Skip to content

fix+harden: Health 74 template drift — restore green, then stop the weekly re-baseline churn #2816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stranske wants to merge 3 commits into from
Closed

fix+harden: Health 74 template drift — restore green, then stop the weekly re-baseline churn #2816

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
216a83b
fix: re-baseline template-drift allowlist after checkout v7.0.1 bump
stranske Jul 24, 2026
006efce
feat: make template-drift check ignore action-pin refs (zero-Tim)
stranske Jul 24, 2026
b93c095
Merge remote-tracking branch 'origin/main' into claude/keen-montalcin…
stranske Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
119 changes: 60 additions & 59 deletions config/template-drift-allowlist.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,123 +4,124 @@
# If either file changes, the fingerprint no longer matches and Health 74 fails
# until the template is aligned or this baseline is deliberately re-reviewed.
#
# 2026-06-24 re-baseline: refreshed the consumer template fingerprints for
# auto-label, capability-check, decompose, dedup, issue-optimizer, and
# weekly-metrics after the setup-python v6 digest moved to ece7cb0. The root
# workflows intentionally continue using floating major tags.
# Action-pin refs are NOT part of the fingerprint. As of 2026-07-24
# (scripts/check_template_drift.py::canonicalize_action_refs), a remote-action
# `uses: owner/repo@<ref> # comment` line is canonicalized to `owner/repo@<pinned>`
# before hashing. Root floats major tags (@v7) while consumer templates SHA-pin
# per the fleet action-pin contract, and Renovate bumps each side independently;
# those ref differences are intentional and self-managed, so they no longer
# register as drift and never require re-baselining this file. Only genuine
# functional/structural divergence (env, concurrency, sparse-checkout, extra
# steps/logic, superset workflows) keeps a pair in this allowlist. A real action
# SWAP (different owner/repo) is still detected.
#
# 2026-06-14 re-baseline: refreshed the fingerprints of 7 entries (issue-intake,
# auto-label, capability-check, decompose, dedup, issue-optimizer, weekly-metrics)
# that went stale after action-version bumps (#2391/#2394) and root feature work.
# The divergence is intentional, not a missing consumer improvement: consumer
# template workflows SHA-pin third-party actions per the fleet action-pin contract
# (docs/HISTORY.md, PR #1925) and carry LangSmith tracing env, while the root
# Workflows-repo copies use floating major tags plus repo-internal concurrency +
# sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Aligning the
# template to root would strip the contractually-required consumer action pins, so
# these are re-baselined rather than aligned.
# 2026-07-24 regeneration: all 15 fingerprints were recomputed once under action-
# ref canonicalization. This supersedes the prior per-entry re-baselines that
# were driven purely by Renovate action-pin bumps (e.g. #2799 checkout v7.0.1),
# which will no longer recur. The residual divergences captured below are the
# reviewed non-pin differences between each root workflow and its consumer twin.

[pair.1]
main = .github/workflows/agents-63-issue-intake.yml
template = templates/consumer-repo/.github/workflows/agents-issue-intake.yml
main_sha256 = 66c53b8b23089b52d0a34b75774a0fadc258a2cd0978f01b77ff8a0c74e005a5
template_sha256 = 689d22e20cc6f21df006a2f7ed54924fc05d63adea5ef89251788f888f2a5495
reason = Intentional divergence (re-baselined 2026-06-14): numeric-prefixed root agents-63-issue-intake is a Workflows-internal superset (chatgpt_sync/agent_bridge/Codex bridge, ~1.7k lines) vs the minimal consumer intake template; alias-mapped. Only the root fingerprint changed since the last baseline (#2391 actions bump).
main_sha256 = 4ede9aabaf8304c7b948e5adbbd82832248a2b8a02ae0299c8a4dab837408bb5
template_sha256 = 368e4c9c8059cb0ef1e93c8ed6573ef56bbd5886e80a463510b6719d6e3bf10d
reason = Intentional divergence: numeric-prefixed root agents-63-issue-intake is a Workflows-internal superset (chatgpt_sync/agent_bridge/Codex bridge, ~1.7k lines) vs the minimal consumer intake template; alias-mapped.

[pair.2]
main = .github/workflows/agents-71-codex-belt-dispatcher.yml
template = templates/consumer-repo/.github/workflows/agents-71-codex-belt-dispatcher.yml
main_sha256 = 46baf1443fbe633a8fee20ba09e68499fbb80bb662fc2d433b463a5e5182d66c
template_sha256 = 6354a29e2423c7b9a388ddb6a2f5ee68fc48fccd86013d06ef78bb8aad9b6ae7
reason = Existing reviewed baseline drift re-baselined 2026-06-20: exported Orchestrator skill inputs were added to both root and consumer dispatcher surfaces while preserving consumer action pinning and Codex-specific wording.
main_sha256 = 4c00b0622181cd89c09f9297446c65045538245789809ca5fc899592d26af482
template_sha256 = 53a57369e4d0f526edc88bdf4bbc079ee095ccd41a9a7fe37e0d9e0b828be8e3
reason = Intentional divergence: root and consumer dispatcher surfaces carry the exported Orchestrator skill inputs with Codex-specific wording; non-pin structural differences remain between the two.

