fix: gate JSON 校验去 apt 化——apt-get update 挂起烧穿 10min timeout（ADR-0013 后续）

[randypanding]

改了什么

• gate.yml JSON 校验步骤：sudo apt-get update && apt-get install jq + jq -e 循环 → 纯 python3 json.load 循环（python 已由前置步骤就绪，零外部依赖）

为什么

故障复现（客观证据）：main 分支最近两次 gate run（32217218076 / 32217301896，对应 #55/#56 合并的 push 事件）双双 cancelled——job 均在「JSON 校验」步骤卡死 10 分钟后被 timeout-minutes: 10（ADR-0013 红队 #18-P2 引入的熔断）砍掉：

• 04:50:38 与 04:52:02 两个 run 的 steps 记录一致：checkout/setup-python/YAML 解析（~5s）全部成功 →「JSON 校验」started 04:52:12 → 05:02:18 cancelled（10m06s），后续步骤全 skipped；
• 挂起点是 apt-get update（runner 镜像源瞬断），非 jq 本身；同步骤在 04:17/04:27 的 run 正常通过——瞬态基础设施故障 + 无重试的 apt 调用 = main gate 可用性单点；
• timeout 熔断本身按设计工作（红队 红队演练：治理体系问题报告（流程断点/角色/认领/死循环/安全） #18-P2 防的就是失控 job），但一个纯语法校验步骤不应有 10 分钟的网络暴露面。

修复依据：

1. JSON 语法校验用 python3 标准库即可，语义等价（jq -e . ≡ json.load 解析成功即合法）；
2. adr-required 步骤仍需 jq，但 runner 镜像预装 jq——实证：CI-Workflows ci.yml 的 gate/hygiene 从不安装 jq 且直接使用（L77/L101-115），feat: 组织地图 REPOS.yaml 与仓申报漂移检测 #7-fix: secret 命名统一 + drift §5 bug + 上游 external 声明 #11 五个 PR 连跑绿；本步骤删除 apt 后 adr-required 不受影响。

怎么验证

• 本地 yaml.safe_load 解析修改后 gate.yml 通过；python3 片段对 rulesets/*.json + expected-state.json 全部 load 成功（4 files）
• 同构校验：改动前后校验目标文件集合一致（governance/rulesets/*.json + governance/expected-state.json）
• CI：本 PR gate 跑绿即证明（PR 事件路径含 adr-required 的 jq 使用，同时验证预装假设）

风险 / 回滚

• 低：校验语义等价；若 runner 未来不预装 jq，adr-required 会 fail-closed 报错而非挂起（loud failure）；revert 即回滚

ADR: ADR-0013（gate 硬化批次的可靠性后续——timeout 熔断已到位，本 PR 消除其被瞬态 apt 故障无谓消耗的场景）

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Limit details: You’ve used all 3 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b73db8b8-11d6-401f-ba4d-80fbfcc4cb6b

📥 Commits

Reviewing files that changed from the base of the PR and between bf1deec and 3e54c0b.

📒 Files selected for processing (1)

• .github/workflows/gate.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Eliminate apt hangs from gate JSON validation

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Replaces apt-installed jq with Python standard-library JSON parsing.
• Prevents package-mirror hangs from exhausting the gate timeout.
• Preserves validation coverage for rulesets and expected state.

Diagram

graph TD
  Event["PR or push"] --> Gate["Gate job"] --> Python["Setup Python"] --> Validator["JSON validator"] --> Files["Governance JSON"] --> Checks["Remaining checks"]

Loading

High-Level Assessment

The proposed approach is appropriate because Python is explicitly provisioned earlier and its standard library fully covers JSON syntax parsing without network access. Using the runner’s preinstalled jq directly was considered, but it would retain an implicit image dependency; adding retries around apt would preserve the avoidable network failure surface.

Files changed (1) +11 / -2

Bug fix (1) +11 / -2

gate.ymlReplace apt-backed JSON validation with Python +11/-2

Replace apt-backed JSON validation with Python

• Removes apt update and jq installation from the JSON validation step, avoiding transient package-mirror hangs. Parses all ruleset files and expected-state.json with Python’s json module while retaining a fail-fast check for missing ruleset inputs.

.github/workflows/gate.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. JSON scalar values now pass ✓ Resolved 🐞 Bug ≡ Correctness

Description

The new validator accepts top-level null and false, while the previous jq -e . check rejected
them because jq's -e status is false for those outputs. This lets a ruleset or expected-state file
with a syntactically valid but unusable scalar pass the gate and reach consumers that expect object
fields, producing null/invalid API data instead of failing validation.

Code

.github/workflows/gate.yml[50]

+              json.load(open(f, encoding="utf-8")); print("OK", f)

Relevance

●●● Strong

Recent accepted precedents favor enforcing schema semantics and rejecting valid-but-unusable
payloads, especially required fields and conditional constraints.

PR-#13
PR-#47

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed loop only calls json.load and ignores its returned value, so Python accepts valid
scalar JSON documents. The same files are consumed through object-field lookups: apply.sh reads
.name from every ruleset and .actions_policy... from expected-state.json, while the workflow
change removed the earlier jq -e . command that supplied the stronger exit-status check.

.github/workflows/gate.yml[45-50]
governance/apply.sh[53-76]
governance/drift-check.sh[26-44]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The replacement uses `json.load` as a syntax-only check, so top-level `null` or `false` now passes even though the removed `jq -e .` check failed for those values. The validated files are governance documents consumed as objects, so this weakens the gate and can allow unusable state into later scripts.

## Issue Context
Preserve the dependency-free Python validation, but enforce the prior truthy-result behavior or, preferably, the actual document shape expected by the consumers. At minimum reject `None` and `False`; ideally require a JSON object for each ruleset and `expected-state.json`.

## Fix Focus Areas
- .github/workflows/gate.yml[45-50]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

Review mode: 🚀 Fast: This is a localized one-hunk CI workflow change replacing apt/jq JSON parsing with Python stdlib parsing, with contained behavior and no high-risk contract, security, or data-path impact.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