fix: §8 直推检测增加初始建仓导入豁免清单（ADR-0016 附录）

[randypanding]

改了什么

• governance/expected-state.json：新增 direct_push_exemptions 字段——.github 初始建仓导入的 2 个直推 commit 完整 SHA 逐一登记
• governance/drift-check.sh §8：豁免清单读取与逐 SHA 匹配（grep -qF 全 SHA 精确匹配，非子串）；命中豁免输出 OK 行注明依据，未命中照常走关联 PR 复核

为什么

.github 仓初始治理树导入（9b056b3a / 416f5f5，"feat: GitHub 企业级安全与质量体系搭建"）发生在 policy_effective（2026-08-19T00:00Z）之后、gate/PR 机制建立之前——彼时仓库尚不存在，初始 commit 结构上无法走 PR（flows.new_repo step1-2 的固有形态）。§8 直推检测将它们报为 P0 漂移属误报。

豁免采 GM-2 破玻璃回填的机器可读形式：逐完整 SHA 落盘登记 + ADR 背书（ADR-0016 附录），不引入时间窗/消息模式等可被滥用泛化的弱判据——豁免范围被 SHA 唯一钉死，新直推 commit 不可能搭便车。

窗口外核查：同消息的 6a00fbf（2026-08-18T21:08Z）早于 policy_effective，天然在窗外，无需豁免。

怎么验证

• 本地 GH_TOKEN=… bash governance/drift-check.sh：30 OK / 0 DRIFT / exit 0——§8 输出 repo '.github' commit 9b056b3a/416f5f57 初始建仓导入（§8 豁免清单，ADR-0016 附录回填），四仓 no-direct-push 全绿
• bash -n 通过；jq -e JSON 解析通过
• 豁免 SHA 经 commits/{sha}/pulls API 复核确无关联 PR（确系直推、确系建仓导入消息）

风险 / 回滚

• 低：豁免只缩窄 §8 的报错面（消除既定误报），不放松对任何新直推的检测；revert 即恢复报错

ADR: ADR-0016

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Limit details: You’ve used all 3 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a0d601d-5f08-4f6f-8a07-c7c3709f38a0

📥 Commits

Reviewing files that changed from the base of the PR and between 670df89 and f49095a.

📒 Files selected for processing (2)

• governance/drift-check.sh
• governance/expected-state.json

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

修复 §8 初始建仓直推误报

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• 为初始建仓导入提交登记逐仓、完整 SHA 豁免。
• §8 命中豁免后跳过 PR 复核，其他提交继续严格检测。

Diagram

graph TD
  G["Commit List API"] --> C["§8 Drift Check"] --> M{"SHA exempt?"}
  E["Expected State"] --> M
  M -->|yes| O["OK Result"]
  M -->|no| P["PR Lookup API"] --> R{"PR found?"}
  R -->|yes| O
  R -->|no or error| D["Drift Result"]

Loading

High-Level Assessment

逐仓登记完整 SHA 并由 ADR 背书，是处理不可经 PR 创建的初始仓库提交的最小权限方案。时间窗或提交消息匹配会形成可复用绕过条件，而伪造历史 PR 不符合真实建仓流程；因此当前精确白名单策略最合适，并保留了所有未登记提交的 fail-closed 检测。

Files changed (2) +14 / -0

Bug fix (1) +7 / -0

drift-check.sh在 §8 直推检测中应用完整 SHA 豁免 +7/-0

在 §8 直推检测中应用完整 SHA 豁免

• 从 expected-state 读取当前仓库的直推豁免清单。命中登记 SHA 时输出带 ADR-0016 依据的 OK 结果并跳过关联 PR 查询；未命中提交保持原有 fail-closed 复核流程。

governance/drift-check.sh

Other (1) +7 / -0

expected-state.json登记初始建仓直推提交豁免 +7/-0

登记初始建仓直推提交豁免

• 新增 direct_push_exemptions 配置，并为 '.github' 仓库登记两个初始治理树导入提交的完整 SHA。配置注释说明了建仓阶段无法走 PR 的原因及 ADR-0016 背书要求。

governance/expected-state.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

1. drift-check.sh uses admin token 📘 Rule violation ⛨ Security

Description

The added exemption logic extends a GitHub API-backed operation that authenticates with an
externally supplied organization-admin GH_TOKEN. It does not obtain a cloudbrid-agent
single-repository token through scripts/gh-app-token.sh as required.

Code

governance/drift-check.sh[209]

+  EXEMPT=$(jq -r --arg r "$r" '.direct_push_exemptions[$r] // [] | join(" ")' "$EXPECTED")

Relevance

● Weak

Nearly identical GH_TOKEN scope finding was rejected in PR #49 for this script and API pattern.

PR-#49

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Compliance rule 2778539 requires scripts interacting with GitHub to authenticate exclusively through
scripts/gh-app-token.sh using single-repository tokens. The changed exemption lookup at line 209
consumes commit rows fetched by the API loop at lines 180-220, while the script's authentication
setup at lines 7-22 explicitly requires an externally supplied organization-admin GH_TOKEN.

Rule 2778539: Agent operations must use the cloudbrid-agent GitHub App identity via scripts/gh-app-token.sh with single-repo tokens
governance/drift-check.sh[7-22]
governance/drift-check.sh[180-220]
scripts/gh-app-token.sh[20-29]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The direct-push exemption logic depends on commit data fetched using an externally supplied organization-admin `GH_TOKEN`, contrary to the required cloudbrid-agent authentication flow.

## Issue Context
Repository-scoped GitHub operations must obtain tokens through `scripts/gh-app-token.sh`, with each token restricted to the repository being checked. Preserve the current fail-closed drift behavior while removing reliance on generic or organization-wide credentials.

## Fix Focus Areas
- governance/drift-check.sh[7-22]
- governance/drift-check.sh[180-220]
- scripts/gh-app-token.sh[20-29]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

Review mode: ⚖️ Balanced: This changes runtime drift-detection behavior and introduces an exemption mechanism for direct pushes, so the bypass semantics and exact-match handling warrant a complete single-pass review.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