diff --git a/.github/workflows/do-not-merge.yml b/.github/workflows/do-not-merge.yml deleted file mode 100644 index 2f0ff0ea..00000000 --- a/.github/workflows/do-not-merge.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: do-not-merge - -# Standalone required check that blocks merge while the PR carries the -# `do-not-merge` label (the reusable's default). It runs on pull_request_target -# so the base-branch definition gates and a head-branch edit cannot neuter it; it -# reads PR label metadata only and checks out no head code. The emitted -# required-check context is `do-not-merge / do-not-merge`. Public repo: runs on -# the reusable's hosted default runner. -on: - # zizmor: ignore[dangerous-triggers] metadata-only gate; rationale in the header comment - pull_request_target: - types: [opened, reopened, synchronize, labeled, unlabeled] - merge_group: - -permissions: - pull-requests: read - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: true - -jobs: - do-not-merge: - permissions: - pull-requests: read - uses: melodic-software/ci-workflows/.github/workflows/do-not-merge-gate.yml@90f1c54935203fa31b5b3d1f41531228be2c2b7f # 90f1c54 2026-07-18 - with: - runner: ubuntu-24.04 diff --git a/.github/workflows/pr-issue-linkage.yml b/.github/workflows/pr-issue-linkage.yml deleted file mode 100644 index f0491913..00000000 --- a/.github/workflows/pr-issue-linkage.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: pr-issue-linkage - -# Standalone required check that validates the PR body carries a native closing -# keyword (or an explicit no-issue marker) and non-empty Summary, Fix, -# Verification, and Related sections. It runs on pull_request_target so the -# base-branch definition gates and a head-branch edit cannot bypass it; it reads -# body metadata from the event payload only and checks out no head code. The -# emitted required-check context is `pr-issue-linkage / pr-issue-linkage`. -# Public repo: runs on the reusable's hosted default runner. -on: - # zizmor: ignore[dangerous-triggers] metadata-only gate; rationale in the header comment - pull_request_target: - types: [opened, edited, reopened, synchronize] - merge_group: - -permissions: {} - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: true - -jobs: - pr-issue-linkage: - permissions: - pull-requests: read - actions: read - uses: melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml@7107b34832a7b6db5d08d3b132621c599fbe5e50 # v0.14.2 - with: - runner: ubuntu-24.04 - # Dependabot owns its generated body and cannot add this repository's - # closing-keyword or contract-section markers. Keep the exemption - # exact-login only. - exempt-authors: 'dependabot[bot]' diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml deleted file mode 100644 index 06b08afd..00000000 --- a/.github/workflows/pr-title.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: pr-title - -# Conventional Commits PR-title gate. Consumes the shared semantic-pr reusable -# workflow from ci-workflows. Repos are squash-only with the squash title set to -# PR_TITLE, so the PR title becomes the default-branch subject — this gates the -# Conventional-Commits history. `edited` re-validates on a re-title. The emitted -# required-check context is `pr-title / pr-title`. Public repo: runs on the -# reusable's hosted default runner. -on: - pull_request: - types: [opened, edited, reopened, synchronize] - -permissions: - pull-requests: read - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} - cancel-in-progress: true - -jobs: - pr-title: - permissions: - pull-requests: read - uses: melodic-software/ci-workflows/.github/workflows/semantic-pr.yml@90f1c54935203fa31b5b3d1f41531228be2c2b7f # 90f1c54 2026-07-18 - with: - runner: ubuntu-24.04 diff --git a/conventions/process/issue-tracker.md b/conventions/process/issue-tracker.md index 55f522b5..f7709650 100644 --- a/conventions/process/issue-tracker.md +++ b/conventions/process/issue-tracker.md @@ -25,7 +25,7 @@ Labels follow one grammar across every axis, so a reader parses any label withou The naming grammar above governs labels only. Issue titles are free text: there is no enforced prefix vocabulary, and titles do not carry a conventional-commit-style tag such as `[CC]` or `feat(scope):`. This is a deliberate choice, not a gap: GitHub's categorization mechanism is structured metadata (org Issue Types, labels, milestones), not title encoding. The type axis lives in native Issue Types (`Bug`, `Feature`, `Task`); the area axis lives in labels. A title prefix would duplicate an axis that already exists elsewhere and drift out of sync with it. Write a plain summary that describes the issue. -**Structured metadata, not title prefixes.** Set the type with `--type` or the issue form's Types field; set area and other axes with labels. PR titles are unchanged, remaining Conventional Commits enforced by the `pr-title` gate, because squash-merge makes the PR title the default-branch subject line. Issue titles and PR titles serve different layers and follow different rules. +**Structured metadata, not title prefixes.