Repository navigation
ci: keep generated HQ snapshot and ACTIVITY.md off branches - #370
Conversation
GitHub/Mergify merge without our local merge driver, so every PR that committed docs/dev-hq/data.js|json or .pa/ACTIVITY.md re-conflicted with all others. Only main and hq-snapshot branches may change them now. - gate hotspot-guard rejects a branch diff (vs merge-base) touching them - sync.sh note writes to untracked .pa/ACTIVITY.local.md on a branch - post-merge regenerates the snapshot on main only - session-end-hook debounces on the file sync.sh really writes Test-First: scripts/test-hotspot-guard.sh::guard rejects package branch touching docs/dev-hq/data.js Test-First: scripts/test-hotspot-guard.sh::guard rejects package branch touching docs/dev-hq/data.json Test-First: scripts/test-hotspot-guard.sh::guard rejects package branch touching .pa/ACTIVITY.md Test-First: scripts/test-hotspot-guard.sh::guard accepts branch touching other files only Test-First: scripts/test-hotspot-guard.sh::guard accepts main touching the hotspot files Test-First: scripts/test-hotspot-guard.sh::guard accepts a dedicated hq-snapshot branch Test-First: scripts/test-hotspot-guard.sh::guard fails closed without a base Test-First: scripts/test-hotspot-guard.sh::sync note on a package branch leaves the tracked ACTIVITY.md alone Test-First: scripts/lib/hq-post-merge.test.mjs::post-merge leaves the snapshot alone on a non-main branch Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c10cdf6e10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| hs_may_touch() { # branch | ||
| case "$1" in | ||
| main | master | gh-readonly-queue/* | hq-snapshot* | */hq-snapshot*) return 0 ;; |
There was a problem hiding this comment.
Sobald ein erlaubter <vendor>/hq-snapshot-*-PR in die verpflichtende Mergify-Queue gelangt, lautet GITHUB_HEAD_REF laut .github/workflows/ci.yml:98-100 stattdessen mergify/merge-queue/*. Dieses Muster fehlt hier, sodass hotspot-guard den Snapshot im Queue-Diff findet und die Linux-Bahn ablehnt; der dokumentierte Weg zum Aktualisieren des Snapshots kann damit nicht gemergt werden. Die Allowlist muss den tatsächlich verwendeten Mergify-Namensraum berücksichtigen oder die ursprüngliche PR-Branch-Identität separat auswerten.
AGENTS.md reference: AGENTS.md:L148-L154
Useful? React with 👍 / 👎.
|
|
||
| hs_may_touch() { # branch | ||
| case "$1" in | ||
| main | master | gh-readonly-queue/* | hq-snapshot* | */hq-snapshot*) return 0 ;; |
There was a problem hiding this comment.
master aus der Hotspot-Ausnahme
Bei einem PR mit dem Quellbranch master gibt hs_may_touch sofort Erfolg zurück, sodass das Gate Änderungen an allen drei Hotspot-Dateien ungeprüft akzeptiert. Dieses Repository verwendet main, und die neue Regel erlaubt außer dedizierten Snapshot-Branches ausdrücklich keinen anderen Branch; ein Branch namens master kann die Konfliktvermeidung daher vollständig umgehen.
AGENTS.md reference: AGENTS.md:L148-L154
Useful? React with 👍 / 👎.
| if [ -f "$TRACKED" ]; then | ||
| echo "== .pa/ACTIVITY.md (letzte Einträge) ==" | ||
| tail -n 40 "$ACTIVITY" | ||
| tail -n 40 "$TRACKED" |
There was a problem hiding this comment.
Auf jedem normalen Arbeitsbranch schreibt sync.sh note den Handover nun nach .pa/ACTIVITY.local.md, aber sync.sh start liest hier weiterhin ausschließlich $TRACKED. Damit sieht die nächste Sitzung beim vorgeschriebenen Start-Check nur das globale Journal und nicht die gerade für diesen Arbeitsbaum hinterlassene Zusammenfassung; die neue lokale Notiz hat im Repository keinen anderen Leser. Gib beim Start zusätzlich den Tail von $ACTIVITY aus, wenn dieser von $TRACKED abweicht.
AGENTS.md reference: AGENTS.md:L294-L297
Useful? React with 👍 / 👎.
| ACTIVITY="$TRACKED" | ||
| branch="$(hs_branch "$ROOT")" | ||
| hs_may_touch "$branch" || ACTIVITY="$ROOT/.pa/ACTIVITY.local.md" |
There was a problem hiding this comment.
Auf einem <vendor>/hq-snapshot-*-Branch liefert hs_may_touch Erfolg, weshalb diese Zuweisung .pa/ACTIVITY.md als Ziel behält; zugleich beendet hotspot-guard für denselben Branch seine Prüfung vorzeitig. Ein vorgeschriebener sync.sh note verändert dadurch das getrackte Journal, obwohl der dedizierte Snapshot-PR laut Regel nur die beiden docs/dev-hq/data.*-Dateien enthalten soll. Die Snapshot-Ausnahme muss für das Journal getrennt von der Berechtigung zur Snapshot-Regeneration behandelt werden.
AGENTS.md reference: AGENTS.md:L148-L154
Useful? React with 👍 / 👎.
