Repository navigation
Repoint the remaining consumers from actions to .github #239
Description
🤖 Generated by the Agentic Engineer
Evidence
The complete public metadata census on 2026-10-08 binds 23 active, public, non-fork repositories and 270 fully parsed, Git-hash-verified metadata blobs to immutable default heads. Outside the frozen catalogue, 19 external production declarations remain across 10 repositories, plus one dormant tenant-template publisher and the canonical catalogue publisher. Final universe and head rebinds passed; private-source, administrative and native execution clearance remain separate. Rebind source and native execution before each batch. #165 chooses one repository at a time after the signed-fix canary (#238).
Order
- Templates: platform-tenant-template, dotnet-template and platform-template; include propagated wedding-app and ascoachingogvaner caller checks.
- Small repositories: homebrew-tap, agent-plugins, agent-skills, provider-upjet-unifi, unifi, cloudflare and aws. Apply the full private inventory separately without publishing private identities.
- Products: data-product-controller, ksail, world-at-ruin and monorepo.
- Platform last: include actual deployed artifact verification.
- Maintenance: skip if Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo #84 retires it first.
Acceptance criteria
- Every active repository has no executable workflow/action dependency on
devantler-tech/actionson its default branch, and qualifying native CI passed on the maintained equivalents. Historical signer identities and historical issue/comment text are verification data, not executable dependencies; they must not be rewritten to claim another signer. - The caller-pin tests in
platform-tenant-template,wedding-appandascoachingogvanercheckdevantler-tech/.githubpaths and tags in the same pull request that repoints them. - A complete final active-repository and immutable transitive-source census finds zero external executable Actions dependencies, with fresh head/universe rebinds and a real pre-migration positive control.
The signed-fix runtime gate #238 is complete. The publication work in #242 and required-workflow adoption in #237 remain separate rollout gates; neither this proof nor the public census establishes complete organization-level clearance.
Completion — 22 October 2026
The final caller, KHoist #469, passed full exact-head native CI and clean review, merged through protection, and published signed v6.0.4 artifacts. Native runtime smoke and independent image/chart signature and chart-version readback passed; its delivery receipt records exact sources and digests. The separately authorized #468 → #464 planning dependency was removed only after those gates; #464 remains open for its reliability measurement.
The 20:29 UTC census binds all 24 active repositories: 23 nonempty exact default heads and one explicitly verified empty repository. All nonempty effective-rule inventories were read, including private coverage without publishing identities; no active binding names the retiring repository ID. Zero external executable references remain through the immutable transitive workflow/action closure. The same inventory parser still detects the one real caller in immutable pre-migration KHoist source, proving the zero result is not a blind parser.
#237's required-source migration is also closed on its own native evidence. This closes consumer migration only: #240 still requires reviewed/observed management withdrawal, the private recovery backup and exact-identity deletion, final registrations/exceptions cleanup and documentation checks. No repository is deleted by this completion.
Activity
feat!: import the devantler-tech/actions catalogue (#243)
devantler commentedon Sep 30, 2026
The catalogue-aware template-sync prerequisite in #256 is delivered by #327 and available in
v2.5.2at80943d2b2d585ba1bc2d787ca986ead0d7f9d856. Release and post-merge verification passed, including 82 ordering/migration cases and the merged helper's real GitHub ancestry check.When implementing this rollout, ensure template-sync callers use the fixed
.githubworkflow before repointed template content can reach them. The retiredactionscopy was not changed. The separate canary requirement in #238 and this issue's consumer-specific checks still apply.devantler commentedon Oct 3, 2026
Two additional consumer declarations are now delivered on canonical immutable v4.9.1 (
30882cccda9e41c622f6493e21e7eb6f3339b91f): KSail #7469, merged96cb7bada4896099f25b963db7d6f05996cdf060, repoints its comment scanner; Platform #4434, merged1065fe45242b791e75116243382c8c26e28019bb, repoints naming validation. Their declared behavior changes are tracked separately in #394/#274.KSail’s first main scanner run and actual-image native adoption verification succeeded. Platform’s native naming execution and completion assertion passed, and its real production queue gate completed successfully with runtime readback. Both PRs passed complete current-head CI and substantive review before merge.
