fix(gitops): observe the required Go workflow policy by devantler · Pull Request #644 · devantler-tech/.github

devantler · 2026-10-18T10:42:25Z

🤖 Generated by the Agentic Engineer

Why

KSail still runs an older required Go workflow, preventing it from benefiting from the maintained cache policy. Migrating that gate safely first requires a complete view of its existing protections.

What

Add read-only visibility of the existing Go workflow rule without changing which repositories it protects or how merges are gated. Source migration and measured CI improvements remain separate follow-up work.

Part of #643

devantler · 2026-10-18T10:43:21Z

🤖 Generated by the Agentic Engineer

Validation at exact head ca95b72a2785473641df859175bc4148f5ce5db6 (initial implementation 0c22bf4860e2f93ab069ab3ab3178aca4062d241):

RED: the new rendered-policy guard failed before the Go import existed. GREEN: the import now passes, with 25 independent refusal controls for mutation authority, identity, duplicate adoption, reader failure and weakened CI wiring.
All 14 repository Maintenance checks passed, including deployment rendering, declarative coverage and failure handling, repository policy/drift/coverage, release/deletion contracts and workflow-execution policy controls.
Instruction-layout and test-wiring regression suites passed. Existing CodeQL-observation, Go-template and trusted deploy-guard tests passed. ShellCheck and whitespace checks passed.
The first hosted manifest job exposed the existing World at Ruin inventory assertion still pinned to 11 imported rulesets. It failed locally for that exact reason; the new head updates that count to 12 without changing any policy assertion. Both that test and the new Go observation guard now pass, along with ShellCheck and whitespace checks. The rest of the source is unchanged from the locally validated initial head.
The installed Actionlint reports exactly the same unsupported code-quality / queue syntax and existing SC2016 finding on the unchanged base. This is not recorded as a clean lint result; exact-head hosted workflow validation remains required.
Correctness/security and simplification self-review: no actionable findings remain. The import is identity-only, Observe-only, namespace-agnostic for the existing Flux target namespace, and uses the existing namespaced provider. No GitHub settings or cluster resources were imperatively changed.

Hosted CI, external exact-head review, merge/publication and native reconciliation readback are still pending. This import alone is not a CI performance improvement; #237 still owns the source migration and #565 the consumer cache outcome.

github-code-quality · 2026-10-18T10:43:31Z

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main e39b2bd	codex/observe-go-wor... ca95b72	+/-
50%	50%	0%

C# / code-coverage/dotnet

main e39b2bd	codex/observe-go-wor... ca95b72	+/-
100%	100%	0%

Go / code-coverage/go

main e39b2bd	codex/observe-go-wor... ca95b72	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

_{Updated October 18, 2026 10:52 UTC}

devantler · 2026-10-18T10:55:28Z

🤖 Generated by the Agentic Engineer

@coderabbitai full review

coderabbitai · 2026-10-18T10:55:37Z

✅ Action performed

Full review finished.

coderabbitai · 2026-10-18T10:59:01Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 0b00de11-fb31-438c-b74a-6a535934d9f0

📥 Commits

Reviewing files that changed from the base of the PR and between e39b2bd and ca95b72.

📒 Files selected for processing: 7

.github/workflows/ci.yaml
deploy/organization-rulesets/README.md
deploy/organization-rulesets/kustomization.yaml
deploy/organization-rulesets/require-workflows-dependency-review.yaml
deploy/organization-rulesets/require-workflows-go.yaml
tests/go-workflow-observation.sh
tests/world-at-ruin-regression-ruleset.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📚 Code guidelines: 4

AGENTS.md — auto-discovered
actions/CONTRIBUTING.md — auto-discovered
.github/agent-guides/catalogue.md — auto-discovered
CONTRIBUTING.md — auto-discovered

📓 Path-based instructions: 5

Source excerpt: **Manage GitHub declaratively — never imperatively.**

📄 CodeRabbit inference engine (AGENTS.md)

Files:

deploy/organization-rulesets/require-workflows-dependency-review.yaml

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) Full detail in [actions/CONTRIBUTING.md](actions/CONTRIBUTING.md).

📄 CodeRabbit inference engine (actions/CONTRIBUTING.md)

Files:

.github/workflows/ci.yaml

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) | Guide | Read before | |---|---| | [Catalogue layout and references](.github/agent-guides/catalogue.md) | Adding or moving components, self-reference...

📄 CodeRabbit inference engine (.github/agent-guides/catalogue.md)

Files:

.github/workflows/ci.yaml

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) Three things share one repo: **The org's public profile** — `profile/README.md` (rendered on the org page), plus the org-wide commun...

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Files:

.github/workflows/ci.yaml

Applicability reference: AGENTS.md: # AGENTS.md — devantler-tech/.github (GitHub-as-code) Three things share one repo: **The org's public profile** — `profile/README.md` (rendered on the org page), plus the org-wide community health files i...

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Files:

deploy/organization-rulesets/require-workflows-dependency-review.yaml
deploy/organization-rulesets/README.md
deploy/organization-rulesets/kustomization.yaml
deploy/organization-rulesets/require-workflows-go.yaml

🔇 Additional comments: 6

deploy/organization-rulesets/require-workflows-go.yaml: 1

1-18: LGTM!

deploy/organization-rulesets/kustomization.yaml: 1

2-2: LGTM!

Also applies to: 10-10, 22-22

deploy/organization-rulesets/README.md: 1

12-12: LGTM!

Also applies to: 40-40, 51-68

deploy/organization-rulesets/require-workflows-dependency-review.yaml: 1

6-8: LGTM!

.github/workflows/ci.yaml: 1

6258-6259: LGTM!

tests/world-at-ruin-regression-ruleset.sh: 1

61-62: LGTM!

📝 Walkthrough

The deployment adds an Observe-only import for Go workflow ruleset 10320335 and updates the ruleset inventory. A new shell test checks the rendered import’s identity and read-only policy, rejects specified mutations and render failures, and verifies that CI runs the test unconditionally. The CI workflow invokes the test, and an existing inventory check now expects 12 imported rulesets.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to ca95b

This adds read-only visibility of an existing Go workflow ruleset without changing enforcement or coverage. No actionable merge-blocking risk was found; hosted CI results are still pending.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (5 skipped: 5 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description clearly explains the read-only observation of the existing Go workflow rule and the deferred migration work. It directly matches the changeset.
Title check		The title clearly and concisely identifies the main change: observing the required Go workflow policy.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (5 skipped: 5 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

CI annotation context is incomplete: annotation collection unavailable or limited

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-10-18T11:00:32Z

🤖 Generated by the Agentic Engineer

Readiness at exact head ca95b72a2785473641df859175bc4148f5ce5db6:

Native CI run 39120582987 completed all selected tests successfully. The head has 216 successful checks and 64 intended skips, with none unfinished. The manifest job ran all 31 declared manifest/policy test entrypoints, including the new observation guard and corrected inventory assertion.
CodeRabbit's completed review covers this exact base-to-head range and reports no actionable comments. The authenticated, fresh summary passes the repository's current-head verdict helper. No review threads or outside-diff/nitpick findings exist.
Ancillary docstring coverage: the three new functions are private Bash assertion helpers (fail, rendered-policy validation and CI-wiring validation), not a new public API. Their purpose and failure contracts are explicit in their names, assertions and boundary comments. The generic percentage does not identify missing user-facing documentation or a correctness defect; no source change is needed for that suggestion. The user-facing adoption procedure is documented in the same change. This records the assessment rather than silently ignoring the warning.
CodeRabbit's auxiliary Checkov subprocess failed operationally; it is not recorded as a clean scan. The completed code review remains distinct from that unavailable tool. Native deployment rendering and exact policy/refusal guards passed independently, and the production integration's existing Observe-only behavior was read back before this import was authored.
User evaluation: rendered the real deployment, executed the exact identity/read-only and CI refusal controls, verified the existing Go rule identity through GitHub and traced consumption through the existing signed GitOps publication and namespaced provider. This PR changes declarative configuration consumed by that existing integration; it does not change enforcement. The new resource's native observation still requires post-merge publication/reconciliation and remains open on Observe the existing organization Go workflow rule before migrating its CI source #643.

The source migration and any measured CI/cache improvement remain outside this import, under #237/#565. Promotion and merge still require a fresh ownership, body, head and merge-state check; no security or required gate is waived.

fix(gitops): observe the required Go workflow policy

0c22bf4

test(gitops): account for the added Go observation import

ca95b72

devantler mentioned this pull request Oct 18, 2026

Mirror caches are evicted before system tests restore them devantler-tech/ksail#7348

Open

2 tasks

devantler marked this pull request as ready for review October 18, 2026 11:01

devantler merged commit e038a2e into main Oct 18, 2026
284 checks passed

devantler deleted the codex/observe-go-workflow-643 branch October 18, 2026 11:02

This was referenced Oct 18, 2026

Repoint organization-required workflows from actions to .github #237

Open

Observe the existing organization Go workflow rule before migrating its CI source #643

Closed

Move the existing organization Go workflow rule to the maintained catalogue #645

Closed

Navigation Menu

Repository navigation

fix(gitops): observe the required Go workflow policy - #644

fix(gitops): observe the required Go workflow policy#644
devantler merged 2 commits into
mainfrom
codex/observe-go-workflow-643

devantler commented Oct 18, 2026

Uh oh!

devantler commented Oct 18, 2026 •

edited

Loading

Uh oh!

github-code-quality Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

devantler commented Oct 18, 2026

Uh oh!

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

devantler commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devantler commented Oct 18, 2026

Why

What

Uh oh!

devantler commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-code-quality Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code coverage overview

Go / code-coverage/test

C# / code-coverage/dotnet

Go / code-coverage/go

Uh oh!

devantler commented Oct 18, 2026

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devantler commented Oct 18, 2026 •

edited

Loading

github-code-quality Bot commented Oct 18, 2026 •

edited

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading