Repository navigation
Bump the Stale Hub Snippet Pins and Document the Fallback's Mixed-Pair Refusal - #3829
Merged
Merged
Conversation
…r Refusal The merge-bot and codegen caller snippets pinned releases older than the prose gate's non-UTF-8 fix. Both now pin the current release, after checking each callee's workflow_call at that commit. GOVERNANCE.md "Hub-Hosted Tooling" says the uses: pin is the one Dependabot keeps current, so the doc gates' never-pinned rule does not reach it. The unresolved-commit fallback's refusal on differing reads, and the re-run remedy, is stated where that fallback is documented. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Owner
Author
|
A recorded local strict-review pass covers head |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The review found no active issues, with the workflow pin updates and related fallback documentation changes addressed.
No open issues 🎉
What changed in this PR
This pull request updates two stale workflow pins to release 2.0.1319 and documents the fallback’s mixed-pair refusal and retry behavior.
Changes:
- Updates the merge-bot and periodic codegen workflow pins to commit
320713d9. - Clarifies Dependabot’s responsibility for maintaining reusable-workflow pins.
- Documents fallback consistency checks in governance and hook README files.
This pull request is ready to be approved.
| File | Description |
|---|---|
GOVERNANCE.md |
Documents workflow pin maintenance and mixed-pair fallback refusal. |
catalog/snippets/workflows/run-periodic-codegen-pull-request.yml |
Updates the periodic codegen workflow pin. |
catalog/snippets/workflows/merge-bot-pull-request.yml |
Updates the merge-bot workflow pin. |
catalog/snippets/pre-commit/README.md |
Documents fallback consistency behavior for pre-commit users. |
catalog/snippets/husky/README.md |
Documents fallback consistency behavior for Husky users. |
Review effort: Lite
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #3829 +/- ##
===========================================
+ Coverage 81.60% 82.91% +1.30%
===========================================
Files 26 29 +3
Lines 9070 9750 +680
===========================================
+ Hits 7402 8084 +682
+ Misses 1668 1666 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This was referenced Nov 2, 2026
ptr727
added a commit
that referenced
this pull request
Nov 3, 2026
…rge on a Running Hosted Review, and Gate Skill Description Length (#3843) Promotes the changes merged into `develop` since promotion #3797 to `main`, the end of an away-mode backlog burndown. - [#3803](#3803) exempts the Roslyn embedded-language marker (`// lang=json`, `language=`) from the prose gate's comment rules as a tool directive. - [#3807](#3807) has `local_review.py record` take `--report`, the file the reviewer wrote, bind the pass to its sha256, and derive the finding count from it. `status` gains `reportPath`. - [#3809](#3809) holds `pr_review.py merge` while a hosted review is still running on the head, and routes a declined Qodo finding to a dismiss request. - [#3811](#3811) dates an anchored `intentRef` by the section its anchor names, and lets a `driftNote` acknowledge a verified intent advisory. - [#3816](#3816) moves the null GraphQL node check into the shared `gh_graphql` transport as `NullNodeError`. - [#3818](#3818) explains the workspace-edit default in `GOVERNANCE.md` and names the aggregator's expression form. - [#3822](#3822) moves the abandon discard to the `backlog-burndown` orchestrator, aligns the abandoned-branch delete, and holds a grown agent-safety set. - [#3823](#3823) scopes the Husky prose gate to staged paths and adds `--skip-generated` so a named file inside a generated tree is skipped. - [#3828](#3828) reads Copilot's `Open findings:` label, drops the duplicate `null_node`, and matches `scripts/README.md` to the Merge Gate. - [#3829](#3829) bumps the two stale hub caller snippet pins and documents the fallback's mixed-pair refusal. - [#3831](#3831) keeps an inherited `GIT_DIR` from rerooting the prose gate's subdirectory git reads. - [#3832](#3832) gives `backlog-burndown` a disposition for a worker's standalone clone and keeps the agent-safety