[pair.3]
main = .github/workflows/agents-72-codex-belt-worker.yml
template = templates/consumer-repo/.github/workflows/agents-72-codex-belt-worker.yml
main_sha256 = 1c61baf6bd5d3ec29df8957e6a2a56408f4330725263b3c78cc7d3f779734c68
template_sha256 = bab184b343f99c4bb620152a07322e87c743f69d9e581083a87a3a87e1026031
reason = Existing reviewed baseline drift re-baselined 2026-06-20: exported Orchestrator skill inputs were added to both root and consumer worker workflow_call surfaces while preserving consumer action pinning and guarded merge wording.
main_sha256 = 905e1a6487c44f0705b4c83294fa5cc9e2693cfdf2927994f6dc28912516b758
template_sha256 = f8ce0688837030094e20af4aee01d25274dbffcb3eeec3fa5b34da16318f3993
reason = Intentional divergence: root and consumer worker workflow_call surfaces carry the exported Orchestrator skill inputs and guarded-merge wording; non-pin structural differences remain.

[pair.4]
main = .github/workflows/agents-73-codex-belt-conveyor.yml
template = templates/consumer-repo/.github/workflows/agents-73-codex-belt-conveyor.yml
main_sha256 = 3a19af6ea9b6aa7a7c16d8afe919dff318071e69f1b597fd7fb14bc245872ace
template_sha256 = 2a93d90300845ee800c98f1863dc42f1decd0f777756f3dc7362c3b77977dd48
reason = Existing reviewed baseline drift re-baselined 2026-06-19: runtime AC merge guard added to both root and consumer conveyor while preserving consumer action pinning differences.
main_sha256 = 055bec04b007233ec7bb40d41b3729053df190d754d445445f6c30b65cec519e
template_sha256 = 77c270fed157639722d85ab1678770317bd855188a6bbe16db4e088719c3e0cd
reason = Intentional divergence: root and consumer conveyor carry the runtime AC merge guard; non-pin structural differences remain between the two surfaces.

[pair.5]
main = .github/workflows/agents-auto-label.yml
template = templates/consumer-repo/.github/workflows/agents-auto-label.yml
main_sha256 = 502693dc19ae69d6e5502bb91ab03c234c34705fbdd7d8607e04621c07e9ed4f
template_sha256 = 08a8e826de19e93ac6f1f27692cffe09aa981f2c87c1f58dc7c99052e014e2f1
reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.
main_sha256 = 6f88039b65073cac04b163def45f33b41e3981fd8ad08e87becc6524e7087887
template_sha256 = 272c57c6a717b98ecff85d92a1415d883738bb6e840b5b93645499c7e26f58d3
reason = Intentional divergence: consumer template sets LangSmith tracing env; root adds repo-internal concurrency, query-length bounding, App-token minting, and a retry-helper fallback the consumer template omits.

[pair.6]
main = .github/workflows/agents-autofix-dispatcher.yml
template = templates/consumer-repo/.github/workflows/agents-autofix-dispatcher.yml
main_sha256 = 75c913a482fe055d348fab118a8efb35c28d65ff2cbb61073376c45fdb7332e6
template_sha256 = c5e32c178b7deb204db6f5484f760c1c4e2653fccfa3a97be0400a7b28f0044c
reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
main_sha256 = d50546b43254e3374d53a8efb27b3f47efbddce20ae4511579a103bd6ca1e27c
template_sha256 = 533b0f2241708e39e97de00bbae0795b7f9d95f32d9337e0ddcf51ed4fa4c76b
reason = Intentional divergence: root and consumer autofix dispatcher differ in repo-internal plumbing (concurrency / env) beyond action pinning.

[pair.7]
main = .github/workflows/agents-capability-check.yml
template = templates/consumer-repo/.github/workflows/agents-capability-check.yml
main_sha256 = 64b4773234585b7d982b80843868ba8086d1bb5480951c84be449a4c42b2191c
template_sha256 = 8481acbc3fcd9b7e0bcbcfcabe222d8a43a2d1dcae732ab603d14f823ae67474
reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.
main_sha256 = e1f4d43bc8b5f2ef0b314d086a070c5ddb7e45f932ed3192d0933732bbff179c
template_sha256 = 95312f7a0aa3f2c442556ff304dede0a5a06b1301f1e3ffca60130678e23ecb5
reason = Intentional divergence: consumer template sets LangSmith tracing env; root uses repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv).

