fix(lychee): exclude private constellation repos from the online lane - #58
Conversation
Links to private GitHub repos are valid for authenticated collaborators, but the online advisory lane authenticates with the calling repo's GITHUB_TOKEN, which cannot read any other private repo — GitHub returns 404 and every scheduled run files a tracking-issue report for links that are not actually broken. Exclude the currently-private repos by name (not by owner) so links to public siblings remain checked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe
|
Claude finished @kyle-sexton's task in 1m 12s —— View job PR Review
The fix is correct and well-scoped. A few observations: Regex correctness ✅ The boundary guard Per-repo granularity ✅ Listing repos individually rather than suppressing entire owners (e.g. Self-reference edge case (minor, no action required)
Test coverage (acknowledged limitation) The existing test suite in Maintenance comment ✅ The inline comment is clear and actionable: This is exactly the right thing to record at the suppression site. Overall: The approach is sound, the regex is correct, and the inline documentation is good. Approved from a review standpoint. The one minor question is whether |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0332962fed
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
HTTPS clone URLs end in .git, so the [/#?]-or-end boundary missed them and the online lane still probed the private repo (review finding on this PR). Optional (\.git)? arm added; boundary behavior for near-miss repo names (dotfiles-extra, standards-archive) verified unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe
|
Claude finished @kyle-sexton's task in 1m 28s —— View job
PR ReviewThe second commit (
The pattern
Inline comment quality ✅ The comment at This is concise and the reasoning is correct. Self-reference note (carry-over from prior review, no action needed)
Test coverage (acknowledged structural gap)
Overall: The fix is correct. The Codex P2 feedback has been properly addressed. No issues blocking merge. |
|
Claude finished @kyle-sexton's task in 59s —— View job
PR ReviewThis review covers the final state of the branch after the merge-from-main commit ( Regex correctness ✅ Both patterns at
Per-repo granularity ✅ The alternation groups Inline comment ✅ The comment block at L29–35 explains the root cause, the design decision, the maintenance obligation, and the
Test coverage (structural gap, no action required)
Overall: The fix is correct, the Codex P2 feedback was properly addressed in |
…ed (#69) ## Summary The first fleet-wide sync PRs surfaced three local consumer edits that a verbatim overwrite would have destroyed — each resolved at the SSOT per the Track B operating rule (route changes upstream), with the policy recorded where it applies: - **typos** (`modules/typos/_typos.toml`): now carries the constellation-wide union of domain identifiers — provisioning's `PnPCapabilities`/`FoD`/`BAAs`, dotfiles' `abd` — each annotated. typos has no config layering, so repo-local exceptions cannot coexist with a synced file; the file's own comments now state the route-upstream policy (decided 2026-07-06, superseding the "adopters add them locally" guidance from the copy-adoption era). Each identifier only skips its exact token, so the union is inert elsewhere. - **shellcheck**: removed from `kyle-sexton/dotfiles`' include list. Its `.shellcheckrc` is a *documented deliberate* minimal divergence (the SSOT's `require-double-brackets` — verified enabled — would flag the statusline's intentional `[ ]` graceful-degradation idiom), with SSOT alignment already tracked as FU4 in that repo. The manifest comment carries the re-add trigger. Notably dotfiles has no CI shellcheck lane, so the overwrite would have broken pre-commit hooks *silently*. - **lychee** (provisioning's private-repo excludes): already upstream as #58 — no change here. Merging this re-fires the sync cascade (paths match), refreshing the open personal sync PRs so their deletions disappear. ## Verification Manifest parses (yq); typos lane runs in this PR's own CI against the updated config; SSOT `require-double-brackets` claim verified against `modules/shellcheck/.shellcheckrc`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01GbDWhcUtduCejgi7mcbMfy <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Config and manifest-only changes for spellcheck and sync scope; no runtime or auth paths, with typos union entries scoped to exact tokens. > > **Overview** > Aligns **Track B** distribution with what the first fleet sync would have overwritten: typos config and the dotfiles **shellcheck** target. > > **typos** (`modules/typos/_typos.toml`) now documents that the synced file is read-only downstream and holds a **constellation-wide union** of `[default.extend-identifiers]` (`abd`, `BAAs`, `FoD`, `PnPCapabilities`), each annotated, replacing the old “adopters extend locally” guidance. > > **`kyle-sexton/dotfiles`** no longer includes **shellcheck** in `distribution/sync-manifest.yml`, with a comment that its local `.shellcheckrc` intentionally diverges (SSOT `require-double-brackets` vs statusline `[ ]` idiom, FU4) and should be re-added when that follow-up lands. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 83493e7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary Closes out the activation checklist record after tonight's completion: App access fully done and verified (selected-repos flip, public App, personal-account installation proven by all four kyle-sexton sync legs minting tokens, local PEM deleted per key-hygiene guidance); both Layer-1 packages published and public (`biome-config@1.0.1` post-#70, `tsconfig@1.0.0`); full-fleet Layer-2 rollout merged across both accounts, with the first fleet pass's consumer customizations routed upstream (#58, #69). Remaining opens, each with an owner: the read-only marking (engine feature) and medley#1243 (Layer-1 pilot, in review). ## Verification markdownlint (module config) + editorconfig-checker clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01GbDWhcUtduCejgi7mcbMfy <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only status changes with no runtime, auth, or deployment impact. > > **Overview** > Updates the **gated activation checklist** in `config-distribution-plan.md` to reflect work completed 2026-07-06/07. > > **GitHub App + access** is marked fully done: org install limited to selected repos (API-verified), App public, personal-account install proven by all four `kyle-sexton` sync legs minting tokens, and the local private key removed after secrets validation. > > **Layer-1** narrative now states both packages are published and public (`biome-config@1.0.1`, `tsconfig@1.0.0`), with the open work narrowed to checking off the parent item when **medley#1243** merges. > > **Layer-2** is recorded as a **full-fleet rollout** across both accounts (not only org targets), including examples of consumer customizations routed upstream on the first pass. The only remaining blocker before closing that item is **read-only marking** (header comments + consumer CODEOWNERS), called out as an engine feature rather than a rollout step. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c75c611. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
) ## Context A cross-repo audit of the consumers that adopt this catalog's configs by copy (kyle-sexton/dotfiles, kyle-sexton/provisioning) surfaced two fixes that appeared to exist downstream without having been propagated to this SSOT. Verification against `origin/main` showed only one still needs to land: 1. **lychee private-repo exclusions — already upstream, no change.** provisioning fixed its scheduled online link-check 404ing on links to private constellation repos (melodic-software/provisioning#42 context), and dotfiles just adopted the same fix. This SSOT already carries it via #58: `modules/lychee/lychee.toml` on `main` is byte-identical to provisioning's copy (including the later `(\.git)?` clone-URL arm). The dotfiles copy is actually one revision *behind* — it predates the `(\.git)?` refinement — so the flow needed there is a re-copy from here, not a port to here. 2. **PSScriptAnalyzer settings comment — fixed in this PR.** The comment above the `PSUseDeclaredVarsMoreThanAssignments` entry claimed it "promotes to Error". That is factually wrong: a PSScriptAnalyzer settings file cannot re-map a rule's severity; the entry only enables the rule, and findings surface at the shipped Warning (which the top-level `Severity` filter already lets block). The comment now states the actual behavior. Comment-only; no functional change. The PSSA fix was deliberately **not** forked in the consumers, preserving byte-parity with this SSOT — it must land here and flow out via re-copy. ## Verification - `modules/powershell/powershell.test.sh`: 3/3 PASS. - `Invoke-ScriptAnalyzer` on the changed file (self-hosted settings): clean. - Pre-commit lanes (typos, editorconfig, gitleaks, psscriptanalyzer): all pass. ## Propagation After merge, consumers with copied configs should re-vendor: - **dotfiles** — `PSScriptAnalyzerSettings.psd1` (this fix) *and* `modules/lychee/lychee.toml` (to pick up the `(\.git)?` arm it is missing). - **provisioning** — `PSScriptAnalyzerSettings.psd1` (its lychee copy is already current). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_011Bh4hQWCEw3ZJoyQ7nhqVH <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only comment change in analyzer settings; no runtime or lint behavior changes. > > **Overview** > **Comment-only fix** in `PSScriptAnalyzerSettings.psd1` above `PSUseDeclaredVarsMoreThanAssignments`. > > The old comment said unused variables are promoted to **Error**. That was wrong: settings files only **enable** rules; they cannot change a rule’s built-in severity. Findings stay at the rule’s default **Warning**, and blocking still comes from the file’s top-level `Severity = @('Error', 'Warning', 'Information')` filter. > > No rule settings or behavior change—downstream repos that vendor this file should re-copy after merge for parity. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 02a3116. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… style (#124) ## Summary Codifies six open decisions from the org's issue/PR consistency assessment into `conventions/process/issue-tracker.md`: - **#9** `entities-governance-doc-topology-reference-style` — abstracts the personal-vs-org repo-topology prose (no more named `melodic-software/github-iac` / `kyle-sexton/github-iac` links); points at `github-iac`'s `GovernedRepositories.cs` as the sole source of truth for which repositories are governed and how. - **#23** `entities-closing-keyword-house-style-convention` — codifies native GitHub closing keywords (`Closes`/`Fixes`/`Resolves` `#N`) as the default house style, with `provisioning`'s stricter requirement (native keyword plus a manual `## Related` section, per decisions #58/#59) as the one named