ci: converge on l9-ci-core@v1 kernels + repo hygiene - #31
Open
cryptoxdog wants to merge 3 commits into
Open
Conversation
…orted PyPI release workflow Per the L9 repository instantiation audit and remediation plan: - Move the 12 historical PR-remediation helper scripts (fix-*.sh, push-*.sh, s4036-fix.sh, sonar-fix.sh, transplant.sh, push-results.txt) out of the repository root into tools/pr-remediation/, and document them in a new tools/pr-remediation/README.md. These files had no consumer in package.json, workflows, or docs, so their presence at root wrongly implied they were part of the shipped project surface. - Remove .github/workflows/l9-release.yml. It is a Quantum-L9 org starter that publishes to PyPI (python-version 3.12, publish-to-pypi: true), which is inappropriate for this TypeScript/npm package. npm release is already handled by publish.yml. Nothing references l9-release.yml. No production source, build, or published-package files are changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ
…gate) Adapt the L9 shared CI target model (authored for Python) to this TypeScript/npm package. Routing architecture adopted verbatim; gates map to the repo's own npm scripts. - Add .github/scripts/classify_pr.py: changed-files-primary PR classifier with TS-aware surfaces (providers/vision/budget/control-plane), full L9 output set plus run_* routing booleans, unknown diffs fail closed. Validated across docs, app, security, workflow, dependency, contract, and unknown scenarios. - Add .github/workflows/pr-pipeline.yml: canonical "PR Pipeline Gate" job that classifies then routes to lint / build+types / test / security (npm scripts), aggregates with if: always(), contents: read, concurrency + cancel-in-progress. - Add governance policies: routing_policy, blocking_policy, comment_protocol. - Add .github/labels.yml namespaced taxonomy (automation/type/area/risk) as the provisioning source of truth. - Upgrade actions/checkout v4 -> v6 across all workflows, preserving SHA pinning (Scorecard hardening): 34e1148... -> d23441a... . - Document file-plane changes and the settings-plane roadmap (label provisioning, branch protection requiring the gate, secrets) in docs/ci/convergence.md. No production source is changed. classify_pr.py and every npm gate run clean locally (eslint, boundary probe, tsc build, type-check, declarations, 76 vitest tests, npm audit, package verify). Branch protection, label creation, and secrets are settings-plane actions and are intentionally NOT applied here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ
Reverse the repo-local classifier-first pipeline (a one-repo snowflake that followed the auditor's candidate spec) and align with the org's actual, live source of truth: l9-ci-core's language-aware @v1 compatibility kernels (verified against l9-ci-core HEAD and the @v1 tag — pr-pipeline.yml@v1 already detects Node and runs ESLint/tsc/Vitest; trio-governance.yml@v1 no-ops on non-tiered repos). Cut (divergent classifier architecture): - .github/scripts/classify_pr.py - .github/workflows/pr-pipeline.yml (repo-local canonical gate) - .github/governance/{routing_policy,blocking_policy,comment_protocol}.yaml - .github/labels.yml - docs/ci/convergence.md Rationalize the lint/typecheck/test overlap (was running 4x): - Remove .github/workflows/l9-lint-test-node.yml (copied template; its lint/typecheck/test are already provided by l9-pr-pipeline.yml@v1). - Remove .github/workflows/l9-node-ts-monorepo.yml (repo-local snowflake that duplicated typecheck/test and double-delegated the security/scorecard kernels already called by l9-security.yml / l9-scorecard.yml). Kept: - actions/checkout v4 -> v6 across the surviving workflows (org standard, SHA-pinned d23441a...; not divergent). - ci.yml as the repo-owned comprehensive contract gate (eslint boundary probe, package tarball contract + sha, declaration-consumer compile, 3-node matrix, npm audit, artifact roundtrip) — coverage no kernel provides. - All l9-* @v1 kernel callers + l9-analysis (v2 governed preset) + publish.yml + supply-chain.yml. Lint/typecheck/test now run in exactly two places with distinct roles: the org l9-pr-pipeline@v1 baseline-hygiene kernel and ci.yml's comprehensive matrix. NOTE (settings plane, not changed here): if branch protection required checks referenced the removed workflows' jobs, update the required-check list after merge or PRs will hang on never-reported checks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ
|
There was a problem hiding this comment.
Pull request overview
This PR converges the repository’s CI configuration toward the org-standard l9-ci-core@v1 reusable workflow kernels, removes redundant/mis-scoped repo-local workflows, and relocates historical PR remediation scripts under tools/ for repo hygiene.
Changes:
- Removed redundant Node/TS CI workflows and an inappropriate PyPI-oriented release workflow.
- Updated remaining repo-owned workflows to use a SHA-pinned
actions/checkoutv6. - Moved historical remediation/transplant scripts into
tools/pr-remediation/and documented their purpose.