This is a partial migration, not the final organization-wide absence claim. The live Go canary follow-up in #238 confirms KSail’s signed-fix path still binds the frozen catalogue, so that remaining family must move with a genuine canonical consumer proof. Remaining declarations and the final active-repository census stay open here.
devantler commentedon Oct 3, 2026
Fresh pinned consumer census after the two merged adoptions: all 21 public repositories in the declared portfolio resolved to current default-branch commits, all recursive trees were complete, and all 252 workflow/composite metadata files were read in full and parsed structurally. Outside the canonical and frozen catalogue repositories themselves, 69 direct catalogue
usesdeclarations remain; 60 still name the frozen Actions catalogue. The migration acceptance criterion is therefore still unmet.The merged KSail scanner and Platform naming caller are canonical. The two platform-template naming declarations are also canonical; their exact pinned action metadata declares
enableddefault true. The scanner family has eight direct public callers: two canonical and six frozen. No private-source contents are included in this record.These are version-bound static declarations, not executed-job counts or a complete census of consumers outside the declared portfolio. Nested workflow revisions still need their own pinned resolution, and actual consumer-path evaluation remains a separate gate. This issue stays open; the census supplies concrete remaining migration scope without retiring compatibility inputs prematurely.
devantler commentedon Oct 4, 2026
Fresh post-merge immutable portfolio census: all 21 public declared repositories resolved live visibility, archive and default-branch metadata. Every recursive tree was complete, and all 252 public workflow/composite metadata files were read in full and structurally parsed. Changed metadata was reread at KSail
d6a72e0df608d11c2ee3964bd7f9c0b328b8252fand Platform7f97d0263af4f8824dae293da0805ed0c4d8189f; the complete head/visibility set was rebound after those reads with no drift. Private source remains private.Outside the canonical and frozen catalogue repositories, those snapshots contain 73 direct catalogue uses declarations: 14 canonical and 59 frozen. The two template adoptions add four immutable validator declarations with actual clean and negative execution proof. KSail #7478 is now merged: its one direct Go workflow caller resolves canonical
.githubbd0035dd8f41fcf1459b878882b8897443f8dc59(v4.9.4), preserves its main/allowlist trigger, removes redundant true arguments, and keeps signed fixes explicitly disabled. GitHub independently resolves that exact canonical source in merged-main CI; its actual Test and Vulnerability Scan both pass, and the full native main run completes successfully with all 42 jobs settled and no failures. Native step/log evidence is recorded on the PR.This is version-bound declaration evidence, not executed-job counts or a census of consumers outside the declared portfolio. #239 remains open for the remaining frozen consumers, named canary requirements, caller-pin tests where relevant, and the final organization-wide search. No compatibility interface is retired by this census.
The subsequent organization-wide membership read finds 22 active public repositories, including the still-active legacy
maintenancerepository named in this rollout. Its complete tree contributes four further workflow metadata files and three frozenupsert-issuedeclarations atdf7fd4f83edade31c121a9de563d9a7b9b1f900d. After rebinding every active repository head and visibility with no drift, the complete active public organization metadata inventory is 256 files and 76 direct consumer catalogue declarations: 14 canonical, 62 frozen. The declared-portfolio count above remains its narrower scope. This closes the inventory gap; the migration criteria remain unchecked because the frozen declarations still exist.devantler commentedon Oct 4, 2026
Verified consumer census — 2026-10-04
The complete active public census covers 22 repositories and 257 workflow/composite metadata blobs. Outside the canonical and frozen catalogue hosts, it finds 62 direct legacy declarations in 18 public consumers, alongside 14 canonical declarations; every catalogue call is pinned to a full commit SHA. These are declarations, not file counts or executed jobs. The final observed-head rebind completed at 11:17:32 UTC. Private source details are excluded.