[pair.8]
main = .github/workflows/agents-decompose.yml
template = templates/consumer-repo/.github/workflows/agents-decompose.yml
main_sha256 = ffc51b2a8fd50b85416b28bd126f777dc74d956cba964245342d26ff642cc34a
template_sha256 = 55a3a580ca024dc3a5610c64711b0aa71cf82e024607d98db8e43c45c9abd910
reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.
main_sha256 = 7eb36db9e6a18c82e4accfb8fbaab04421bb2ce9bbc1e98d0b9300df6e00f65d
template_sha256 = ea4373306a028425bc147bdd7e003118aab99130f872fb313644cdcf8ba36b84
reason = Intentional divergence: consumer template sets LangSmith tracing env; root uses repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv).

[pair.9]
main = .github/workflows/agents-dedup.yml
template = templates/consumer-repo/.github/workflows/agents-dedup.yml
main_sha256 = 180e9c71136b65878f4f90896470bfe2420972f0c68b6387e12fc0d808be3c52
template_sha256 = 461dd4765ca018a5152fd144b921eb0af3b14a9f07f4225114380721d57dbca6
reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.
main_sha256 = 4cb7a051fddd34137caf3fb359eaee09162b6f0b61de3a14b31f350ae4e77479
template_sha256 = 373becf5260e775b0ed7340fb8c24709a17fcf5ecd4962607ebf61b79d778de8
reason = Intentional divergence: consumer template sets LangSmith tracing env; root uses repo-internal concurrency + sparse-checkout and a retry-helper fallback the consumer template omits.

[pair.10]
main = .github/workflows/agents-guard.yml
template = templates/consumer-repo/.github/workflows/agents-guard.yml
main_sha256 = 0931588deb2fefa02b6b2fa81450579d29af8496ee5857be91b378958bd35a7c
template_sha256 = d942d54aafe9e8ba89ff9f6ab2003327a6ccccc03a68ca191f7dfd48104a94fa
reason = Intentional divergence re-baselined 2026-06-30: root and consumer guard workflows differ for pinned consumer actions/App-token setup; stranske/Workflows digest pins were refreshed together in root and consumer guard surfaces after Renovate moved the Workflows digest to ebef44a.
main_sha256 = bd3ff640a421ad6cde9cd7e0667276b0f37f517da663c0e470e1f1dfd21490fb
template_sha256 = 79333e2a48b21bf9e44638b47092f1086cbce5aebe6e69ed5f5a1c4fa0a21ecb
reason = Intentional divergence: root and consumer guard differ in App-token setup and repo-internal plumbing beyond action pinning.

[pair.11]
main = .github/workflows/agents-issue-optimizer.yml
template = templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
main_sha256 = ecb6c59d4e30c6f2742720cb4ac2b1b0e32762b0c23d953f8bfc5edcef07d89b
template_sha256 = fc08646e57af311c0dfc1bcee79f79b13aa8377be1818381007a8151d3ac148b
reason = Intentional divergence re-baselined 2026-07-07: root and consumer issue-optimizer workflows keep different auth plumbing/action pin surfaces, and the consumer template installs LLM deps from checked-out workflows-scripts/tools/requirements-llm.txt with python -m pip. Do not align wholesale because that would strip consumer action pins/token setup.
main_sha256 = 77eecd57e1a7637628bc16faedb6ef50f8cb5a810f94e286eaffd8dc50e02409
template_sha256 = a93f1a86ee6396740647fc4e923297aa3d6224bcec3f791592258d2710776d6b
reason = Intentional divergence: root and consumer issue-optimizer keep different auth plumbing, and the consumer template installs LLM deps from checked-out workflows-scripts/tools/requirements-llm.txt with python -m pip.

[pair.12]
main = .github/workflows/agents-keepalive-loop-reporter.yml
template = templates/consumer-repo/.github/workflows/agents-keepalive-loop-reporter.yml
main_sha256 = 57433673a81d5fd8b60ae8401b20f28ab9240221e8ce76a2567c0eca28355c53
template_sha256 = 1a0880645b799f10d776f50d48e36469a725495f3cd3de7535a483a4c1a1c9af
reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
main_sha256 = 87aba22f921d4e0ccc875dcd699f908718354b114f970c4930c0f722179032de
template_sha256 = 8601999200300ca18a65a7abd94480b1176706c7d0b23fed7092390ee415c838
reason = Intentional divergence: root and consumer keepalive loop reporter differ in repo-internal plumbing beyond action pinning.

