You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Standards sweep compares only the pin for ring-managed stubs — a stub whose body differs from the template is reported compliant while template-drift fails on it (dependabot-rebase.yml) #1285
For a ring-managed stub (one that calls a *-reusable.yml on a channel tag), scripts/deploy-standard-workflows.sh decides compliance from the pin alone. is_already_compliant says so on purpose: "Kept targeted (pin + marker presence), NOT a byte-compare, to avoid churn on cosmetic diffs."
The result is that the body of such a stub can differ from the template indefinitely, and the sweep reports it as already compliant. Two other checks do compare the whole file, so the three disagree:
template_stub_drift.sh in petry-projects/.github-private byte-compares petry-projects/repo-template against the standards channel and fails the Lint / template-drift job on any difference.
So repo-template can be marked drifted by one check while the tool that is supposed to keep it in sync says there is nothing to do.
Evidence (2026-10-10)
standards/workflows/dependabot-rebase.yml changed on 2026-09-30 (#1075 / PR #1098): two comment lines and a trailing newline.
Standards Deploy run 38043597933 logged SKIP repo-template/.github/workflows/dependabot-rebase.yml already compliant.
repo-template's copy is blob 10b53434; the template at standards/v1.2.0 (564cd157) is blob 24175bf6. template_stub_drift.sh reports it DRIFTED.
Four other repos sampled the same day also carry a body that differs from the template for this file: broodly, TalkTerm, markets, incubator.
The repo-template copy was aligned on 2026-10-10 by merging its seed PR (combsmith/repo-template#228, open since 2026-10-04). The others were left.
Why it is not a one-line change
Comparing every ring-managed stub in full would open a sync PR in most repos for comment-only differences, which is the churn the current rule avoids. Some stubs also carry documented per-repo edits (BODY_PRESERVING_WORKFLOWS, for example feature-ideation.yml's project_context) that must never be overwritten.
Options
Full-body compare for repo-template only. It is the one repo another check byte-compares, and new repos are created from it. Smallest blast radius.
Full-body compare for all ring-managed stubs except BODY_PRESERVING_WORKFLOWS, reusing stub_body_matches_template. One wave of sync PRs, then quiet.
Leave the sweep alone and make template_stub_drift.sh ignore comment-only differences. Removes the disagreement without touching the fleet, but leaves stale comments in stubs.
Decision (maintainer, 2026-10-10)
Implement option 1: full-body comparison for petry-projects/repo-template only. Every other repo keeps the pin-only rule, so this opens no fleet-wide wave of sync PRs. Reuse stub_body_matches_template so the comparison is against the template rendered at the repo's tier channel. Do not implement options 2 or 3.
Acceptance criteria
The sweep and template_stub_drift.sh cannot disagree about repo-template: a stub one reports as drifted, the other does not report as compliant.
A stub listed in BODY_PRESERVING_WORKFLOWS is never overwritten because of a body difference.
A repo keeps its ring tier pin when its stub body is re-synced.
Covered by tests next to test/scripts/deploy-standard-workflows/; every existing test passes unmodified.
Issue:#1285 — Standards sweep compares only the pin for ring-managed stubs (repo-template full-body compare, option 1)
Scope
Make is_already_compliant in scripts/deploy-standard-workflows.sh also require stub_body_matches_template (the template rendered at the repo's tier channel) when the target repo is repo-template, except for BODY_PRESERVING_WORKFLOWS. Every other repo keeps the pin-only rule.
Implementation Checklist
scripts/deploy-standard-workflows.sh: add a FULL_BODY_COMPARE_REPOS=(repo-template) list + is_full_body_compare_repo helper (basename match, like is_engine_host_target)
is_already_compliant: for such a repo and a non-body-preserving workflow, require stub_body_matches_template; update the header comment
No change to the deploy path: a drifted repo-template stub already takes the verbatim path re-pinned via emit_ref_for, so the tier pin is kept
Tests to Write
New test/scripts/deploy-standard-workflows/repo-template-full-body.bats:
repo-template: right pin + a stale comment body (dependabot-rebase.yml) → drift, sync PR planned
repo-template: the template verbatim → already compliant (no churn)
another repo with the same stale body → still already compliant (pin-only rule kept)
repo-template feature-ideation.yml with a tuned project_context → not overwritten (compliant, or re-pinned in place with the body kept)
repo-template on a non-stable tier (test registry via CANARY_RINGS) → re-synced body keeps the tier pin; second run is a no-op
Dev-Lead: Progress (in progress — not yet durable)
Provisional. Nothing is pushed yet; the automation posts the authoritative
completion record (with PR number + head SHA) after the push. Treat the notes
below as intent, not delivered results.