Reviewed changes
Copilot reviewed 7 out of 19 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/ci.yml |
Bumps SHA-pinned actions/checkout to v6 for the main CI workflow. |
.github/workflows/publish.yml |
Bumps SHA-pinned actions/checkout to v6 for the publish workflow. |
.github/workflows/supply-chain.yml |
Bumps SHA-pinned actions/checkout to v6 for SBOM/supply-chain workflow. |
.github/workflows/l9-release.yml |
Removes mis-imported org starter that publishes to PyPI (not applicable to this package). |
.github/workflows/l9-node-ts-monorepo.yml |
Removes redundant monorepo pipeline now covered by kernel-based CI. |
.github/workflows/l9-lint-test-node.yml |
Removes redundant lint/typecheck/test workflow now covered by kernel-based CI. |
tools/pr-remediation/README.md |
Documents the historical remediation scripts and why they were relocated. |
tools/pr-remediation/transplant.sh |
Adds historical script for rebuilding a transplant commit chain onto main. |
tools/pr-remediation/sonar-fix.sh |
Adds historical script for applying SonarCloud remediation across PR branches. |
tools/pr-remediation/s4036-fix.sh |
Adds historical script to remediate Sonar rule javascript:S4036 in PR branches. |
tools/pr-remediation/push-transplants.sh |
Adds historical script for pushing transplant branches to live PR heads. |
tools/pr-remediation/push-remediation.sh |
Adds historical script for pushing remediation branches with --force-with-lease. |
tools/pr-remediation/push-results.txt |
Adds recorded output from a historical push run. |
tools/pr-remediation/fix-sha-chain.sh |
Adds historical script to rebuild transplant chain fixing truncated action SHA pins. |
tools/pr-remediation/fix-readfile-chain.sh |
Adds historical script to rebuild transplant chain removing an unused import. |
tools/pr-remediation/fix-pin-prs.sh |
Adds historical script to bump a stale l9-ci-core pin across PR branches. |
tools/pr-remediation/fix-lockfile-chain.sh |
Adds historical script to rebuild transplant chain to handle missing lockfiles in CI. |
tools/pr-remediation/fix-eslint-chain.sh |
Adds historical script to rebuild transplant chain patching eslint.config.js. |
tools/pr-remediation/fix-boundary-chain.sh |
Adds historical script to rebuild transplant chain adding boundary lint rule where missing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+30
to
+32
| They are retained here, out of the package root, pending confirmation that | ||
| all referenced pull requests are merged or closed, at which point they can | ||
| be deleted. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converge this repo's CI onto the org's single source of truth (
l9-ci-core@v1language-aware kernels), cut redundant repo-local workflows, and relocate stray remediation scripts out of the package root.Type of Change
What changed (net diff vs
main)Repo hygiene
fix-*.sh,push-*.sh,s4036-fix.sh,sonar-fix.sh,transplant.sh,push-results.txt) from the repo root intotools/pr-remediation/(git mv, history preserved) + a README documenting them. They had no consumer inpackage.json, workflows, or docs, so their presence at root wrongly implied shipped surface..github/workflows/l9-release.yml— a mis-imported org starter that published to PyPI (python-version: 3.12,publish-to-pypi: true), inappropriate for this TypeScript/npm package. npm release is already handled bypublish.yml.CI convergence
l9-lint-test-node.ymlandl9-node-ts-monorepo.yml. Both duplicated the lint/typecheck/test hygiene now provided by the language-awarel9-pr-pipeline.yml@v1; the monorepo workflow additionally double-delegated thesecurity/scorecardkernels already called byl9-security.yml/l9-scorecard.yml. Lint/typecheck/test previously ran across four workflows; it now runs in two with distinct roles (org baseline-hygiene kernel +ci.yml's comprehensive matrix).actions/checkoutv4 → v6 across the surviving workflows, SHA-pinned (d23441a…) to preserve Scorecard hardening.Kept intentionally
ci.ymlas the repo-owned comprehensive contract gate — eslint boundary probe, package tarball contract + sha, declaration-consumer compile, 3-node matrix (20/22/24),npm audit, artifact roundtrip. Coverage no kernel provides.l9-*@v1kernel callers,l9-analysis.yml(v2 governed preset),publish.yml,supply-chain.yml.Verified against live
l9-ci-core(HEAD + the@v1tag):pr-pipeline.yml@v1already detects Node and runs ESLint/tsc/Vitest, andtrio-governance.yml@v1no-ops on non-tiered repos — so the kernels cover this repo without a repo-local classifier.Verification
Ran locally on the branch — all green:
npm run lint,npm run lint:boundary,npm run build,npm run verify:types,npm run verify:declarationsnpm test→ 76 tests / 16 files passnpm audit --audit-level=high --omit=dev,npm run verify:packageNo production source changed — diff is
.github/**+tools/**only.Governance Checklist
@v1; convergence is toward the@v1kernelsRollback Plan
Low blast radius — CI-only, no source or published-package files. Revert the merge commit to restore the prior workflow set; no runtime or consumer impact.
Related Issues
Generated by Claude Code