exception. - **#25** `naming-issue-title-vocabulary-governance` — codifies issue titles as free text with no enforced prefix vocabulary (no `[CC]`-style conventional-commit tags), documenting the existing silence as a deliberate choice. - **#45** `entities-assignee-claiming-guidance-relevance` — keeps the existing assignee-plus-lease claiming guidance but marks it explicitly deferred, with an activation trigger (required reviewers / multi-maintainer assignment contention). - **#48** `metadata-codeowners-adoption` — adds a one-line note that CODEOWNERS adoption is deferred, contingent on decision #11 (`required_approving_review_count` staying at 0 org-wide) — CODEOWNERS is inert without required reviews. - **#49** `comments-codify-human-conventions` — codifies three optional documented conventions: a 🤖 footer marking bot-authored comments, citing evidence when closing on it, and a 🔒 marker for claimed issues (explicitly framed as the lightweight interim signal until #45's mechanism activates). Decisions Log: https://claude.ai/code/artifact/232ecdce-8316-4880-8c0a-dc3c7dcf3a63 ## Test plan - [x] `lefthook run pre-commit` — typos, editorconfig, gitleaks, markdownlint all pass - [x] Grepped the file for residual `kyle-sexton`/named `github-iac` repo references — none remain - [ ] Human review of tone/placement against the rest of the process conventions 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
…ted scope (#247) No related issue: rule additions decided on melodic-software/medley#1623 and melodic-software/claude-code-plugins#975 ## Summary - Adds the rule that CLI/agent issue creation always passes `--type` with one of the org's enabled native types (`Task`/`Bug`/`Feature`); the web-UI issue form already surfaces the Types field so that path can't skip it. Placed in `conventions/process/issue-tracker.md`'s existing "The type axis" section. - Corrects an existing claim in that same paragraph beyond the two dictated edits: the doc asserted a `no:type` search qualifier exists to find untyped issues. Empirically disproved against the live org (`org:melodic-software is:issue is:open no:type` returned the unfiltered total of 336, identical to the query with no `no:type` clause at all — GitHub silently drops the unrecognized qualifier rather than erroring). Replaced with an accurate description: search exposes a positive `type:"Bug"`-style qualifier per enabled type but no negation for "untyped"; finding the untyped remainder means comparing per-type counts against the total, or reading an issue's `type` field (`null` when unset). - Reconciles the `## Related` PR-section requirement from requires-ci-scoped phrasing ("became the org-wide rule when the shared `pr-issue-linkage` gate generalized it to every requires-ci repository") to the fleet-wide convention locked in claude-code-plugins#975's Q12 decision — the practice applies org- and account-wide by convention even where no CI gate exists to check it mechanically (e.g. `songwriting`, `knowledge-corpus`). Preserves the one-line historical note that it began as `provisioning`'s stricter convention (decisions log #58/#59). ## Related - melodic-software/medley#1623 - melodic-software/claude-code-plugins#975 - #173 🤖 Generated with [Claude Code](https://claude.com/claude-code) KNOWN ISSUE: hosted CI may fail 0-step/2s (billing) — environmental, note and continue. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>


Problem
The online advisory link-check lane (ci-workflows
link-check.yml) reports 404 for every link to a private constellation repo (e.g.kyle-sexton/dotfiles,melodic-software/standards). Those links are valid for authenticated collaborators, but the lane's credential is the calling repo'sGITHUB_TOKEN, which cannot read any other private repo — GitHub answers 404 by design. Result: rolling tracking issues (e.g. kyle-sexton/provisioning#36) report links that are not broken.Fix
Add
excludepatterns for the currently-private repos tomodules/lychee/lychee.toml, with the justification recorded at the suppression site:ci-workflows,claude-code-plugins) stay checked.([/#?]|$)prevents accidental prefix matches (verified:.../dotfiles-other-repo-nameis still checked).Verification
modules/lychee/lychee.test.sh: 4/4 PASS.blob/...#anchorpaths) excluded; public-repo URLs checked OK; near-miss repo name not excluded.typosclean on the changed file.Propagation
Consumers adopt this file by copy — repos with a copied
modules/lychee/lychee.tomlshould pull this update. kyle-sexton/provisioning picks it up in the PR that closes its link-checker report issue.🤖 Generated with Claude Code
https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe
Note
Low Risk
Config-only URL exclusions for known false positives in the online lychee lane; no runtime or auth logic changes.
Overview
The online advisory link-check lane was reporting 404 for URLs to private constellation repos even when those links are valid for collaborators, because the lane only uses the calling repo’s
GITHUB_TOKEN, which cannot read other private repos.This change extends
modules/lychee/lychee.tomlexcludewith regex patterns for specific private repos underkyle-sextonandmelodic-software, documented inline at the suppression site. Patterns are per repo (not whole owners), include an optional.gitarm for clone URLs, and use a([/#?]|$)boundary so similarly named public repos still get checked. The offline lane is unchanged.Reviewed by Cursor Bugbot for commit fd33fd8. Bugbot is set up for automated code reviews on this repo. Configure here.