** Set the type with `--type` or the issue form's Types field; set area and other axes with labels. PR titles are unchanged, remaining Conventional Commits enforced by the `pr-contract` composite inside the required `ci-status` check, because squash-merge makes the PR title the default-branch subject line. Issue titles and PR titles serve different layers and follow different rules. **Template-default bracket prefixes are permitted cosmetics.** GitHub's own issue-form examples ship a `title: "[Bug]: "` default prefix. A bracket prefix a form inserts is display-only template text, not a metadata carrier. Do not encode type, area, or status in a title by hand. @@ -63,7 +63,7 @@ Reconcile recurring items by a dedicated bare marker label (for example `recurri ## Closing pull requests -A pull request that resolves an issue uses GitHub's native closing keywords, `Closes`, `Fixes`, or `Resolves` followed by the issue number, as the default house style. The keyword is what wires the automatic link and auto-close on merge; a plain-text reference like "see #123" does neither. Every pull request fleet-wide additionally carries `## Summary`, `## Fix`, `## Verification`, and `## Related` sections alongside the native keyword (or the literal `No linked issue` when nothing closes). The practice applies org- and account-wide, not only where a CI gate can check it. The machine-readable list lives in `components/pr-convention-policy/policy.json`. This began as `provisioning`'s stricter convention (decisions log #58/#59); the shared `pr-issue-linkage` gate mechanically enforces it on every requires-ci repository, and repositories without CI follow the same convention unenforced. +A pull request that resolves an issue uses GitHub's native closing keywords, `Closes`, `Fixes`, or `Resolves` followed by the issue number, as the default house style. The keyword is what wires the automatic link and auto-close on merge; a plain-text reference like "see #123" does neither. Every pull request fleet-wide additionally carries `## Summary`, `## Fix`, `## Verification`, and `## Related` sections alongside the native keyword (or the literal `No linked issue` when nothing closes). The practice applies org- and account-wide, not only where a CI gate can check it. The machine-readable list lives in `components/pr-convention-policy/policy.json`. This began as `provisioning`'s stricter convention (decisions log #58/#59); the shared `pr-contract` composite inside each requires-ci repository's `ci-status` check reports it, leaving an advisory comment and the `needs-issue-linkage` label rather than failing the check, and repositories without CI follow the same convention unreported. ## Optional conventions diff --git a/conventions/review/code-quality.md b/conventions/review/code-quality.md index d08ffa99..73484b4f 100644 --- a/conventions/review/code-quality.md +++ b/conventions/review/code-quality.md @@ -41,7 +41,7 @@ Review owns parameter shape: where a stack toolchain enforces an arity ceiling, - **Lint exclusions instead of fixes**: default to fixing. Never add a suppression to bypass a pre-existing error; a justified exclusion lives in the tool's config with a recorded reason, never inline as a silencer. - **Embedded cross-language scripts**: a multi-line script of one language inlined inside another (a shell heredoc of another language, say) belongs in its own co-located file. - **Self-executing importable modules**: an entry script that other modules import needs a main guard so its CLI body does not run on import. -- **PR-title format**: deterministic; tool-owned by the `pr-title` gate (`ci-workflows/.github/workflows/semantic-pr.yml`, wired into each consumer as `.github/workflows/pr-title.yml`), not review prose. See `../engineering/enforceability-tiers.md`. +- **PR-title format**: deterministic; tool-owned by the `pr-contract` composite (`ci-workflows/.github/actions/pr-contract`, which every consumer pins as a step inside its required `ci-status` job), not review prose. See `../engineering/enforceability-tiers.md`. ## Sources diff --git a/distribution/sync-manifest.yml b/distribution/sync-manifest.yml index de3ff4fd..51fd5dfa 100644 --- a/distribution/sync-manifest.yml +++ b/distribution/sync-manifest.yml @@ -269,7 +269,7 @@ components: path-detection-tools: files: components/path-detection/machine-path-patterns.sh: tools/shared/path-detection/machine-path-patterns.sh - # Always-loaded PR-body contract rule for every pr-issue-linkage gate caller + # Always-loaded PR-body contract rule for every pr-contract composite caller # (standards ADR-0008): the one repo-tracked signal that reaches sessions # with no plugins installed. The source doubles as this repository's own # live rule (standards is manifest source, not a target); the lockstep