fix(sync): cover every shared workflow drift pair

[stranske]

Source: Issue #3182

Closes #3182

Automated Status Summary

Scope

scripts/check_template_drift.py:210 discovers root-versus-template pairs with a single narrow glob:

def discover_workflow_pairs(repo_root: Path) -> list[WorkflowPair]:
    main_dir = repo_root / ".github" / "workflows"
    template_dir = repo_root / "templates" / "consumer-repo" / ".github" / "workflows"
    ...
    for main_path in sorted(main_dir.glob("agents-*.yml")):

At base 451b609, 25 basenames exist in both workflow trees and 18 match agents-*.yml. The remaining
seven have no root-versus-template content gate at all, and four of them genuinely differ today:

file	differing lines	root	template
the consumer Gate, pr-00-gate.yml	148	1158	1130
autofix.yml	154	516	588
maint-coverage-guard.yml	81	340	343
reusable-pr-context.yml	22	250	236
pr-46-dependency-repair-contract.yml	0	58	58
autofix-versions.env	0	15	15
maint-87-docs-drift-fix-agent.yml	0	113	113

This also explains a fact that reads innocently: config/template-drift-allowlist.txt holds 16
fingerprint pairs against 25 shared basenames. The nine-pair gap is NOT "those nine are identical" — it
is seven files outside the glob plus two inside it that happen to normalize equal. The Gate is the
largest of the four divergent files and the least guarded, and it is the workflow whose green result
keepalive requires before it will drive any agent PR.

The fix has been implemented and machine-verified in a throwaway clone: changing the glob to *.yml
makes the named test below pass, and the Orchestrator's break verifier local_verify.py returned
{"verdict":"PASS","reason":"candidate tests pass live and fail against the base implementation"} with
green returncode 0 and red returncode 1.

Known and required cost: with the glob widened, python3 scripts/check_template_drift.py exits 1
with four newly-visible unallowlisted pairs (autofix.yml, maint-coverage-guard.yml, the Gate,
reusable-pr-context.yml), reporting 20 pairs instead of 16. That is the work of this issue, not a side
effect to suppress: each of the four needs either alignment or a deliberate allowlist entry with a
written divergence rationale. Merging the widened glob without those four entries lands a red gate.

Tasks

• Change the discovery glob in scripts/check_template_drift.py:210 from agents-*.yml to *.yml, leaving the existing missing-counterpart guard below it unchanged.
• Diff root against template for autofix.yml and either align the template or add a fingerprint pair to config/template-drift-allowlist.txt stating the divergence.
• Diff root against template for maint-coverage-guard.yml and either align the template or add a fingerprint pair to config/template-drift-allowlist.txt stating the divergence.
• Diff root against template for pr-00-gate.yml and either align the template or add a fingerprint pair to config/template-drift-allowlist.txt stating the divergence.
• Diff root against template for reusable-pr-context.yml and either align the template or add a fingerprint pair to config/template-drift-allowlist.txt stating the divergence.
• Add test_pair_discovery_covers_every_shared_basename in tests/scripts/test_check_template_drift_coverage.py using the body given in Implementation Notes.

Acceptance criteria

• python3 -m pytest tests/scripts/test_check_template_drift_coverage.py::test_pair_discovery_covers_every_shared_basename -q exits 0.
• The PR body quotes a deliberate break of that named test (glob reverted to agents-*.yml) showing it FAIL and naming the six uncovered basenames, and the revert showing it PASS, both as raw pytest output.
• python3 scripts/check_template_drift.py exits 0 on the merged tree.
• python3 scripts/check_template_drift.py reports 20 pairs, countable from its output lines.
• grep -c "Existing reviewed baseline drift" config/template-drift-allowlist.txt returns 0.
• python3 -m pytest tests/scripts -q exits 0.

Summary by CodeRabbit

• Chores

  • Improved workflow template tracking to cover all shared workflow files.
  • Documented approved differences between primary and consumer workflow configurations.
  • Added coverage records for additional workflow templates and their reviewed variations.

• Tests

  • Added regression coverage to detect shared workflows missing from template-drift checks, helping prevent configuration inconsistencies.

[stranske]

Runner dispatch state for autofix on PR #3194. Do not edit.

[github-actions]

Runner dispatch state for codex on PR #3194. Do not edit.

