From 3abb11eb198e78bc61cf87a5950d0ba16c5866e8 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Thu, 1 Oct 2026 14:32:28 -0700 Subject: [PATCH 1/3] Declare Python and Codecov on Blog's Registry Entry Blog adopted the hub Python profiles, with checks/ lint-only and scripts/ a pip directory, both passed in python-directories by every validator caller, and CODECOV_TOKEN in both secret stores. Add python to its types, CODECOV_TOKEN to requiredSecrets, and pythonDirectories checks and scripts. Reword the environment-secrets note that said requiredSecrets stays empty, and record why capture/ stays undeclared. Co-Authored-By: Claude Opus 5.5 --- registry/repos.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/registry/repos.json b/registry/repos.json index 9e341a098..fa13c7590 100644 --- a/registry/repos.json +++ b/registry/repos.json @@ -306,17 +306,18 @@ "name": "Blog", "url": "https://github.com/ptr727/Blog", "status": "cataloged", - "types": ["hugo", "source-only"], + "types": ["hugo", "source-only", "python"], "groundTruthBranch": "main", "workflowModel": "release", "lineEndings": "lf", "hasDevelop": true, "publish": [{ "target": "github-release", "mechanism": "none" }, { "target": "self-hosted", "mechanism": "static-secret" }], - "requiredSecrets": [], + "requiredSecrets": ["CODECOV_TOKEN"], "environments": [{ "name": "production", "branchPolicy": "none" }, { "name": "staging", "branchPolicy": "none" }], "consumerModel": "pull", "releaseTrigger": "dispatch-only", - "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "Deploy credentials are per-environment GitHub Environment secrets and variables, which spec/secrets.json has no vocabulary for, so requiredSecrets stays empty and the names are declared in this repo's own secrets.json environments block; listing them here would make the audit demand them in the repository actions store.", "Neither deployment environment carries a branch policy, deliberately: the ref gate that admits production from the default branch only runs as a job in the deploy workflow, before anything is installed or written (WORKFLOW.md D2.1). branchPolicy none records that, so a policy appearing later reads as a change rather than as the gate arriving."] + "pythonDirectories": ["checks", "scripts"], + "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "Deploy credentials are per-environment GitHub Environment secrets and variables, which spec/secrets.json has no vocabulary for, so requiredSecrets leaves them out and the names are declared in this repo's own secrets.json environments block; listing them here would make the audit demand them in the repository actions store.", "Neither deployment environment carries a branch policy, deliberately: the ref gate that admits production from the default branch only runs as a job in the deploy workflow, before anything is installed or written (WORKFLOW.md D2.1). branchPolicy none records that, so a policy appearing later reads as a change rather than as the gate arriving.", "capture/ is one-shot WordPress migration tooling that has already run, so it owes no test suite and stays outside pythonDirectories, so the audit's python-directories drift naming capture/ files is expected."] }, { "name": "DiskSpeedTest", From bafe9d90ddcec2b107f91a96f44071197637c240 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Thu, 1 Oct 2026 14:36:23 -0700 Subject: [PATCH 2/3] Record the capture/ Exclusion as a Maintainer Deviation Co-Authored-By: Claude Opus 5.5 --- registry/repos.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry/repos.json b/registry/repos.json index fa13c7590..0893a4de0 100644 --- a/registry/repos.json +++ b/registry/repos.json @@ -317,7 +317,7 @@ "consumerModel": "pull", "releaseTrigger": "dispatch-only", "pythonDirectories": ["checks", "scripts"], - "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "Deploy credentials are per-environment GitHub Environment secrets and variables, which spec/secrets.json has no vocabulary for, so requiredSecrets leaves them out and the names are declared in this repo's own secrets.json environments block; listing them here would make the audit demand them in the repository actions store.", "Neither deployment environment carries a branch policy, deliberately: the ref gate that admits production from the default branch only runs as a job in the deploy workflow, before anything is installed or written (WORKFLOW.md D2.1). branchPolicy none records that, so a policy appearing later