Conversation
…ecks) - Add ci_checks.yml consuming complytime/org-infra reusable CI workflow (SHA-pinned to v0.7.1) for MegaLinter and commitlint PR title validation - Add .mega-linter.yml with org-standard 12-linter set and directory exclusions for AI agent configs and build output - Update release.yml preflight to gate on both "Build and Test" and "Standardized CI / Run linters" checks - Update settings.yml branch protection to require the new linter check - Update AGENTS.md to document the new CI check and add Recent Changes entry - Include OpenSpec change artifacts (proposal, design, spec, tasks) - Include Dewey learnings from prior sessions Fixes: unbound-force#25 Assisted-by: claude-opus Generated with AI assistance (claude-opus)
|
🤖 Finished Review · ✅ Success · Started 10:07 AM UTC · Completed 10:27 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.03 |
|
Risk Assessment: moderate (2/5) DetailsScore unchanged from prior assessment (2, moderate). Tier 1 raw metrics inflated by 22 deleted learnings files and 5 new openspec documents, but actual risk surface is narrow: one new CI workflow, one new linter config, and minor edits to 4 existing files. No security-sensitive or dependency changes. CI workflow addition is additive and easily reverted. All issue acceptance criteria met. Previous runRisk Assessment: moderate (2/5) DetailsCI config change with 4 protected paths and workflow modifications, but the change is additive, well-documented with rollback procedure, all issue acceptance criteria are met, most files are new documentation, and no dependency or security-sensitive changes exist. |
ReviewFindingsMedium
Low
Next steps:
Previous runReviewFindingsMedium
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Remove 60 .uf/dewey/learnings/*.md files that were unintentionally included in the PR. Add .uf/dewey/learnings/ to .gitignore to prevent future leaks. Addresses PR unbound-force#101 review feedback from @marcusburghardt. Signed-off-by: Em <em-redhat@users.noreply.github.com> Assisted-by: claude-opus
Rename call_reusable_ci to call-reusable-ci to match the kebab-case convention used by all other workflow job keys (build-and-test, check-signing-secrets, etc.). Addresses PR unbound-force#101 review feedback from @fullsend-ai-review. Signed-off-by: Em <em-redhat@users.noreply.github.com> Assisted-by: claude-opus
Add note that MegaLinter runs in CI only with no local equivalent, and suggest mega-linter-runner (requires Docker) for local linting. Addresses PR unbound-force#101 review feedback from @fullsend-ai-review. Signed-off-by: Em <em-redhat@users.noreply.github.com> Assisted-by: claude-opus
|
🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:43 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.60 |
| strict: true | ||
| contexts: | ||
| - "Build and Test" | ||
| - "Standardized CI / Run linters" |
There was a problem hiding this comment.
[medium] runtime mechanism
The required status check name "Standardized CI / Run linters" depends on the external reusable workflow job name. If the reusable workflow job is not named exactly "Run linters", the required check will never be satisfied and all PR merges to main will be blocked.
Suggested fix: Verify by checking the job name in complytime/org-infra/.github/workflows/reusable_ci.yml, or by confirming the exact check name reported by a test run.
| @@ -0,0 +1,24 @@ | |||
| # https://megalinter.io/latest/supported-linters/ | |||
| ADDITIONAL_EXCLUDED_DIRECTORIES: | |||
There was a problem hiding this comment.
[low] Secrets-Detection-Gap
ADDITIONAL_EXCLUDED_DIRECTORIES excludes .opencode, .claude, .uf, and .specify from all enabled linters, including REPOSITORY_BETTERLEAKS (secrets scanner). If a secret is accidentally committed to any of these directories, the secrets scanner will not detect it.
3 participants
Summary
Adopts the
complytime/org-infrareusable CI workflow for standardizedlinting and PR title validation, addressing issue #25. This brings
replicator in line with the org-wide CI standard already adopted by
other repos (unbound-force, dewey).
The new
Standardized CI / Run linterscheck runs MegaLinter (12org-standard linters including actionlint, shellcheck, golangci-lint,
markdownlint, yamllint, and security scanners) and validates PR titles
against Conventional Commits format via commitlint. The existing
Build and Testcheck is unchanged.Fixes: #25
How to Test
Verify workflow file: Inspect
.github/workflows/ci_checks.yml— confirm SHA-pinned
uses:reference tocomplytime/org-infrav0.7.1,
timeout-minutes: 15, least-privilege permissions.Verify MegaLinter config: Inspect
.mega-linter.yml— confirm12 org-standard linters enabled, directory exclusions for
.opencode,.claude,.uf,.specify,dist,vendor.Verify release preflight: Inspect
.github/workflows/release.yml— confirm
ci_checksarray includes both"Build and Test"and"Standardized CI / Run linters".Verify branch protection: Inspect
.github/settings.yml—confirm
Standardized CI / Run lintersadded torequired_status_checks.contexts.CI check: Observe that the
Standardized CI / Run linterscheck runs on this PR and produces MegaLinter output.
How to Demo
After merge, open any PR against
mainand observe two required CIchecks: the existing
Build and Testand the newStandardized CI / Run linters. Non-conventional PR titles will berejected by commitlint. MegaLinter will scan changed files for lint
issues across GitHub Actions, shell, Go, Markdown, YAML, and security.
Key Files Changed
CI/CD Configuration:
.github/workflows/ci_checks.yml— New consumer workflow callingorg-infra reusable CI (SHA-pinned v0.7.1)
.mega-linter.yml— New MegaLinter configuration with org-standard12-linter set and project-specific directory exclusions
.github/workflows/release.yml— Updated preflightci_checksarray to gate on both checks
.github/settings.yml— Added new required status check to branchprotection
Documentation:
AGENTS.md— Documented new CI check and added Recent Changes entrySpec Artifacts:
openspec/changes/adopt-org-infra-ci/— Proposal, design, spec,and tasks for this change
This PR was generated by /uf.finale (AI-assisted).