chore(governance): auto-seed org templates from Quantum-L9/.github - #177
chore(governance): auto-seed org templates from Quantum-L9/.github#177cryptoxdog wants to merge 1 commit into
Conversation
PR Size Report
Best Practices for Large Changes
This PR is blocked from merging until size limits are met. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: write |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| uses: Quantum-L9/l9-ci-core/.github/workflows/publish-analysis.yml@f88116503430aa18992b70d8d31063e34ff97ef1 | ||
| permissions: | ||
| actions: read | ||
| checks: write |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| @@ -0,0 +1,33 @@ | |||
| # Managed by Quantum-L9/.github. Pinned to a tag so main can move safely. | |||
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| command -v pytest >/dev/null 2>&1 || pip install pytest | ||
| python -c "import pytest_cov" 2>/dev/null || pip install pytest-cov | ||
| python -c "import xdist" 2>/dev/null || pip install pytest-xdist | ||
| python -c "import pytest_timeout" 2>/dev/null || pip install pytest-timeout |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| echo "::notice::no local editable package to install" | ||
| command -v pytest >/dev/null 2>&1 || pip install pytest | ||
| python -c "import pytest_cov" 2>/dev/null || pip install pytest-cov | ||
| python -c "import xdist" 2>/dev/null || pip install pytest-xdist |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| run: | | ||
| set -euo pipefail | ||
| case "${PACKAGE_MANAGER}" in | ||
| npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| run: | | ||
| set -euo pipefail | ||
| case "${PACKAGE_MANAGER}" in | ||
| npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| jobs: | ||
| pr: | ||
| if: github.event_name == 'pull_request' | ||
| uses: Quantum-L9/.github/.github/workflows/governance-pr.yml@v1 |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| if: steps.gov.outputs.enabled == 'true' | ||
| run: | | ||
| set -euo pipefail | ||
| python -m pip install --upgrade pip semgrep |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
|
|
||
| issue: | ||
| if: github.event_name == 'issues' | ||
| uses: Quantum-L9/.github/.github/workflows/governance-issue.yml@v1 |
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0714c83905
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| run: | | ||
| set -euo pipefail | ||
| python -m pip install --upgrade pip | ||
| if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi |
There was a problem hiding this comment.
On a clean GitHub-hosted runner, this command installs requirements-ci.txt, which fetches the private Quantum-L9/Gate_SDK Git dependency, but neither this job nor the identical lint installation configures secrets.SDK_TOKEN as the existing ci.yml and pr-pipeline.yml jobs do. Consequently both new Python jobs fail during dependency installation before linting or tests can run; configure authenticated Git access before either install.
AGENTS.md reference: AGENTS.md:L321-L322
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| - name: Set up Node | ||
| uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 | ||
| with: | ||
| node-version: ${{ env.NODE_VERSION }} | ||
| cache: ${{ env.PACKAGE_MANAGER }} |
There was a problem hiding this comment.
The reviewed tree contains no package.json, package-manager lockfile, or tsconfig.json, yet this workflow runs two Node jobs on every pull request and enables npm caching in both. setup-node derives its cache key from dependency lockfiles and searches the repository root when cache-dependency-path is omitted, so these jobs fail while resolving the nonexistent npm dependency file before the later test/typecheck guards can skip (setup-node caching documentation); remove this unactivated Node template or gate the entire workflow on a Node manifest.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| PYTHONPATH=. pytest "${TEST_DIR}" \ | ||
| -n auto \ |
There was a problem hiding this comment.
This invocation runs the entire tests/ tree without the deselections generated by tools/pytest_quarantine_deselects.py, even though .l9/baselines/test-quarantine.yml records numerous currently failing tests. The existing ci.yml and pr-pipeline.yml jobs explicitly pass those deselections, so after dependency setup is repaired this added required-looking PR job will still fail every run on acknowledged baseline debt; construct and pass the same quarantine arguments here.
AGENTS.md reference: AGENTS.md:L347-L350
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| # Fail the build below this line coverage percentage. 0 = advisory (no gate). | ||
| COVERAGE_THRESHOLD: "0" |
There was a problem hiding this comment.
CONTRACT C-15 VIOLATION — Coverage must remain at least 60%. This new pull-request workflow is configured with COVERAGE_THRESHOLD: "0", making its advertised test gate advisory and allowing the workflow to pass with arbitrarily low coverage if it replaces the old pipeline as its header describes; set the threshold to at least 60 rather than disabling it.