reads as a change rather than as the gate arriving.", "capture/ is one-shot WordPress migration tooling that has already run, so it owes no test suite and stays outside pythonDirectories, so the audit's python-directories drift naming capture/ files is expected."] + "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "Deploy credentials are per-environment GitHub Environment secrets and variables, which spec/secrets.json has no vocabulary for, so requiredSecrets leaves them out and the names are declared in this repo's own secrets.json environments block; listing them here would make the audit demand them in the repository actions store.", "Neither deployment environment carries a branch policy, deliberately: the ref gate that admits production from the default branch only runs as a job in the deploy workflow, before anything is installed or written (WORKFLOW.md D2.1). branchPolicy none records that, so a policy appearing later reads as a change rather than as the gate arriving.", "capture/ is one-shot WordPress migration tooling that has already run, so the maintainer kept it out of pythonDirectories (Blog #356, 2026-10-01), forgoing the lint, type-check, and test obligations every declared Python directory owes. The audit's python-directories drift naming capture/ files is therefore expected."] }, { "name": "DiskSpeedTest", From 3ed0448d4d2dc74b171640d6444d4e2492c6546a Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Thu, 1 Oct 2026 14:38:01 -0700 Subject: [PATCH 3/3] Name Every Obligation the capture/ Exclusion Forgoes Co-Authored-By: Claude Opus 5.5 --- registry/repos.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry/repos.json b/registry/repos.json index 0893a4de0..a120f2219 100644 --- a/registry/repos.json +++ b/registry/repos.json @@ -317,7 +317,7 @@ "consumerModel": "pull", "releaseTrigger": "dispatch-only", "pythonDirectories": ["checks", "scripts"], - "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "Deploy credentials are per-environment GitHub Environment secrets and variables, which spec/secrets.json has no vocabulary for, so requiredSecrets leaves them out and the names are declared in this repo's own secrets.json environments block; listing them here would make the audit demand them in the repository actions store.", "Neither deployment environment carries a branch policy, deliberately: the ref gate that admits production from the default branch only runs as a job in the deploy workflow, before anything is installed or written (WORKFLOW.md D2.1). branchPolicy none records that, so a policy appearing later reads as a change rather than as the gate arriving.", "capture/ is one-shot WordPress migration tooling that has already run, so the maintainer kept it out of pythonDirectories (Blog #356, 2026-10-01), forgoing the lint, type-check, and test obligations every declared Python directory owes. The audit's python-directories drift naming capture/ files is therefore expected."] + "driftNotes": ["Hugo static site migrated off WordPress.com, stood up 2026-08-01; release model with a dispatch-only publisher that cuts the tag and a source archive.", "lineEndings lf on a release repo, where the rule grants the native-platform default to operational repos only: every consumer is Linux (the Hugo build, the Caddy container, and the rsync deploy).", "content/ is an imported WordPress archive, so the prose, spelling, and style gates are scoped to exclude it.", "Deploy credentials are per-environment GitHub Environment secrets and variables, which spec/secrets.json has no vocabulary for, so requiredSecrets leaves them out and the names are declared in this repo's own secrets.json environments block; listing them here would make the audit demand them in the repository actions store.", "Neither deployment environment carries a branch policy, deliberately: the ref gate that admits production from the default branch only runs as a job in the deploy workflow, before anything is installed or written (WORKFLOW.md D2.1). branchPolicy none records that, so a policy appearing later reads as a change rather than as the gate arriving.", "capture/ is one-shot WordPress migration tooling that has already run, so the maintainer kept it out of pythonDirectories (Blog #356, 2026-10-01), forgoing the lint, format, type-check, test, and coverage obligations every Python directory owes. The audit's python-directories drift naming capture/ files is therefore expected."] }, { "name": "DiskSpeedTest",