Compliance: non-stub-auto-rebase.yml #795

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Jun 19, 2026
2. don-petry commented on Jun 19, 2026

   

   don-petry

   on Jun 19, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead: Finding is a false positive — @v2 pin is intentional

   After investigating, I determined the literal remediation (downgrade auto-rebase.yml to the canonical @v1 stub) must not be applied — it is a behavioral regression for this repo. I documented the intentional divergence instead.

   Why @v1 is wrong here

   I diffed auto-rebase-reusable.yml@v1 vs @v2 in petry-projects/.github:

   • @v1: on merge conflict, posts a static "resolve manually" comment. github.token only.
   • @v2: posts a base-SHA-keyed conflict sentinel that triggers dev-lead's agentic rebase (the rebase intent in dev-lead.yml), accepts the optional GH_PAT_WORKFLOWS secret, and does smart delete/re-post to avoid cancelling in-flight rebase runs.

   This repo has infrastructure built directly on the @v2 behavior, already documented in AGENTS.md:

   • auto-rebase-retry.yml — "self-heals a failed Auto-rebase run … the gap left by the conflict-only sentinel path"
   • auto-rebase-health.yml — "quantifies the agentic-conflict-resolution rate (conflict-sentinel fires vs. dev-lead rebase responses)"

   The @v2 pin is also locked by the regression guard tests/dev-lead/integration/test_auto_rebase_stub.py, added for issue #139. Downgrading to @v1 would (a) break the dev-lead agentic-rebase trigger, (b) invalidate auto-rebase-health.yml's core metric, and (c) fail the #139 test.

   Root cause of the finding

   The org canonical stub standards/workflows/auto-rebase.yml still pins @v1; this repo (home of dev-lead itself) intentionally runs the newer @v2. The divergence was real but undocumented as an AGENTS.md exception, so the auto-generated audit flagged it.

   What I changed

   • AGENTS.md: added an **Exception:** entry under "Workflow Files" documenting that auto-rebase.yml deliberately pins @v2 ahead of the canonical @v1, why (agentic-rebase infra + Compliance: non-stub-auto-rebase.yml #139 test), and that it should defer to the template once the org stub is bumped to @v2.

   No workflow change, no test change.

   Verification

   $ bash .dev-lead/scripts/dev-lead-lint.sh
     [lint] shellcheck on 67 file(s)...
     [lint] validating 4 agent profile(s)...
     [lint] all checks passed
   
   $ python3 tests/dev-lead/integration/test_auto_rebase_stub.py
   PASS: .github/workflows/auto-rebase.yml correctly references ...auto-rebase-reusable.yml@v2
   
   $ python3 tests/dev-lead/integration/test_caller_permissions.py
   PASS: caller template grants >= every permission the reusable jobs request.
   

   Recommended follow-up (org side)

   Bump the canonical stub in petry-projects/.github standards/workflows/auto-rebase.yml to @v2. Once done, this repo's exception should be removed and the stub re-synced verbatim. Until then, this finding should be suppressed/acknowledged for this repo.

   Phase 2 note

   TDD phase skipped — this is a documentation-only change with no observable behavioral change (the existing #139 test already enforces the @v2 invariant and continues to pass).
3. don-petry

   closed this as completedin #804on Jun 19, 2026
4. don-petry

   added a commit that references this issue on Jun 19, 2026

   feat: implement issue #795 — Compliance: non-stub-auto-rebase.yml (#804)

   ...

   0fb2ea6