Repository navigation
feat: standards channel staleness alarm and pre-promotion consumer verification (#1173) - #1293
Conversation
…rification (#1173) standards/v1-stable is promoted by hand and has no canary stage. Nothing said when a promotion was due, and nothing checked that one was safe: the channel once fell 14 commits and 8 standards/ files behind main unnoticed. Staleness alarm - scripts/standards-staleness.sh compares standards/ on the channel with the default branch, once a day (standards-staleness.yml). - It keeps one issue open while a file under standards/workflows/ differs, or the oldest unpublished change is more than 7 days old (STANDARDS_STALENESS_MAX_DAYS). The issue lists the differing files, is updated in place, and is closed once the channel catches up. - A comparison that cannot be read fails the run. It is never reported as fresh. - The decision and the issue text are a pure core, scripts/lib/standards-staleness.sh. Pre-promotion verification - `cut-standards-release.sh verify <ref>` runs every known channel consumer pinned to the candidate commit and exits non-zero if any fails. - `cut --verify` runs the same check first and refuses to cut on a failure. It is opt-in, so `cut` without it behaves as before. - The consumers are data: scripts/lib/standards-channel-consumers.json. Each declares the output that proves it ran, so a consumer that skips its checks and exits 0 does not pass. standards-versioning.md documents both steps and states that a promotion is fleet-wide with no canary stage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 1 minute. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
CodeAnt Nitpicks1 code suggestion1. A consumer row without
|
CodeAnt PR Risk: Low Risk
Assessed commit: |
|
dev-lead is withholding action on this item. It is labeled To re-enable automated pickup: remove the |
…git trees, require expect_output Staleness alarm - Both ends are resolved to commit SHAs first, and the compare and the commit list run at those SHAs. A branch that moves mid-run can no longer pair one commit's diff with another commit's SHA. - The differing files now come from the two git trees of standards/, not from the compare response. Compare lists at most 300 changed files for the whole repo, so a standards change could be cut off, read as "no difference", and close an open alarm. Equal tree SHAs mean standards/ is identical. A listing that is unreadable or truncated fails the run. Verification - A consumer row must declare expect_output. Without it the consumer would pass on its exit code alone. Such a row is refused as malformed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-11T04:06:16Z. |
|
2 participants
Summary
Two supports for the hand-promoted standards channel: a daily alarm that says when a promotion is due, and a scripted check that it is safe before the tag moves.
Staleness alarm
scripts/standards-staleness.shcomparesstandards/onstandards/v<major>-stablewith the default branch.standards-staleness.ymlruns it once a day at 10:23 UTC and on manual dispatch (with adry_runinput).standards/workflows/differs, or the oldest unpublished change tostandards/is more than 7 days old (STANDARDS_STALENESS_MAX_DAYS).Pre-promotion verification
cut-standards-release.sh verify <ref>runs every known channel consumer pinned to the candidate commit and exits non-zero if any fails.cut --verifyruns the same check first and refuses to cut on a failure, writing no tag.scripts/lib/standards-channel-consumers.json. Today that is the repo-template drift guard and the persona manifest validator, both inpetry-projects/.github-private.Docs
standards/standards-versioning.mddocuments both steps and states plainly that a promotion is fleet-wide with no canary stage.Closes #1173 ("standards/v1-stable has no staleness alarm and no pre-promotion consumer verification — it fell 14 commits / 8 files behind main unnoticed").
Problem
standards-versioning.mdmakes promotion a human decision, but nothing told that human when. The channel fell 14 commits and 8standards/files behindmain, and the symptom surfaced in another repo as a red drift check. The verification done before the v1.1.0 cut was by hand and written down nowhere.Decision for review:
--verifyis opt-inThe issue asks that the tooling "refuses to cut if any consumer fails".
cut --verifydoes that.cutwithout the flag behaves exactly as before.I did not make verification the default because it would change what
cutdoes for every existing caller and test, and this repo's rule is that such a change needs human approval. If you want it on by default, say so and it is a small follow-up (with a--no-verifyescape for rollbacks).Failure handling
standards/, read at commit SHAs resolved up front. The compare API caps its file list at 300 for the whole repo, so it is not used for this. An unreadable or truncated tree listing fails the run.standards/after the channel commit. If none is listed, it falls back to the channel commit's own date and the issue says "at most N days".expect_outputis refused as malformed. Each consumer declares output that proves it ran and output that must not appear. The drift guard exits 0 when it cannot compute a baseline and skips the file, so its "Could not compute" warning is rejected.Risk
Low to medium.
issues: write. Its only writes are opening, editing and closing one issue that carries a hidden marker.verifyexecutes commands fromstandards-channel-consumers.jsonin a clone of each consumer repo, on the operator's machine, with the operator'sghlogin. Those are the same two commands the operator already ran by hand.cutis unchanged unless--verifyis passed.Test plan
bats tests/standards_release.bats tests/standards_staleness.bats: 88 pass (28 existing, 22 new for verify, 38 new for the alarm). No existing test was edited.shellcheck --severity=warning -xon the four scripts: clean.actionlinton both workflows: clean.check-cron-timing.sh: passes.markdownlint-cli2on the standard: 0 errors.ghon 2026-10-11 (all read-only):verify main: both consumers PASS.verify mainwith a Python that lacksjsonschema: the persona validator is reportedFAIL exit-1with its error shown, and the run is refused.cut v9.9.9 --commit <main sha> --verify --dry-run: verifies, then "no tags written".cut ... --verify --dry-runwith a SHA that does not exist: "REFUSE to cut".DRY_RUN=true standards-staleness.sh: 1 differingstandards/file, 0 templates, 0 days old, decision PENDING, nothing to do.SS_CHANNEL=standards/v1.0.0: 20 differing files, 11 templates, decision STALE, and the issue body it would open.ghonly.Rollback
Revert this PR. If the alarm has opened an issue, close it by hand.
Monitoring
The first scheduled run of "Standards Channel Staleness" after merge. Its job summary shows the channel, the branch, the count of differing files and the decision. With today's state it should report PENDING and open nothing.
Interaction contract
gh+jqcheck.🤖 Generated with Claude Code