[pair.13]
main = .github/workflows/agents-keepalive-sweep.yml
template = templates/consumer-repo/.github/workflows/agents-keepalive-sweep.yml
main_sha256 = fe6f037095c20e29cd004d258924f9f32eae98d76f01fbe02d6208105c58b86b
template_sha256 = 4d701b515996131eafbab75e934d8c123ebbd26a67af314a25d02d1749237167
reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
main_sha256 = b34e9b91728fbaa1ea02fb50a3f00f2554e561968777b2cfa53fee16bd7d4a33
template_sha256 = 566e3ad4ba57a2a238fa887bd1f15b5d86bcef533dd1758b4f0c708a5a7e3da4
reason = Intentional divergence: root and consumer keepalive sweep differ in repo-internal plumbing beyond action pinning.

[pair.14]
main = .github/workflows/agents-verifier.yml
template = templates/consumer-repo/.github/workflows/agents-verifier.yml
main_sha256 = 365dcf610b8f4c880c495822bf150997eb5eee6a675b7ffef590413e7673e69b
template_sha256 = 419f9bd0f309db14ecff40ac2ede3743c1bdf55a08529599368d8259542d9ce5
reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
main_sha256 = 5e1cb04f45d27ccd30395eb804203677db130c7f1bcabf8054d80cb22c189e97
template_sha256 = 9c803d40ce8b26f4450a60d6f821eb2cadbd59c42b47259d3394ad1d932fee0f
reason = Intentional divergence: consumer template carries extra state-fingerprint computation logic/outputs; root uses repo-internal concurrency and floats action tags.

[pair.15]
main = .github/workflows/agents-weekly-metrics.yml
template = templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml
main_sha256 = 3046679fc57febb2897d93b894a952ccd7e2fb3df8f48de3282d0b1edede321b
template_sha256 = aa6798871dfbd9d6b0a8fa327bff77920595dae5302e8d551d4dbbc7d9f40dd2
reason = Intentional divergence (re-baselined 2026-07-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after the durable-label guard was added to the template. Do not align: would strip consumer action pins.
main_sha256 = 6e48b36caaa2865c66fe978b75e775687b96b69eae74c5adbc1355346819f271
template_sha256 = 865fe609fbc6fde8f0f9faf338d8ba9e9e573448e8dc454fb759df003bd9b437
reason = Intentional divergence: consumer template sets LangSmith tracing env and a durable-label guard; root uses repo-internal concurrency + sparse-checkout.
2 changes: 1 addition & 1 deletion docs/ci/WORKFLOWS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ Scheduled health jobs keep the automation ecosystem aligned:
* [`health-71-sync-health-check.yml`](../../.github/workflows/health-71-sync-health-check.yml) monitors sync workflow health daily - creates issues if all recent runs failed or sync is stale (daily schedule, manual dispatch).
* [`health-72-template-sync.yml`](../../.github/workflows/health-72-template-sync.yml) validates that manifest-declared exact template-sync files are in sync with their consumer template copies (PR, push on exact-sync source/template changes).
* [`health-73-template-completeness.yml`](../../.github/workflows/health-73-template-completeness.yml) validates that consumer-intended workflows exist in the template directory and sync manifest - prevents workflows from being added to .github/workflows/ without being synced to consumer repos (PR, push on workflow/template changes).
* [`health-74-template-drift.yml`](../../.github/workflows/health-74-template-drift.yml) checks normalized content drift between main agent workflows and their consumer repo templates. It fails on unallowlisted drift and permits only fingerprinted baseline differences recorded in `config/template-drift-allowlist.txt` (PR, push on workflow/template changes).
* [`health-74-template-drift.yml`](../../.github/workflows/health-74-template-drift.yml) checks normalized content drift between main agent workflows and their consumer repo templates. It fails on unallowlisted drift and permits only fingerprinted baseline differences recorded in `config/template-drift-allowlist.txt` (PR, push on workflow/template changes). Remote-action `uses:` refs are canonicalized before hashing (see `canonicalize_action_refs` in `scripts/check_template_drift.py`), so Renovate action-pin bumps do not count as drift and never require re-baselining the allowlist; only genuine functional divergence does.
* [`health-75-api-rate-diagnostic.yml`](../../.github/workflows/health-75-api-rate-diagnostic.yml) monitors API rate limit utilization across PATs and GitHub Apps - alerts when usage exceeds 85% and provides load balancing analysis (scheduled every 4 hours, manual dispatch).
* [`health-76-codex-cli-freshness.yml`](../../.github/workflows/health-76-codex-cli-freshness.yml) emits a weekly machine-readable freshness contract for the verifier `@openai/codex` CLI pin and uploads the deliberate update path as an artifact (scheduled weekly, manual dispatch).
* [`health-78-backplane-contract.yml`](../../.github/workflows/health-78-backplane-contract.yml) Workflows-internal gate that runs on PRs touching the run-contract/v1 contract set (schemas, registry, validator, fixtures): asserts the three schemas load as valid draft 2020-12 JSON Schema, `config/backplane_participants.json` keeps the required shape, and the bundled valid/invalid fixtures behave (the validator self-smoke).
Expand Down
Loading