hold past a park. - [#3835](#3835) makes `carry.py check-sections` refuse what `apply-sections` would, and name an open fence. - [#3836](#3836) pins the reusable-workflow stubs by placeholder and ticks the PlexCleaner gates item. - [#3838](#3838) has the `runtime-secrets` audit dimension detect a bare `secrets/` directory from the tracked files that name it. - [#3839](#3839) gates skill descriptions at the 1024-character limit and trims every one over it. - [#3846](#3846) fixes an adjacent doc, an in-file pre-existing defect, and an edge case on new code in the open pull request instead of filing an issue for each, and keeps filing for code that runs elsewhere. - [#3847](#3847) refuses skill frontmatter that parses to a list or a scalar, so the description length gate cannot be bypassed. Fixes #3770 Fixes #3699 Fixes #3705 Fixes #3789 Fixes #1819 Fixes #727 Fixes #3710 Fixes #3706 Fixes #3623 Fixes #3687 Fixes #3617 Fixes #3757 Fixes #3790 Fixes #3786 Fixes #3785 Fixes #3772 Fixes #1657 Fixes #3443 Fixes #3824 Fixes #3817 Fixes #3805 Fixes #1666 Fixes #3700 Fixes #3821 Fixes #3771 Fixes #3794 Fixes #3825 Fixes #3690 Fixes #1472 Fixes #3813 Fixes #3719 Fixes #1592 Fixes #3845 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
merge-bot-pull-request.yml(was 2.0.338) andrun-periodic-codegen-pull-request.yml(was 2.0.352), to the 2.0.1319 release commit320713d9. Each snippet'ssecrets:matches the callee'sworkflow_callat that commit. The merge-bot's optionalrules,delete-branchandapp-logininputs, which the snippet's comments name, all exist there. The codegen callee dropped its optionalNINJA_API_KEYsecret, which the snippet never passed.test-pull-request.yml,publish-release.ymlandtest-pull-request-smoke.ymlwere already past the prose gate's non-UTF-8 fix and are unchanged.uses:pins incatalog/snippets/workflows/stay SHA pins, or move to fetching the hub's latest the way the doc gates do throughhub_fetch_run.py? (Bumping the four stale pins is ordina? #3745: Dependabot keeps theuses:pin current, so the never-pinned rule for a doc gate fetched frommaindoes not reach it.hub_fetch_run.py's mixed-pair refusal where its unresolved-commit fallback is documented: GOVERNANCE.md "Running the Linters Locally" and the husky and pre-commit snippet READMEs. The fallback reads the prose gate and its data frommaintwice, refuses when the reads differ, and a re-run is the remedy.The residual per-URL CDN caching risk from #3696's review needs an immutable fetch, a design change filed as #3827 (
deferred).Not changed:
docs/reusable-workflows.md's adopt-stub copies of these two pins (the "Adopting the Merge-Bot" and codegen stubs) andcatalog/snippets/workflows/README.md's history line still name 2.0.338 and 2.0.352. A Markdown-quoted pin is never bumped by Dependabot, which is exactly #1472's open question, so they are left for that issue rather than hand-bumped here.Closes on promotion: #1666, #3700
Pre-existing findings, not filed
catalog/snippets/workflows/publish-release.yml,test-pull-request-smoke.yml,test-pull-request.yml: these still pin 2.0.1122 and 2.0.1166, which are past the fix Every catalog workflow pin predates the prose gate's non-UTF-8 fix, so a new repo starts with a gate that crashes on a binary diff #1666 needed but older than 2.0.1319, and the hub's Dependabot config does not scancatalog/snippets/workflows. That ispre-existing, outside this change's file claim. The class, a snippet pin nothing keeps current, is Adopter docs and catalog snippets hardcode a pin, so every one of them is stale #1472's.Verification
git rev-parse '2.0.1319^{commit}'resolves to320713d9d491f578b5604a8d67b82478717d7b05, the latest release pergh release list.on.workflow_callread at that commit for both snippets.origin/develop: clean. Repo gate: every check ok,sha-pinresolving both new pins against GitHub.tests/test_release_guards.py: 33 passed.local-strict-review, two recorded passes: the first raised twointroducedwording findings in GOVERNANCE.md (a carried sentence leaning on a reason stated only in a hub-only section, and an ambiguous "That fallback"), both fixed in the second commit. The second pass raised nothing.🤖 Generated with Claude Code