AGENTS.md reference: AGENTS.md:L175-L175
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| if [ -f scripts/sync_ci_from_pack.py ]; then | ||
| python scripts/sync_ci_from_pack.py | ||
| else | ||
| echo "::notice::No sync_ci_from_pack.py found — skipping" | ||
| exit 0 |
There was a problem hiding this comment.
A repository-wide tree search at the reviewed commit finds no scripts/sync_ci_from_pack.py, so every org_template_updated dispatch takes this branch, exits successfully, and never synchronizes or opens a PR. This makes the newly advertised automatic org-template synchronization completely inert; seed the implementation with the receiver or invoke an available reusable action instead of silently skipping.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
| @@ -0,0 +1,200 @@ | |||
| # L9 analysis caller (TEMPLATE — copy into your repo at .github/workflows/l9-analysis.yml) | |||
There was a problem hiding this comment.
CONTRACT C-20 VIOLATION — Template-managed files require an L9_META header. This workflow explicitly identifies itself as a template, but it and the other 27 seeded files contain no L9_META block, so the governance seed immediately introduces unmanaged template artifacts; add valid headers while generating the files.
AGENTS.md reference: AGENTS.md:L180-L180
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Acknowledged — not actioned this cycle
Ownership is CI_PIPELINE. l9-pr-remediation repairs codebase only and does not edit .github/workflows/**.
This PR remains unmerged until a human decides whether org-seeded workflows belong in this Python engine repo.
Tracking: Converge status for #177
d3772ba to
306af94
Compare
Remediation-Cycle: #177/cycle-1 Co-authored-by: Cursor <cursoragent@cursor.com>
Remediation-Cycle: #177/cycle-2 Co-authored-by: Cursor <cursoragent@cursor.com>
Remediation cycle-1 (
|
PR Pipeline Gate Summary
✅ All checks passedReady for code review and merge. Local equivalent: |
6da11d3 to
d7e9633
Compare
| with: | ||
| python-version: ${{ env.PYTHON_VERSION }} | ||
| - name: Install consumer CI toolchain | ||
| uses: Quantum-L9/l9-ci-core/.github/actions/install-consumer-ci@v2 |
| - name: Install extra CI requirements | ||
| run: | | ||
| set -euo pipefail | ||
| if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi |
| with: | ||
| python-version: ${{ env.PYTHON_VERSION }} | ||
| - name: Install consumer CI toolchain | ||
| uses: Quantum-L9/l9-ci-core/.github/actions/install-consumer-ci@v2 |
| run: | | ||
| set -euo pipefail | ||
| if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi | ||
| pip install -e ".[dev]" || pip install -e . || \ |
| run: | | ||
| set -euo pipefail | ||
| if [ -f requirements-ci.txt ]; then pip install -r requirements-ci.txt; fi | ||
| pip install -e ".[dev]" || pip install -e . || \ |
51f6f07 to
85cf5c6
Compare
018162c to
82d5ae9
Compare
82d5ae9 to
f9ba483
Compare
|
2 participants
Automatically seeds org template files from
Quantum-L9/.github/templates/plus thel9-ci-pack/Core hub.Files in this PR
.github/workflows/governance.yml.github/labels.ymlCODE_OF_CONDUCT.mdCONTRIBUTING.mdSECURITY.mdSUPPORT.md.github/FUNDING.yml.github/ISSUE_TEMPLATE/1-bug.yml.github/ISSUE_TEMPLATE/2-feature.yml.github/ISSUE_TEMPLATE/3-task.yml.github/ISSUE_TEMPLATE/4-incident.yml.github/ISSUE_TEMPLATE/ci-failure.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/gov-violation.yml.github/pull_request_template.md.github/workflows/on-org-update.yml.github/workflows/l9-analysis.yml.github/workflows/l9-lint-test-node.yml.github/workflows/l9-lint-test.yml.github/governance/execution-profiles.yaml.github/governance/promotion-policy.yaml.github/governance/provider-requiredness.yaml.github/governance/quality-thresholds.yaml.github/governance/rule-modes.yaml.github/governance/waivers.yamlbiome.json.biomeignore.vscode/extensions.jsonExisting files were left untouched (missing-only seed), except a stock ESLint
l9-lint-test-node.ymlwhich is replaced with the Biome SDK caller.Governance caller is advisory (
strictdefaults false).Core pack callers are distributed here;
l9-ci-coreexecutes CI.Opened automatically by Quantum-L9/.github auto-seed.