Actual KSail CI completed all 42 jobs. Test and vulnerability scan actually ran from canonical Go workflow bd0035d. Its caller blob remains unchanged at the observed current KSail head. Every signed-fix job skipped, so this proves read-only Go adoption and does not clear #238.
Keep the existing order, install the template and application caller-pin checks in the same PRs as their migrations, and require #242's deployed signing acceptance before each publisher changes. Rebind each repository before claiming its batch. The final retirement gate must join the complete active repository universe, source declarations, required rules and pinned nested workflow references; an incomplete code search cannot certify zero remaining dependencies.
31 remaining items
devantler commentedon Oct 21, 2026
Retirement checkpoint, 21 October:
maintenancehas been fully deleted after recreation controls were removed and observed absent; it is not merely archived. The Git/tracker recovery material is retained privately.actionsremains live. Caller migrations, complete private coverage, actual application-publication acceptance, final native required-workflow evidence, fresh complete dependency/runtime inventories and recreation-control removal are not all cleared. This checkpoint is not deletion authorization or a claim that the remaining consumers are migrated.devantler commentedon Oct 21, 2026
Fresh retirement checkpoint, 21 October 2026:
Merged migrations now include KSail #7903, Platform #5158, provider-upjet-unifi #77, dotnet-template #533, platform-tenant-template #250, ascoachingogvaner #326 and wedding-app #431. The two application publishers have normal successful releases and independent live signature/rollout readback. KSail's maintained release and skill updater executed successfully; its full post-merge validation is still being observed.
Keep this issue open. Rebind every remaining caller and open head, complete publication proof and recreation-control retirement, and keep private-source clearance separate before deleting the source. Historical certificate-identity strings and GitHub's native /actions/ API namespace are not executable dependencies and must not be rewritten indiscriminately.
devantler commentedon Oct 21, 2026
The shared required-workflow adoption in #237 is now complete, with ordinary native .NET three-OS and full Go validation execution from the maintained catalogue. Go template #412 is also merged and normally published as v1.5.9 after current-head review and complete native validation.
actionsis still live and not cleared for deletion. The remaining KHoist publisher #469 is explicitly parked on khoist#464: the unchanged real Document fixture crashes during startup. Diagnostics #470 is being validated; its first native run established exit 1 but not the root cause. No readiness, signature, CI or database acceptance requirement was relaxed.The earlier open-PR-head inventory still requires resolution: migrated default branches do not update older PR workflow declarations. Current ownership/activity must be rebound before changing any such branch. Complete authorized private coverage, final runtime/API dependency and source rebinds, observed recreation-control removal and a fresh recovery snapshot remain separate deletion gates. Historical signature identities must remain intact. No source-absence or deletion-completion claim is made here.
devantler commentedon Oct 22, 2026
The current cleanup survey parsed 207 workflow files at exact source commits across all 23 non-empty repositories. The organization census contains 24 active repositories, one empty repository and zero archived repositories. Maintenance is absent. No deletion was attempted from an incomplete or historical text search.
Only one executable workflow reference still names the legacy Actions repository: KHoist's application publisher. Its existing migration #468/#469 remains gated by native Document acceptance #464; deleting the repository now would break releases.
Ownership checks also clarify two apparent outliers: PostgreSQL AGE publication already lives in KHoist, and
publish-manifests.yamlhas two real production consumers (AWS and this catalogue's CD), so its catalogue fixtures are not its justification for reuse. Shared release, app publication, Go validation, TODO scanning, template sync and skill updates have multiple observed product consumers. Game linting remains a single-product export pending world-at-ruin#1494/#1495. The two superseded singleton rules are disabled and reconciled, as recorded under #693; the remaining game-specific source cutover is not complete.The .NET singleton wrapper retirement #708 now contains its scanner/source-auditor correction and actual three-OS authenticated/ordinary/MTP execution proof. Its complete-CI gate is currently blocked by the acknowledged GitHub Actions Results incident, tracked in #655, not by the .NET change. No final cleanup or deletion completion is claimed.