Repository navigation
Standards sweep reports a drifted initiative-driver.yml as compliant — the template gained a uses: step, so the stub is no longer compared verbatim (repo-template still on ref: v1) #1277
Description
Problem
scripts/deploy-standard-workflows.sh reports a drifted initiative-driver.yml stub as already compliant, so the sweep never re-syncs it.
is_pin_compliant decides how to compare a stub from the template's first uses: line:
- no
uses:line → "verbatim-managed", full-content comparison (the comment namesinitiative-driveras the example); - otherwise → ring-pin check if it is a ring reusable, else
grep -qF "$expected_uses"on the existing stub.
The initiative-driver.yml template gained a step uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 (the rate-limit gate tooling checkout). Since then the template has a uses: line, so the stub is no longer compared verbatim. Any stub that contains that one checkout line passes, whatever else differs.
Evidence (2026-10-10, template blob 1c7c765b)
Standards Deploy runs 38043597933 and 38043075189 logged:
[deploy] SKIP repo-template/.github/workflows/initiative-driver.yml already compliant
[deploy] SKIP empower-personal-dashboard/.github/workflows/initiative-driver.yml already compliant
Neither file matches the template:
| Repo | Difference from the template (non-comment lines) |
|---|---|
repo-template |
Gate tooling checkout is ref: v1, not the commit SHA that #1232 introduced. The gate step still ends in || true and lacks the missing-script check, so a gate failure is silent. |
bmad-bgreat-suite |
Same ref: v1 pin. |
empower-personal-dashboard |
Passes github.repository to the dispatch step through an env var (TARGET_REPO) instead of inline ${{ }} expansion in the shell text. This is a hardening the template does not have. |
repo-template matters most: new repos are created from it, so they start on the stub #1232 replaced.
Stubs with no checkout step at all (markets, google-app-scripts, ContentTwin, TalkTerm) are correctly seen as drift, because the grep for the checkout line fails.
Fix direction
- Decide "verbatim-managed" by something other than "the template has no
uses:line". For example: the firstuses:that references a*-reusable.ymlworkflow, or an explicit list of verbatim-managed templates. A template whose onlyuses:lines are action steps is compared in full. - Before the corrected sweep runs, move the
TARGET_REPOenv hardening fromempower-personal-dashboardintostandards/workflows/initiative-driver.yml, or the sweep will revert it there.
The compliance audit shares helpers with the sweep; check that scripts/compliance-audit.sh does not have the same blind spot.
Acceptance criteria
- A stub that differs from a verbatim-managed template in any non-CRLF way is reported as drift, even when the template contains
uses:action steps. Covered by a test using the currentinitiative-driver.ymltemplate and theref: v1variant. - A byte-identical stub is still reported compliant, and ring-managed stubs (
dev-lead.ymland the others) keep their ring-pin rule. - The template carries the
TARGET_REPOenv form for the dispatch step. - The audit and the sweep agree on the same inputs.
Activity
don-petry commentedon Oct 10, 2026
Dev-Lead Implementation Plan
Issue: #1277 — Standards sweep reports a drifted initiative-driver.yml as compliant
Scope
Decide "verbatim-managed" by the absence of a
*-reusable.ymluses:line (not of anyuses:line), share that decision between the deploy sweep and the compliance audit, and move theTARGET_REPOenv hardening into the initiative-driver template.Implementation Checklist
scripts/lib/stub-verbatim.sh:stub_reusable_uses <template>(firstuses:naming a-reusable.yml),stub_is_verbatim_managed <template>,stub_verbatim_matches <content> <template>(CRLF-normalized full compare)scripts/deploy-standard-workflows.sh: source the lib;is_pin_compliantandreusable_uses_ofusestub_reusable_uses, so action-stepuses:lines no longer select the pin rulescripts/compliance-audit.sh: source the lib; newcheck_verbatim_stubsflags a deployed verbatim-managed stub (initiative-driver.yml) that does not match its template (exempt.github/.github-private, which self-manage it)standards/workflows/initiative-driver.yml(+ the self-hosted identical.github/workflows/initiative-driver.yml): dispatch step passesTARGET_REPOvia envTests to Write
test/scripts/deploy-standard-workflows/verbatim-managed-stub.bats: current template → compliant;ref: v1variant → drift; CRLF variant → compliant; ring stub (dev-lead) still uses the ring-pin ruleref: v1, CRLF)TARGET_REPOenv, no inline${{ }}in the run textTest Command
npx bats -r test testsdon-petry commentedon Oct 10, 2026
Dev-Lead: Implementation Complete — PR #1278
The implementation for issue #1277 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.
uses:step, so the stub is no longer compared verbatim (repo-template still onref: v1) #1278ba52d9733276db47698223e393ec3742e5af7984main: 7 file(s), +296/-14 linesReview happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.
feat: implement issue #1277 — Standards sweep reports a drifted initi…