refactor(actions): consolidate 18 hourly review-repair callers into one file - #1673
Conversation
…ne file
Replaces the 18 near-identical per-repository hourly review-repair caller
workflows with one file, .github/workflows/hourly-review-repair.yml, per the
repository owner's request ("이런 Workflow는 단일 파일로 통합하라") citing
run ContextualWisdomLab/.github/actions/runs/33524178483/job/99910668839.
A single on.schedule list (17 distinct minutes, staggering comments
preserved) feeds a resolve-target job that looks up github.event.schedule in
a case/esac table, fanned out through a matrix dispatch-review-repair job
that keeps every repository's own independent, non-cancelling
concurrency.group. pr-review-fix-scheduler.yml is unchanged.
Auditing the 18 originals for this consolidation found two real issues, both
handled deliberately: fast-mlsirm and metering-billing-platform had
independently collided on cron minute 49 (now one shared trigger,
matrix-fanned to both, so each still dispatches exactly once/hour); and
clearfolio-hourly-review-repair.yml was the only one of the 18 missing its
job-level id-token: write grant (closed uniformly across the consolidated
matrix). Full mapping and rationale: docs/doctoring/hourly-review-repair-
single-file-consolidation.md and ADR-0021.
13 dedicated per-repository test files are replaced by
tests/test_hourly_review_repair_callers.py, which extracts and executes the
lookup script as a subprocess for every schedule and asserts it against the
exact parameters the deleted files used. 4 other test files that used a
since-deleted caller as a representative example, plus the quality-gate
workflow's path filters and several doc cross-references (AGENTS.md,
ARCHITECTURE.md, docs/automation/hourly-review-repair.md), are updated in
place rather than deleted.
Full suite: 2566 passed, 1 skipped (pre-existing, environment-conditional),
21 subtests passed; 100% branch coverage and 100% docstrings on scripts/ci
(untouched by this change); actionlint clean across all workflow files.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 23 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (48)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Fresh revalidation immediately before merge: PR is Ready and mechanically mergeable with no conflict; every inline review thread is resolved; exact-head CodeRabbit and Devin Review statuses are success; no current substantive security/review finding remains. The source repair is independently reviewed, including the privileged registry-retirement boundary: no This is therefore the bounded circular control-plane case: the change removes 18 duplicate scheduled caller sources and provides the only reviewed migration that can retire their persistent Actions registry identities, while its ordinary admission evidence is itself waiting behind the fleet pressure it reduces. No test failure, real security finding, meaningful CHANGES_REQUESTED, malformed provenance, or merge conflict is being bypassed. Merge is head-guarded with the exact SHA above. After landing, the protected-main registry migration must be re-read and verified before removing its one-shot source. |
Resolve CHANGELOG.md conflict by keeping both this PR's quality-CI consolidation entry and main's hourly-review-repair-callers entry (#1673), newest first. Also fold in a fix for a Devin Review finding on the new exact-head-coverage-quality-gate.yml reusable workflow: route pytest_target/coverage_include/compileall_targets through step-level env vars instead of interpolating ${{ inputs.* }} directly into the run: script, matching this repo's own established convention (test_verifier_is_data_only_and_workflow_never_executes_downloaded_evidence in test_exact_artifact_sbom_attestation_contract.py already enforces this for exact-artifact-sbom-attestation.yml). Verified glob/word-split behavior for the two callers is unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Summary
.github/workflows/hourly-review-repair.yml, per the repository owner's request ("이런 Workflow는 단일 파일로 통합하라", citing hosted runContextualWisdomLab/.github/actions/runs/33524178483/job/99910668839).github.event.schedulelookup and a matrix fan-out, preserving each repository's exact target, base branch, retry floor, and independent non-cancelling concurrency group. The existing product-neutralpr-review-fix-scheduler.ymlremains unchanged.id-token: writepermission that its siblings had, now made uniform. Its doctoring now matches the consolidated non-cancelling/OIDC boundary.1a40fdd23c57bc558dc71335fe3e84123663181dcarries an explicit one-shot registry retirement migration, a dedicated regression contract, focused-CI ownership, and doctoring.Registry-identity migration
.github/workflows/hourly-review-repair-registry-retirement.ymlhas no schedule, noworkflow_dispatch, and no repository-content/model/reviewer authority. It can execute only from reviewed source pushed to protectedmain; the job independently requiresgithub.event_name == 'push'andgithub.ref == 'refs/heads/main'. It has onlyactions: write+contents: read, enumerates the full Actions workflow registry, and requires exactly one active.github/workflows/hourly-review-repair.ymlreplacement before any mutation.The migration then resolves and retires all 18 deleted caller identities. Every active identity is disabled through the Actions API, re-read, and required to report
disabled_manually; missing, duplicate, unresolved, or unexpected states fail closed. The replacement is rechecked active after legacy retirement, and the migration workflow disables its own registry identity last. A transient hosted failure is retried from the same reviewed protected-main run/job rather than by executing feature-branch workflow code.After one hosted protected-main migration run proves all 18 legacy identities plus the migration identity disabled while the replacement remains active, remove the migration YAML in a normal cleanup PR. Its own registry identity will already be disabled, avoiding creation of another enabled orphan. PR checks validate the migration source but are not post-merge retirement evidence.
tests/test_hourly_review_repair_registry_retirement.pypins the protected-main-push-only/narrow-permission boundary, all 18 exact legacy paths, replacement-before-disable ordering, read-after-write verification, self-disable-last behavior, and absence of reviewer/provider credentials.Contextual Orchestrator Review Repair Quality CInow watches the migration workflow, its test, and its doctoring record on both PR and push and runs the dedicated contract as part of the repository test suite.Exact current state — 2026-09-02
1a40fdd23c57bc558dc71335fe3e84123663181d;Merge boundary
Do not bypass protection or reuse predecessor evidence. Merge only after every then-applicable exact-head required workflow/reviewer gate is terminal-success on one unchanged head. Registry retirement itself occurs only after the replacement is active on protected
main; it must then be verified from the hosted migration run before the one-shot source is removed.