Plan Execution (intended)
Option 1 only: is_already_compliant also requires stub_body_matches_template when the repo is in a new FULL_BODY_COMPARE_REPOS=(repo-template) list, skipping BODY_PRESERVING_WORKFLOWS. Other repos keep the pin-only rule.
The deploy path is unchanged: a drifted repo-template stub is overwritten from the template and re-pinned to the channel emit_ref_for computes, so its tier pin stays.
Files touched (this workspace, not yet pushed)
scripts/deploy-standard-workflows.sh: FULL_BODY_COMPARE_REPOS + is_full_body_compare_repo; extended the body-compare condition in is_already_compliant.
test/scripts/deploy-standard-workflows/repo-template-full-body.bats (new): stale body on repo-template is drift and gets re-synced; template verbatim is compliant; second run is a no-op; ring1 tier pin is kept on re-sync; broodly/markets/incubator stay pin-only; a tuned feature-ideation.yml is never overwritten. Existing test files are unchanged.
Notes
Trailing-newline-only differences are still invisible.fetch_existing decodes through command substitution, which drops trailing newlines, and stub_body_matches_template is trailing-newline-insensitive by design. A repo-template stub that differs from the template only in trailing newlines would still read as compliant to the sweep, while template_stub_drift.sh (byte compare) flags it. Once any other byte differs, the re-sync writes the template byte-for-byte, so this only affects newline-only drift. Closing it would mean changing fetch_existing, which is outside this issue's scope.
feature-ideation.yml on repo-template is exempt as required (BODY_PRESERVING_WORKFLOWS). If template_stub_drift.sh byte-compares that file too, the two checks can still disagree about it; that would have to be fixed on the .github-private side.
The implementation for issue #1285 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.
Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.
Activity
don-petry commentedon Oct 10, 2026
Dev-Lead Implementation Plan
Issue: #1285 — Standards sweep compares only the pin for ring-managed stubs (repo-template full-body compare, option 1)
Scope
Make
is_already_compliantinscripts/deploy-standard-workflows.shalso requirestub_body_matches_template(the template rendered at the repo's tier channel) when the target repo isrepo-template, except forBODY_PRESERVING_WORKFLOWS. Every other repo keeps the pin-only rule.Implementation Checklist
scripts/deploy-standard-workflows.sh: add aFULL_BODY_COMPARE_REPOS=(repo-template)list +is_full_body_compare_repohelper (basename match, likeis_engine_host_target)is_already_compliant: for such a repo and a non-body-preserving workflow, requirestub_body_matches_template; update the header commentemit_ref_for, so the tier pin is keptTests to Write
New
test/scripts/deploy-standard-workflows/repo-template-full-body.bats:already compliant(pin-only rule kept)project_context→ not overwritten (compliant, or re-pinned in place with the body kept)CANARY_RINGS) → re-synced body keeps the tier pin; second run is a no-opTest Command
bats test/scripts/deploy-standard-workflows/(plusbash .dev-lead/scripts/dev-lead-lint.sh)don-petry commentedon Oct 10, 2026
Dev-Lead: Progress (in progress — not yet durable)
Plan Execution (intended)
is_already_compliantalso requiresstub_body_matches_templatewhen the repo is in a newFULL_BODY_COMPARE_REPOS=(repo-template)list, skippingBODY_PRESERVING_WORKFLOWS. Other repos keep the pin-only rule.emit_ref_forcomputes, so its tier pin stays.Files touched (this workspace, not yet pushed)
scripts/deploy-standard-workflows.sh:FULL_BODY_COMPARE_REPOS+is_full_body_compare_repo; extended the body-compare condition inis_already_compliant.test/scripts/deploy-standard-workflows/repo-template-full-body.bats(new): stale body on repo-template is drift and gets re-synced; template verbatim is compliant; second run is a no-op; ring1 tier pin is kept on re-sync; broodly/markets/incubator stay pin-only; a tuned feature-ideation.yml is never overwritten. Existing test files are unchanged.Notes
fetch_existingdecodes through command substitution, which drops trailing newlines, andstub_body_matches_templateis trailing-newline-insensitive by design. A repo-template stub that differs from the template only in trailing newlines would still read as compliant to the sweep, whiletemplate_stub_drift.sh(byte compare) flags it. Once any other byte differs, the re-sync writes the template byte-for-byte, so this only affects newline-only drift. Closing it would mean changingfetch_existing, which is outside this issue's scope.BODY_PRESERVING_WORKFLOWS). Iftemplate_stub_drift.shbyte-compares that file too, the two checks can still disagree about it; that would have to be fixed on the.github-privateside.don-petry commentedon Oct 10, 2026
Dev-Lead: Implementation Complete — PR #1290
The implementation for issue #1285 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.
2ae3322fbf11b2878649e857b63c1ce48cb2f862main: 2 file(s), +240/-3 linesReview happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.
feat: implement issue #1285 — Standards sweep compares only the pin f…