[stranske-keepalive]

🤖 Keepalive Loop Status

PR #3194 | Agent: Codex | Iteration 3/12

Current State

Metric	Value
Iteration progress	[###-------] 3/12
Action	review (progress-review-4)
Gate	success
Tasks	0/12 complete
Timeout	45 min (default)
Timeout usage	9m elapsed (22%, 36m remaining)
Keepalive	✅ enabled
Autofix	❌ disabled

🔍 Failure Classification

| Error type | infrastructure |
| Error category | unknown |
| Suggested recovery | Capture logs and context; retry once and escalate if the issue persists. |

[stranske-keepalive]

Keepalive Work Log (click to expand)

#	Time (UTC)	Agent	Action	Result	Files	Tasks	Progress	Commit	Gate
0	2026-08-23 12:13:10	Codex	wait (gate-cancelled-transient-transient)	skipped	—	0	0/12	—	cancelled
1	2026-08-23 12:16:07	Codex	run (bypass-rate-limit-gate)	success	32 file(s)	0	0/12	—	cancelled
1	2026-08-23 12:20:07	Codex	run (agent-run-skipped)	skipped	—	0	0/12	—	cancelled
1	2026-08-23 12:29:13	Codex	fix (agent-run-skipped)	skipped	—	0	0/12	—	failure
1	2026-08-23 12:29:53	Codex	fix (agent-run-skipped) retry	skipped	—	0	0/12	—	failure
2	2026-08-23 12:49:27	Codex	run (ready)	success	32 file(s)	0	0/12	—	success
3	2026-08-23 15:16:25	Codex	run (ready)	success	32 file(s)	0	0/12	—	success
3	2026-08-23 16:23:09	Codex	wait (gate-pending-transient)	skipped	—	0	0/12	—	—
3	2026-08-23 16:32:16	Codex	review (progress-review-4)	skipped	—	0	0/12	—	success

[github-actions]

Autofix updated these files:

• tests/scripts/test_check_template_drift_coverage.py

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 9 minutes

Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: aa299f0a-b12e-4762-ac3b-3ccd1175c214

📥 Commits

Reviewing files that changed from the base of the PR and between 2a9b0cf and bb04334.

📒 Files selected for processing (6)

• .github/workflows/health-74-template-drift.yml
• config/template-drift-allowlist.txt
• docs/ci/WORKFLOWS.md
• docs/ci/WORKFLOW_SYSTEM.md
• tests/scripts/test_check_template_drift_coverage.py
• tests/workflows/test_template_drift_workflow.py

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 7bce8e47-2c96-4d08-b6db-518b56cdeada

📥 Commits

Reviewing files that changed from the base of the PR and between 35267fb and 2a9b0cf.

📒 Files selected for processing (3)

• config/template-drift-allowlist.txt
• scripts/check_template_drift.py
• tests/scripts/test_check_template_drift_coverage.py

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The drift checker now discovers all shared .yml workflow pairs. A regression test verifies complete basename coverage. The allowlist records reviewed fingerprints and divergence reasons for four newly detected workflow pairs.

Changes

Template drift coverage

Layer / File(s)	Summary
Expand pair discovery and verify coverage scripts/check_template_drift.py, tests/scripts/test_check_template_drift_coverage.py	discover_workflow_pairs scans all .yml files. The regression test checks every shared workflow basename, including configured aliases.
Record reviewed workflow divergences config/template-drift-allowlist.txt	The allowlist updates rationale for the autofix dispatcher and verifier. It adds fingerprints and reviewed divergence reasons for autofix.yml, maint-coverage-guard.yml, pr-00-gate.yml, and reusable-pr-context.yml.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 2a9b0

The change broadens workflow drift discovery and adds corresponding allowlist coverage and tests. No actionable merge-blocking risk remains; it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes implement the required glob update, four divergence allowlist entries, and shared-basename coverage test for issue #3182.
Out of Scope Changes check	✅ Passed	All summarized changes directly support workflow drift discovery, divergence handling, or regression coverage required by issue #3182.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: expanding workflow drift-pair coverage.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-3182-drift-pair-discovery

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f282c15f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[stranske]

Closer recovery — test-quality + Health 74 trigger scope (head cb9e3ed7)

P1 thread PRRT_kwDOQprj9M6bfKev: Health 74 push/pull_request path filters now match .github/workflows/*.yml (not only agents-*.yml). Docs updated in docs/ci/WORKFLOWS.md and docs/ci/WORKFLOW_SYSTEM.md to describe all shared-basename pairs, not agent-only scope. Workflow contract test added.

Gate test-quality failure: tests/scripts/test_check_template_drift_coverage.py now uses assert missing == [] (literal expected assertion per check_gate_diff_quality.py).

Local validation: check_gate_diff_quality.py passed; focused pytest 3 passed (test_check_template_drift_coverage, test_template_drift_workflow).

Fresh Gate CI is queued on this head. Await green required checks + seven-minute post-push window before merge disposition.

[agents-workflows-bot]

🤖 Bot Comment Handler

• Agent: codex
• Bot comments to address: 1
• Exact PR head: bb04334
• Controller part: 1 of 1

The agent is reassigned only after every controller part is durable on the PR.
Each entry links to the authoritative review thread containing its full context.

Active thread controller

• PRRT_kwDOQprj9M6bfKev — scripts/check_template_drift.py:210
  • fix(sync): cover every shared workflow drift pair #3194 (comment)
  • Acceptance criterion: Trigger drift checks for all newly discovered workflows Expanding discovery to every *.yml pair is ineffective for root-side changes to the new non-agent pairs: in the reviewed .github/workflows/health-74-template-drift.yml, both push.paths and `pull_r...

Required outcome

1. Inspect every listed active thread on the exact head.
2. Implement and validate any still-valid criterion; do not make no-op edits.
3. Reply with exact-head evidence and request a thread-specific reviewer disposition.
4. Never self-resolve reviewer threads.
5. Do not report completion while any listed thread remains active; a generic top-level review is insufficient.

[stranske]

The active P1 path-trigger finding is already fixed on exact head cb9e3ed7: Health 74 now matches .github/workflows/*.yml and the template workflow directory on both push and pull_request; docs/ci/WORKFLOWS.md and docs/ci/WORKFLOW_SYSTEM.md describe the expanded all-workflow scope. Revalidated: uv run --extra dev python -m pytest tests/workflows/test_template_drift_workflow.py tests/scripts/test_check_template_drift_coverage.py -q and python3 scripts/check_template_drift.py --allowlist config/template-drift-allowlist.txt pass. Leaving reviewer-owned resolution untouched.

[stranske]

Closer verification (2026-08-23) for P1 thread PRRT_kwDOQprj9M6bfKev: All three concerns are satisfied on exact head cb9e3ed7:

1. Health 74 trigger paths — .github/workflows/health-74-template-drift.yml has paths: ['.github/workflows/*.yml', ...] in both push and pull_request triggers, covering autofix.yml, maint-coverage-guard.yml, pr-00-gate.yml, and all other root workflows — not just agents-*.
2. docs/ci/WORKFLOWS.md — Health 74 entry updated to say "PR, push on any .github/workflows/*.yml" (agent-only scope removed).
3. docs/ci/WORKFLOW_SYSTEM.md — Updated in the same head.
4. scripts/check_template_drift.py line 210 — glob changed from agents-*.yml to *.yml.

Bot Comment Handler dispatched (run 32642394133) to process the remaining thread resolution.

[stranske]

Closer exact-head review disposition for bb0433418454b222c728c8195ba230149acd4893:

The active Health 74 trigger-path finding is satisfied. .github/workflows/health-74-template-drift.yml now watches all root and consumer *.yml workflow pairs on both push and pull_request; docs/ci/WORKFLOWS.md and docs/ci/WORKFLOW_SYSTEM.md describe that broadened scope; and tests/workflows/test_template_drift_workflow.py rejects a return to agents-*.yml filtering.

Focused exact-head validation: 3 passed for the Health 74 workflow and pair-discovery tests; the drift checker reports 5 in sync / 20 allowlisted / 0 unallowlisted; git diff --check passes. CodeRabbit and Gate are green. No new commit was required in this closer pass because the current head already contains the review fix.

[github-actions]

Provider Comparison Report

Provider Summary

Provider	Model	Verdict	Confidence	Summary
openai	gpt-5.6-terra	PASS	90%	The implementation addresses the discovery gap by widening workflow-pair discovery from agents-*.yml to *.yml while retaining the counterpart handling logic. It adds the required coverage test...
anthropic	claude-sonnet-5	PASS	68%	The PR implements the narrowly-scoped fix described in the issue: widening the workflow-pair discovery glob from 'agents-.yml' to '.yml' in scripts/check_template_drift.py, accompanied by allowli...

📋 Full Provider Details (click to expand)

openai

• Model: gpt-5.6-terra
• Verdict: PASS
• Confidence: 90%
• Scores:
  • Correctness: 10.0/10
  • Completeness: 9.0/10
  • Quality: 9.0/10
  • Testing: 9.0/10
  • Risks: 10.0/10
• Summary: The implementation addresses the discovery gap by widening workflow-pair discovery from agents-*.yml to *.yml while retaining the counterpart handling logic. It adds the required coverage test for every shared workflow basename, updates the drift allowlist to account for the newly discovered intentional divergences, and updates workflow/documentation expectations from 16 to 20 reported drift pairs. The allowlist cleanup also appears to satisfy the requirement to remove the generic Existing reviewed baseline drift rationale. The change is small, readable, and low-risk: discovery remains constrained to workflow YAML files and uses the existing validation/normalization path. Added tests specifically protect against regression to the narrow glob, with related workflow tests updated for the expanded drift count.

anthropic

• Model: claude-sonnet-5
• Verdict: PASS
• Confidence: 68%
• Scores:
  • Correctness: 8.0/10
  • Completeness: 8.0/10
  • Quality: 7.0/10
  • Testing: 7.0/10
  • Risks: 3.0/10
• Summary: The PR implements the narrowly-scoped fix described in the issue: widening the workflow-pair discovery glob from 'agents-.yml' to '.yml' in scripts/check_template_drift.py, accompanied by allowlist additions (net +15 lines) presumably covering the four newly-surfaced divergent pairs (autofix.yml, maint-coverage-guard.yml, pr-00-gate.yml, reusable-pr-context.yml), a new coverage test file, minor workflow/doc updates, and a small addition to the existing workflow test. CI workflows relevant to this change (ci-smoke, selftest-ci) report success, and the gate workflow is in-progress but that is expected/ignorable post-merge. The change set size and shape align well with the acceptance criteria (single-line glob change, allowlist growth for exactly the four flagged files, new named test). Without full diff content for the allowlist and test files, some precision checks (exact pair count, absence of generic rationale text, exact test assertions) cannot be independently confirmed, but nothing in the available diff contradicts the stated requirements, and the implementation matches the described narrow, well-specified fix.
• Concerns:
  • Full diff content for config/template-drift-allowlist.txt and the new test file was not available for line-by-line review; verification relies on aggregate diff stats (+35/-20 for allowlist, +23 new test) which are consistent with but not conclusive proof of the required 4 new fingerprint entries and the exact test body specified in the issue.
  • The core fix is a single-line glob change (agents-*.yml -> *.yml); correctness of downstream effects (20 pairs reported, exit code 0) depends entirely on the allowlist additions being accurate and well-formed, which cannot be fully confirmed from the diff summary alone.
  • Docs updates are minimal (+1/-1 in two files), which is plausible for updating a pair count reference but should be spot-checked to ensure they reflect the new '20 pairs' figure rather than stale numbers.
  • No visibility into whether the added allowlist entries contain the required 'written divergence rationale' language rather than reused generic boilerplate (the acceptance criteria explicitly checks that the old generic phrase count is zero).

Agreement

• Verdict: PASS (all providers)
• Completeness: scores within 1 point (avg 8.5/10, range 8.0-9.0)

Disagreement

Dimension	openai	anthropic
Correctness	10.0/10	8.0/10
Quality	9.0/10	7.0/10
Testing	9.0/10	7.0/10
Risks	10.0/10	3.0/10

Unique Insights

• openai: The implementation addresses the discovery gap by widening workflow-pair discovery from agents-*.yml to *.yml while retaining the counterpart handling logic. It adds the required coverage test for every shared workflow basename, updates the drift allowlist to account for the newly discovered...
• anthropic: Full diff content for config/template-drift-allowlist.txt and the new test file was not available for line-by-line review; verification relies on aggregate diff stats (+35/-20 for allowlist, +23 new test) which are consistent with but not conclusive proof of the required 4 new fingerprint entries and the exact test body specified in the issue.; The core fix is a single-line glob change (agents-*.yml -> *.yml); correctness of downstream effects (20 pairs reported, exit code 0) depends entirely on the allowlist additions being accurate and well-formed, which cannot be fully confirmed from the diff summary alone.; Docs updates are minimal (+1/-1 in two files), which is plausible for updating a pair count reference but should be spot-checked to ensure they reflect the new '20 pairs' figure rather than stale numbers.; No visibility into whether the added allowlist entries contain the required 'written divergence rationale' language rather than reused generic boilerplate (the acceptance criteria explicitly checks that the old generic phrase count is zero).

🔍 LangSmith Traces

• openai
• anthropic

[stranske-keepalive]

✅ Progress Review (Round 4)

Recommendation: CONTINUE
Alignment Score: 10.0/10

Feedback

Work appears aligned. Continue toward task completion.

---

This review was triggered because the agent has been working for 4 rounds without completing any task checkboxes.
The review evaluates whether recent work is advancing toward the acceptance criteria.