The sync note cases inherited GITHUB_HEAD_REF in CI, so the main case saw the PR branch. No-Test: fixes the self-test itself; verified with GITHUB_ACTIONS and GITHUB_HEAD_REF set Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The hook reads GITHUB_HEAD_REF first, so in CI the fixture repos were judged as the PR branch and the hook skipped regeneration. No-Test: fixes the test harness itself; red with GITHUB_ACTIONS=true GITHUB_HEAD_REF=claude/x (5 failed), green with and without (7 passed) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Queued — the merge queue status continues in this comment ↓. |
Test-First: scripts/test-hotspot-guard.sh::guard accepts a Mergify merge queue branch
Test-First: scripts/test-hotspot-guard.sh::guard accepts a Mergify merge queue branch
|
@Mergifyio queue |
Merge Queue Status
This pull request spent 14 minutes 38 seconds in the queue, including 14 minutes 16 seconds running CI. Required conditions to merge
|
Branches dürfen den HQ-Snapshot (
docs/dev-hq/data.js|json) und.pa/ACTIVITY.mdnicht mehr committen, weil genau diese drei Dateien fast alle Merge-Konflikte verursacht haben. Ein neues Gate (hotspot-guard) lehnt solche Änderungen ab und sagt, wie man sie entfernt. Journal-Notizen auf Branches landen in einer ungetrackten Datei, und den Snapshot aktualisiert nur noch der Koordinator aufmainbzw. in einem eigenenhq-snapshot-PR.Report
What changed (9 files, +223/-9)
scripts/sync.shnote (appends.pa/ACTIVITY.md),scripts/session-end-hook.sh(calls it; debounce on the file),.githooks/post-merge(regeneratesdocs/dev-hq/data.*in the worktree after every merge),scripts/dev-hq.mjs(the generator, run bynpm run hqand byscripts/hq-live.mjsat startup),scripts/dev/report-commit.mjs(only restores the snapshot, does not write it). Readers: HQ tests (scripts/lib/hq-*.test.mjs) readdata.json; they need it present, not fresh..pa/ACTIVITY.mdis read byhq-live.mjsinsights.scripts/lib/hotspots.sh: shared rule. Onlymain/master, GitHub or Mergify queue branches, andhq-snapshot*/*/hq-snapshot*branches may carry changes to the files.scripts/ci/hotspot-guard.sh+ gatehotspot-guard(prepush, branchpush, linux): fails if the diff vs merge-base touches a hotspot file; fails closed without a base; message names the files and thegit checkout <base> -- ...fix.sync.sh noteon a branch writes.pa/ACTIVITY.local.md(ignored by.gitignore) and prints where; newsync.sh where; session-end hook debounces on that file..githooks/post-mergeskips regeneration off main.Decision note: the task text named the package-branch regex, but most conflicting PRs (
codex/state-7-…,codex/ci-…) do not match it. The rule is therefore an allow-list (main + hq-snapshot branches), not a deny-list of package branches. Open PRs that currently carry these files will go red until they drop them (message tells how).Evidence
bash scripts/test-hotspot-guard.shexit 0 (10okcases at f5ce8aa; Mergify queue case red before the review fix)node --test scripts/lib/hq-post-merge.test.mjsexit 0 (7 pass)bash scripts/test-gates.sh,test-ci-shape.sh,test-script-modes.shexit 0bash scripts/ci/red-first.sh --planexit 0 at f5ce8aa (count=11)CARGO_TARGET_DIR=<assigned-slot> CARGO_BUILD_JOBS=1 bash scripts/ci/gates.sh lane prepushexit 0 at f5ce8aa (1764 Rust tests passed; 7 platform-gated tests skipped)gh pr checks 370 --watch --interval 10exit 0 at f5ce8aa (gates (linux),gates (windows),red-first, CodeQL and GitGuardian green; expected reporting jobs skipped)NICHT ABGEDECKT
#[cfg(windows)], Git-Bash behaviour of the new scripts); runs in the merge queue.hq-live.mjsstartup regeneration on a branch is not changed; the guard catches it at commit/push time. A full red-first run against the merge base was not executed locally (plan only).hq-snapshotrefresh PR is a follow-up for the coordinator.Architecture drift: no unapproved finding. The review fix adopts the repository's existing
mergify/merge-queue/*branch convention from the CI workflow and lane planner.Review: completed, tier B; no high finding remains open.
Review disposition
a3bc472; post-fix candidate rechecked:f5ce8aa.scripts/lib/hotspots.sh:29: the allowlist recognizedgh-readonly-queue/*but omitted this repository's establishedmergify/merge-queue/*branch form. A queue batch carrying an allowed snapshot refresh would therefore failhotspot-guard. Accepted: red test commit4b626f3, fix commitf5ce8aa;scripts/test-hotspot-guard.sh:64now proves the real queue form..github/workflows/ci.ymlandscripts/ci/lane-plan.sh; the failing regression test reproduced the rejection ata3bc472. No other finding survived countercheck, and no second architecture pattern was introduced.🤖 Generated with Claude Code
CI-Fix (5491ddd):
selftest-hotspot-guardfailed in CI becauseGITHUB_HEAD_REFleaked into thesync note on maincase (reproduced locally withGITHUB_ACTIONS=true GITHUB_HEAD_REF=claude/ci-conflict-hotspots); the test now unsets both.bash scripts/ci/red-first.shexit 0,bash scripts/ci/gates.sh lane prepushexit 0 at 5491ddd.scripts/lib/hq-post-merge.test.mjserbte in CIGITHUB_HEAD_REF(Hook hielt die Fixture fuer den PR-Branch, 5 Tests rot). Rot lokal mitGITHUB_ACTIONS=true GITHUB_HEAD_REF=claude/x node --test scripts/lib/hq-post-merge.test.mjs(Exit 1, 5 failed), danach 7/7 gruen mit und ohne Variablen;gates.sh lane prepushExit 0.