chore(governance): seed governance and template files, hardened - #237
Merged
Conversation
Remediates three failure classes on this PR without changing what the seed delivers: - CODE_OF_CONDUCT.md: the four enforcement entries used two-space markdown hard breaks, which the trailing-whitespace pre-commit hook strips in CI (the "Pre-commit Hooks" / "CI Gate" failure). They are now separate paragraphs with no trailing whitespace, rendering the same. - .github/workflows/governance.yml: added a top-level `permissions: contents: read` block (Scorecard Token-Permissions: "no topLevel permission defined") and pinned both reusable-workflow callees to the commit SHA the v1 tag points at — 7ed3ab86, verified against the file's own preflight (`git ls-remote ... refs/tags/v1`) before pinning (Sonar S7637 x2, Scorecard Pinned-Dependencies). The header comment now describes SHA-bump-on-reseed instead of tag motion, and keeps the pin record and preflight. - .github/workflows/l9-lint-test-node.yml: installs now require a lockfile (no floating `npm install`/`pnpm install`/`yarn install` fallback) and run with --ignore-scripts, and the tsc step uses `npx --no-install` so it can only run the lockfile-resolved local compiler (Sonar S6505 x12, S8543 x3; Scorecard Pinned-Dependencies npmCommand findings). On this Python-only repo both Node jobs are skipped by the detect-node guard; the hardened defaults bind future Node consumers, which can relax per-repo where dependencies genuinely need install-time scripts.
The PR-size gate blocks at 1000 reviewable added lines and this seed carried 1213; the gate's required action is to split. The four lint/test toolchain files (biome.json, .biomeignore, .vscode/extensions.json, .github/workflows/l9-lint-test-node.yml — ~383 lines) move to a sibling PR based on main, leaving this PR the governance, template, and community files at ~830 added lines. Nothing is dropped: the toolchain files land via the follow-up PR with the security hardening from the previous commit already applied.
|
📋 Best Practices for Large Changes
✅ This PR passes the blocking limit but is larger than recommended. |
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
…-templates-hardened
The previous pin used 7ed3ab8650583f6659a6caf061eae77dbd3ed1be, which is the
ANNOTATED TAG OBJECT for v1 — not a commit. GitHub's commits API rejects it
("No commit found for SHA"), so both Governance runs on this branch failed
before any job was created: conclusion=failure with total_count=0 jobs, and the
run labelled by its raw path rather than `name: Governance`, because the file
never parsed that far.
`git ls-remote refs/tags/v1` returns the tag object; `refs/tags/v1^{}` returns
the commit it peels to. Both callees now reference the peeled commit
3e841ea4f7f8be2a8c9fc45cad5bed46fe801d08 ("feat(governance): deploy advisory
defaults v3.1 (#18)"), verified as a real commit object, with
governance-pr.yml and governance-issue.yml both present there and both exposing
`on: workflow_call`.
The header comment now records the two SHAs as distinct identities and points
the preflight at the peeled ref, so a future re-seed cannot repeat the mistake.
No behavior change beyond making the caller resolvable: top-level
`permissions: contents: read`, both job-level permission blocks, the absence of
`secrets: inherit`, and the event triggers are all unchanged. This is not a
revert to a floating `@v1`.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Two problems, one structural and one that this PR previously got wrong.
1. The org auto-seed PR (#233) cannot hold a fix. Its branch is regenerated by
the seeding automation every 20–40 minutes; remediation commits pushed there were
discarded within minutes by an identical fresh seed. Its payload also fails as
generated: PR size, Pre-commit (trailing whitespace in
CODE_OF_CONDUCT.md), andScorecard/Sonar on
governance.yml.2. This PR's first attempt at the Scorecard/Sonar fix was itself broken. It
pinned both reusable-workflow callees to
7ed3ab8650583f6659a6caf061eae77dbd3ed1be.That is the annotated tag object for
v1, not a commit — GitHub's commits APIrejects it outright:
So the Governance workflow failed before creating any job —
conclusion: failurewith
total_count: 0, and the run labelled by its raw path instead ofname: Governance, because the file never parsed that far. That failure emits nocheck-runs, which is why a check-runs-only query showed this PR as green when it
was not.
Fix
git ls-remote refs/tags/v1returns the tag object;refs/tags/v1^{}returns thecommit it peels to. Both are recorded now, and
uses:references the commit:Verified at the peeled commit: it resolves as a real commit object
(
feat(governance): deploy advisory defaults v3.1 (#18), 2026-07-29), and bothgovernance-pr.ymlandgovernance-issue.ymlexist there, each exposingon: workflow_call. Not a revert to a floating@v1. The header comment nowrecords the two SHAs as distinct identities and points the preflight at
refs/tags/v1^{}, so a re-seed cannot repeat the mistake.Otherwise this PR is the 14 governance/template/community files of the org seed,
with the fixes the seeder's own payload lacks:
CODE_OF_CONDUCT.mdtrailingwhitespace repaired, and
governance.ymlgiven a top-levelpermissions: contents: read. Job-level permissions, the absence ofsecrets: inherit, and the event triggers are unchanged.Evidence
Governance now starts and executes, on head
0cce42b:Job count is the point:
2, not0. Prior runs onbf635a5werefailure/total_count: 0.All other material workflows on this head are
success: PR Review Enforcement,Supply Chain Security, CodeQL Analysis, Architecture Compliance Check, L9 Lint and
Test, L9 Audit Harness, Contract Enforcement, Docker Build & Push, Terminology
Guard, Release Drafter, Code Quality.
Not green, stated plainly:
L9 Analysisisstartup_failure. That is arepository-wide pre-existing condition, not caused by this diff — it reproduces on
mainat the base SHA and on unrelated branches (every one of the last 12 runs ofthat workflow). It is recorded, not claimed as passing.
Relationship to the other PRs
#234 (
38bc671) and #236 (9936954) are merged;mainis at9936954. #236carried the 4 lint/test toolchain files with hardened installs. This PR carries the
remaining 14 — the two file sets are disjoint. Once this lands, all 18 seed
destinations exist on
mainand the missing-only seeder has nothing left topropose, which is why #233 becomes closable rather than mergeable.
Risk
Low — templates, community files, and one workflow caller. No runtime code, no
tests. Rollback: revert.
One trade, flagged: SHA-pinning
governance.ymlmeans future governance releasesno longer propagate by moving the
v1tag; a re-seed must bump the pinned commit(preflight retained in the file). That matches this repo's full-SHA-pin convention
but diverges from the org pack's tag-motion design. If the pack should stay
tag-pinned, that decision belongs upstream in
Quantum-L9/.github.History note
This branch preserves the seed commit (
ea4cfb3, from the seeding flow) plus theremediation commits, merged with current
main. No history rewritten, no forcepush.
Generated by Claude Code