Repository navigation
Wave 10: CI jobs a diff fires, repo-settings audit - #2155
Merged
Merged
Conversation
Delivery (refs #1559): - ci_cost_advisor.py ROOT --diff BASE lists every pull_request workflow job the committed diff BASE...HEAD fires, with its run: lines, so a fix lane knows which CI jobs to run locally (or name "left to CI") before it pushes to a repo it does not own. It applies the cost model's types, branches, paths and paths-ignore rules; branches filters are matched against the branch BASE names, never against --default-branch, and a sha or tag BASE lists each branch-gated job tagged "(branches: unchecked)" instead of dropping it. A workflow the parser cannot read but that names pull_request is listed as UNPARSED, and one line names the workflows that start only on push, merge_group or workflow_run. Jobs that build images or start containers (including services: and container:) are tagged [runtime]. Read-only and offline. - A segment-leading **/ in a paths filter now also matches no directory, as GitHub's filter cheat sheet specifies, so **/Dockerfile matches a root Dockerfile. The fix is in the glob matcher shared with the cost model. - scripts/test_ci_cost_advisor.py no longer leaves a temp dir behind on every run; NoTempLeak re-runs the file in a child with a private TMPDIR. Security (repository settings): - agentic-delivery/scripts/repo_settings_audit.py: a read-only audit of the GitHub settings a diff review cannot see (default-branch protection and rulesets together, the Actions token default, review approval and allowed actions, collaborator counts, write deploy keys, insecure webhooks, unprotected environments, secret scanning and push protection). A 403 or 404, a reply missing a field the check reads, an unreadable list item and a list of 1000 or more are "not checked" rows, never clean; a 404 "Branch not protected" is a finding only when the reply shows admin for the token. Counts and booleans only: no login, email, key title, hook URL or API message text is printed. Routed from agentic-delivery/SKILL.md and references/tool-hub.md (legitify and OpenSSF Scorecard named as the OSS options); sources and fetch dates in docs/standards-index.md. - scripts/test_skill_index_split.py: the script-lookup budget grows by 300 bytes for the new index row (measured 22162). size-budget-raise: .claude/skills/deep-code-review/references/parallel-audit.md 39795→40669 one routed bullet: run the CI jobs a fix diff fires, or name them left to CI size-budget-raise: .claude/skills/agentic-delivery/SKILL.md 7202→7457 one route row for repo_settings_audit.py size-budget-raise: .claude/skills/deep-code-review/references/tool-hub.md 14455→15368 one Repo settings section holding the repo_settings_audit.py row and its OSS options Tests: 20/20 affected suites pass, run one at a time (19 on the tip before the budget bump, then test_skill_index_split 7/7 after it; repo_settings_audit 55/55, ci_cost_advisor 80 with 1 skip); test-ci-gates.sh left to CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wave 10: four lane commits squashed into one. The commit message has the detail per item.
What changes
ci_cost_advisor.py ROOT --diff BASElists thepull_requestjobs a diff triggers, with theirrun:lines, so a fix lane runs them locally or names themleft to CI. An unreadable workflow is listed asUNPARSED, never dropped.**/path filters:**/Dockerfilenow matches a rootDockerfile, as GitHub specifies.repo_settings_audit.pyreads settings a diff review cannot see (branch protection and rulesets, the Actions token default, deploy keys, webhooks, environments, secret scanning). Anything it cannot read in full isnot checked, never clean. Output is counts and booleans only.Verification
5a0e5e59b: all 20 affected suites pass, run one at a time;test_skill_index_split.pyre-run 7/7 after its 300-byte budget bump for the new index row.test-ci-gates.shis left to CI.5a0e5e59b: pass.repo_settings_audit.pyrun: counts and booleans only.🤖 Generated with Claude Code