chore(governance): auto-seed org templates from Quantum-L9/.github - #152
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 181deaa305
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| case "${PACKAGE_MANAGER}" in | ||
| npm) if [ -f package-lock.json ]; then npm ci; else npm install; fi ;; | ||
| pnpm) corepack enable && (if [ -f pnpm-lock.yaml ]; then pnpm install --frozen-lockfile; else pnpm install; fi) ;; | ||
| yarn) corepack enable && (if [ -f yarn.lock ]; then yarn install --frozen-lockfile; else yarn install; fi) ;; | ||
| *) echo "::error::unknown PACKAGE_MANAGER ${PACKAGE_MANAGER}" && exit 1 ;; |
There was a problem hiding this comment.
On every PR and push, both new install blocks run npm ci, but .npmrc:1-2 routes the repository's @quantum-l9 dependencies to GitHub Packages using NODE_AUTH_TOKEN. These jobs grant only contents: read and never provide that token, unlike the existing .github/workflows/l9-lint-test.yml, so clean runners cannot install the dependencies and fail before type-checking or testing; add packages: read and pass the token to each install step.
Useful? React with 👍 / 👎.
| REPOSITORY NOTICE: This LICENSE applies only to the Quantum-L9/.github | ||
| repository. GitHub does not propagate LICENSE files via org community-health | ||
| fallbacks. Other Quantum-L9 repositories should include their own LICENSE | ||
| file (this text may be used as the org template). |
There was a problem hiding this comment.
This notice expressly says the license applies only to Quantum-L9/.github, even though it has been installed as Website-Bot's root LICENSE; that contradicts the earlier definition covering files in “this repository” and leaves the current project's licensing terms ambiguous. Replace it with an operator-approved Website-Bot license rather than shipping the source repository's template notice.
AGENTS.md reference: AGENTS.md:L41-L41
Useful? React with 👍 / 👎.
| in Commercial Use without such an agreement is a material breach of this | ||
| License and constitutes copyright infringement. | ||
|
|
||
| To request a commercial license, contact: eng@l9.dev |
There was a problem hiding this comment.
The newly published eng@l9.dev address conflicts with SECURITY.md:23 and SUPPORT.md:9,43, which explicitly record external contacts as Unknown until supplied by the operator. Publishing this unverified address as the required route for commercial licensing can misdirect legal requests; retain it as an Unknown/operator-owned value until it is verified.
AGENTS.md reference: AGENTS.md:L41-L41
Useful? React with 👍 / 👎.
| `Quantum-L9/.github` validates itself on every PR/push to `main` — note that | ||
| none of the 12 files under `workflow-templates/` ever run as CI *in this | ||
| repo*; they only appear as starter-workflow choices in other repos' Actions | ||
| tab. What actually executes here: |
There was a problem hiding this comment.
This section identifies the current repository as Quantum-L9/.github and describes workflow-templates/, l9-ci-pack/, validate-starters.sh, and other CI assets that do not exist anywhere in Website-Bot. Contributors following it will look for nonexistent checks and overlook the workflows and npm run verify:all that this repository actually uses; replace the copied source-repository section with inspected Website-Bot commands and files.
AGENTS.md reference: AGENTS.md:L34-L34
Useful? React with 👍 / 👎.
| if [ -f scripts/sync_ci_from_pack.py ]; then | ||
| python scripts/sync_ci_from_pack.py | ||
| else | ||
| echo "::notice::No sync_ci_from_pack.py found — skipping" | ||
| exit 0 |
There was a problem hiding this comment.
In this Website-Bot checkout, a repository-wide search finds no scripts/sync_ci_from_pack.py, so every org_template_updated dispatch reaches this branch, exits successfully, and never updates or opens a PR despite the workflow's auto-sync contract. Ship the sync implementation with the receiver or invoke an available reusable workflow rather than treating the missing implementation as success.
Useful? React with 👍 / 👎.
| if [ -f package.json ] && node -e "process.exit(require('./package.json').scripts && require('./package.json').scripts.test ? 0 : 1)" 2>/dev/null; then | ||
| ${PACKAGE_MANAGER} test | ||
| else | ||
| echo "::notice::no test script defined in package.json, skipping" |
There was a problem hiding this comment.
Website-Bot's root package.json has no test script, so after dependencies install this new “Test Suite” job always takes the notice-only branch and reports success without executing any tests. Invoke an existing repository validation command such as verify:all, site:test:local, or the appropriate focused test script so the check cannot be green without test evidence.
Useful? React with 👍 / 👎.
b1a9a88 to
d7a0381
Compare
d7a0381 to
dc6559a
Compare
|
1 participant
Automatically seeds org template files from
Quantum-L9/.github/templates/plus thel9-ci-pack/Core hub.Files in this PR
.github/workflows/governance.yml.github/labels.ymlCODE_OF_CONDUCT.mdCONTRIBUTING.mdLICENSE.github/FUNDING.yml.github/ISSUE_TEMPLATE/1-bug.yml.github/ISSUE_TEMPLATE/2-feature.yml.github/ISSUE_TEMPLATE/3-task.yml.github/ISSUE_TEMPLATE/4-incident.yml.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/ci-failure.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/ISSUE_TEMPLATE/gov-violation.yml.github/workflows/on-org-update.yml.github/workflows/l9-lint-test-node.yml.biomeignore.editorconfig.vscode/extensions.jsonExisting files were left untouched (missing-only seed), except a stock ESLint
l9-lint-test-node.ymlwhich is replaced with the Biome SDK caller.Governance caller is advisory (
strictdefaults false).Core pack callers are distributed here;
l9-ci-coreexecutes CI.Opened automatically by Quantum-L9/.github auto-seed.