checkout v4 -> v6 across the surviving workflows (org standard, SHA-pinned d23441a...; not divergent). - ci.yml as the repo-owned comprehensive contract gate (eslint boundary probe, package tarball contract + sha, declaration-consumer compile, 3-node matrix, npm audit, artifact roundtrip) — coverage no kernel provides. - All l9-* @v1 kernel callers + l9-analysis (v2 governed preset) + publish.yml + supply-chain.yml. Lint/typecheck/test now run in exactly two places with distinct roles: the org l9-pr-pipeline@v1 baseline-hygiene kernel and ci.yml's comprehensive matrix. NOTE (settings plane, not changed here): if branch protection required checks referenced the removed workflows' jobs, update the required-check list after merge or PRs will hang on never-reported checks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converge this repo's CI onto the org's single source of truth (
l9-ci-core@v1language-aware kernels), cut redundant repo-local workflows, and relocate stray remediation scripts out of the package root.Type of Change
What changed (net diff vs
main)Repo hygiene
fix-*.sh,push-*.sh,s4036-fix.sh,sonar-fix.sh,transplant.sh,push-results.txt) from the repo root intotools/pr-remediation/(git mv, history preserved) + a README documenting them. They had no consumer inpackage.json, workflows, or docs, so their presence at root wrongly implied shipped surface..github/workflows/l9-release.yml— a mis-imported org starter that published to PyPI (python-version: 3.12,publish-to-pypi: true), inappropriate for this TypeScript/npm package. npm release is already handled bypublish.yml.CI convergence
l9-lint-test-node.ymlandl9-node-ts-monorepo.yml. Both duplicated the lint/typecheck/test hygiene now provided by the language-awarel9-pr-pipeline.yml@v1; the monorepo workflow additionally double-delegated thesecurity/scorecardkernels already called byl9-security.yml/l9-scorecard.yml. Lint/typecheck/test previously ran across four workflows; it now runs in two with distinct roles (org baseline-hygiene kernel +ci.yml's comprehensive matrix).actions/checkoutv4 → v6 across the surviving workflows, SHA-pinned (d23441a…) to preserve Scorecard hardening.Kept intentionally
ci.ymlas the repo-owned comprehensive contract gate — eslint boundary probe, package tarball contract + sha, declaration-consumer compile, 3-node matrix (20/22/24),npm audit, artifact roundtrip. Coverage no kernel provides.l9-*@v1kernel callers,l9-analysis.yml(v2 governed preset),publish.yml,supply-chain.yml.Verified against live
l9-ci-core(HEAD + the@v1tag):pr-pipeline.yml@v1already detects Node and runs ESLint/tsc/Vitest, andtrio-governance.yml@v1no-ops on non-tiered repos — so the kernels cover this repo without a repo-local classifier.Verification
Ran locally on the branch — all green:
npm run lint,npm run lint:boundary,npm run build,npm run verify:types,npm run verify:declarationsnpm test→ 76 tests / 16 files passnpm audit --audit-level=high --omit=dev,npm run verify:packageNo production source changed — diff is
.github/**+tools/**only.Governance Checklist
@v1; convergence is toward the@v1kernelsRollback Plan
Low blast radius — CI-only, no source or published-package files. Revert the merge commit to restore the prior workflow set; no runtime or consumer impact.
Related Issues
Generated by Claude Code