Skip to content

Compliance: stub-surface-drift-pr-auto-review.yml-on #506

Closed

Description

@don-petry

Compliance Finding

Category: ci-workflows
Severity: error
Check: stub-surface-drift-pr-auto-review.yml-on

Detail

The pr-auto-review.yml caller stub's on: surface has drifted from the canonical standards/workflows/pr-auto-review.yml. These stubs are thin callers — the on: triggers, permissions: grants, and concurrency: block are owned centrally and are not repo-adjustable (only the documented with: inputs and the tier channel pin may differ per repo). Re-sync on: from standards/workflows/pr-auto-review.yml.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml


This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry commented on Jul 31, 2026

    @don-petry
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #506 — Compliance: stub-surface-drift-pr-auto-review.yml-on

    Scope

    Re-sync the centrally-owned on: surface of the pr-auto-review.yml caller stub so it is byte-identical to the canonical standards/workflows/pr-auto-review.yml.

    Root Cause

    A byte-level diff against the canonical template shows the only difference inside the on: block is the YAML scalar quote style on the workflow_run.workflows list:

    • Local: workflows: ['CI'] (single quotes)
    • Canonical: workflows: ["CI"] (double quotes)

    'CI' and "CI" are the same YAML scalar, so the central stub-drift guard is doing a text/byte comparison — the quote style is the drift. (The workflow_run name value stays CI to match canonical; the issue states the on: triggers are owned centrally and are not repo-adjustable.)

    Implementation Checklist

    • .github/workflows/pr-auto-review.yml — change line 33 workflows: ['CI'] → workflows: ["CI"], making the on: block byte-identical to canonical

    Tests to Write

    • None — this is a behavior-preserving config/CI re-sync with no jest-testable logic. Per the Phase 2 documentation/config exception, no unit test applies. Validation is: (a) on: block byte-identical to canonical, and (b) prettier --check still passes (verified prettier preserves the double-quoted ["CI"]).

    Verification Command

    bash .dev-lead/scripts/dev-lead-lint.sh && npm run check && npm test

  2. don-petry commented on Jul 31, 2026

    @don-petry
    CollaboratorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Diffed the local pr-auto-review.yml stub against canonical standards/workflows/pr-auto-review.yml — isolated the on:-surface drift to the workflow_run.workflows scalar quote style
    • Re-synced the on: surface: workflows: ['CI'] → workflows: ["CI"] (now byte-identical to canonical across the whole on: block)
    • Added .github/workflows/pr-auto-review.yml to .prettierignore so the repo-pinned Prettier (3.8.3, singleQuote: true) cannot revert the double quotes and re-introduce the drift — mirroring the existing entries for dev-lead.yml, initiative-driver.yml, and feature-ideation.yml
    • Verified on: block byte-identical to canonical, ran lint + full test suite

    Root Cause

    The stub's on: surface is enforced byte-identical against the canonical by the central stub-drift guard. Canonical ships workflows: ["CI"] (double quotes); the repo's Prettier config (singleQuote: true, v3.8.3) had rewritten it to 'CI', and the file was not in .prettierignore (unlike the three sibling standards-owned stubs). That reformatting was the drift. Fixing the quotes alone is not durable — the mandated pre-commit prettier --write . would undo it — so the file also had to be Prettier-ignored.

    Test Results

    > jest --runInBand
    
    
    Test Suites: 14 passed, 14 total
    Tests:       344 passed, 344 total
    Snapshots:   0 total
    Time:        1.18 s, estimated 4 s
    Ran all test suites.
    
    • bash .dev-lead/scripts/dev-lead-lint.sh → all checks passed
    • npm run check (prettier --check + eslint) → exit 0 (22 pre-existing eslint warnings in unrelated src/ test files, 0 errors)
    • npm test → 14 suites / 344 tests passed

    Files Changed

    • .github/workflows/pr-auto-review.yml: re-synced on: surface — workflows: ['CI'] → workflows: ["CI"], making the on: block byte-identical to canonical
    • .prettierignore: added .github/workflows/pr-auto-review.yml (with rationale comment) so Prettier can't re-introduce the quote-style drift

    Notes

    • TDD exception (Phase 2): this is a behavior-preserving CI/config re-sync with no jest-testable logic; 'CI' and "CI" are the same YAML scalar. Validation is byte-identity of the on: block vs canonical plus prettier --check passing.
    • Scope: limited to the on: surface per the -on check. The # NOSONAR comment-gap on the uses: line (in jobs:, not on:) was intentionally left unchanged as out of scope.
    • No git operations performed — leaving commit/push/PR to the CI workflow.
  3. added a commit that references this issue on Aug 2, 2026
  4. added 3 commits that reference this issue on Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions