Adopt the Hub's Reusable validate-task.yml - #99
Conversation
Replaces this repo's carried validate-task.yml with the hub-hosted reusable workflow (ptr727/ProjectTemplate#924, #950), pinned at the released 2.0.445 tag. The three callers (test-pull-request.yml, publish-release.yml, deploy-site.yml) now pass markdown-exclude-globs to keep the vendored PaperMod theme and the imported WordPress content archive out of the hub's markdownlint pass. The new .github/actions/validate/action.yml hook carries this repo's own domain checks the hub lint/unit-test jobs don't cover: config and environment-docs validation, and the Hugo build plus URL-parity gate. It no longer carries a shell-script step, since the hub's shell lint step now covers extensionless scripts by shebang and runs shfmt alongside shellcheck.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 10 included reviews per hour; 6 remain after this review. 📝 WalkthroughWalkthroughThe repository adds a composite validation action, removes the local reusable workflow, and routes deploy, release, and pull-request validation jobs to a pinned external workflow. Workflows add Markdown exclusions, permissions, and release-model comments. ChangesValidation centralization
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change moves validation to the hub workflow while retaining repository-specific configuration and Hugo checks; no actionable merge-blocking risk remains beyond normal review of the shared workflow contract. Sequence Diagram(s)sequenceDiagram
participant Workflow
participant ExternalValidationWorkflow
participant ValidationAction
participant Hugo
participant ReleaseBundle
Workflow->>ExternalValidationWorkflow: invoke pinned validate-task.yml
ExternalValidationWorkflow->>ValidationAction: run repository validation
ValidationAction->>Hugo: install pinned version and restore mtimes
ValidationAction->>ReleaseBundle: assemble validated release bundle
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Summary by QodoAdopt hub reusable validate-task workflow and repo-specific validate hook
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
There was a problem hiding this comment.
🟡 Changes recommended
The new validate composite action re-runs checkout to deepen history without pinning the ref, which can validate/build a different commit than the workflow run’s intended SHA (especially for workflow_dispatch).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR migrates this repository’s CI validation to the hub-hosted reusable validate-task.yml, replacing the local carried workflow with a small repo-specific validate hook that the hub workflow can invoke.
Changes:
- Updated the PR, release, and deploy workflows to call
ptr727/ProjectTemplate/.github/workflows/validate-task.yml@3927fec...and pass repo-specificmarkdown-exclude-globs. - Deleted this repo’s carried
.github/workflows/validate-task.yml. - Added
.github/actions/validate/action.ymlas the repo’s validate hook for config/env-doc checks and the Hugo build/URL-parity gate.
File summaries
| File | Description |
|---|---|
.github/workflows/validate-task.yml |
Deletes the repo-carried reusable workflow in favor of the hub-hosted gate. |
.github/workflows/test-pull-request.yml |
Switches PR validation to the hub reusable workflow and supplies markdown exclude globs. |
.github/workflows/publish-release.yml |
Switches release-time validation to the hub reusable workflow and supplies markdown exclude globs. |
.github/workflows/deploy-site.yml |
Switches deploy-time validation to the hub reusable workflow and supplies markdown exclude globs. |
.github/actions/validate/action.yml |
Adds the repo’s validate hook that the hub workflow runs for domain-specific checks. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
The re-checkout had no explicit ref, so it could resolve to a
different commit than the rest of the job validated (notably on a
workflow_dispatch run, where the ref can move after dispatch).
Pinning ref: ${{ github.sha }} matches the commit every other step
in the job already runs against.
There was a problem hiding this comment.
🔵 Needs a closer look
The updated header comment in test-pull-request.yml contradicts the actual triggers (it claims pull_request-only but the workflow also defines workflow_dispatch).
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
.github/workflows/test-pull-request.yml:9
- Comment says the workflow trigger is pull_request only, but the workflow also defines workflow_dispatch. Update the comment to match the actual triggers (or remove workflow_dispatch if it is not intended), so the header docs don’t contradict the on: block.
# It has no direct-commit allowance to keep advisory.
on:
pull_request:
branches: [ main, develop ]
workflow_dispatch:
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
Re-pins the three validate-task.yml callers to the released 2.0.448 tag (ptr727/ProjectTemplate#957, fixed by hub PR #958) and sets the new repo-gate-exclude-globs input to themes/*/**. The hub's validate-task.yml lint job runs a repo-gate step that scans every tracked workflow file for SHA-pinned actions. Blog's old carried copy never had this step, so adopting the hub's version was what surfaced it failing on themes/PaperMod's own vendored CI workflows, which pin actions by floating tag and stay byte-identical to upstream per themes/README.md's documented invariant. Verified locally: repo_gate.py --check sha-pin --exclude 'themes/*/**' reports 0 issues against this tree.
The header comment claimed pull_request was the only trigger, but workflow_dispatch was right below it in the same on: block.
|
Answering the suppressed finding (1) from round #99 (review): .github/workflows/test-pull-request.yml:9 — "Comment says the workflow trigger is pull_request only, but the workflow also defines workflow_dispatch." Fixed in 41d46f7: reworded the header comment to say the automatic trigger is pull_request only, with a separate line noting workflow_dispatch stays available for a manual run. |
There was a problem hiding this comment.
🟢 Approval recommended
The workflow migration to the hub reusable gate is consistent across callers and preserves Blog-specific validation via the new local validate hook.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Lite
There was a problem hiding this comment.
🔵 Needs a closer look
The PR description and newly added workflow comments contain verified inconsistencies that should be corrected to avoid misleading reviewers and future maintainers.
Review details
Suppressed comments (4)
Previously missed (3) — in code that hasn't changed since the last review.
.github/workflows/test-pull-request.yml:22
- PR description says these validate jobs now call the hub workflow at
.../validate-task.yml@3927fec... # 2.0.445, but the code pinscd7bae9e... # 2.0.448. Please update the PR description (or the pin) so reviewers can reliably confirm which hub release is being adopted.
This issue also appears on line 26 of the same file.
uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@cd7bae9ea830d2e42d1f7bb6e45b3e7f631c0668 # 2.0.448
.github/workflows/publish-release.yml:40
- The comment claims the WordPress content archive and the vendored theme are "neither authored here", but
content/is this repo’s primary Hugo content tree (posts/pages). Consider rewording to something precise like “exclude Hugo content and the vendored PaperMod theme from markdownlint/repo-gate to avoid noise from imported/vendored sources” (or scope the exclusion to the specific imported subtrees).
# This repo vendors the PaperMod theme and carries an imported WordPress content archive, neither authored here.
# .markdownlint-cli2.jsonc is carried verbatim, so it cannot scope them locally.
markdown-exclude-globs: |
.github/workflows/deploy-site.yml:49
- The comment claims the WordPress content archive and the vendored theme are "neither authored here", but
content/is this repo’s primary Hugo content tree (posts/pages). Consider rewording to something precise like “exclude Hugo content and the vendored PaperMod theme from markdownlint/repo-gate to avoid noise from imported/vendored sources” (or scope the exclusion to the specific imported subtrees).
# This repo vendors the PaperMod theme and carries an imported WordPress content archive, neither authored here.
# .markdownlint-cli2.jsonc is carried verbatim, so it cannot scope them locally.
markdown-exclude-globs: |
.github/workflows/test-pull-request.yml:28
- The comment claims the WordPress content archive and the vendored theme are "neither authored here", but
content/is this repo’s primary authored Hugo content tree (posts/pages). Consider rewording to something precise like “exclude Hugo content and the vendored PaperMod theme from markdownlint/repo-gate to avoid noise from imported/vendored sources” (or scope the exclusion to the specific imported subtrees).
# This repo vendors the PaperMod theme and carries an imported WordPress content archive, neither authored here.
# .markdownlint-cli2.jsonc is carried verbatim, so it cannot scope them locally.
markdown-exclude-globs: |
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
The comment said content/ was 'neither authored here', but it is this repo's whole Hugo content tree, which also holds newly-authored posts alongside the imported WordPress archive, not only imported content.
|
Answering the suppressed findings (4) from round #99 (review): .github/workflows/test-pull-request.yml:22 (and :26) — "PR description says these validate jobs now call the hub workflow at .../validate-task.yml@3927fec... # 2.0.445, but the code pins cd7bae9e... # 2.0.448." Disproven: the PR description was already updated to cd7bae9e... # 2.0.448 before this review round ran (edited in the PR body directly, no commit SHA). Current description text confirms it. .github/workflows/publish-release.yml:40, deploy-site.yml:49, test-pull-request.yml:28 — "The comment claims the WordPress content archive and the vendored theme are 'neither authored here', but content/ is this repo's primary Hugo content tree (posts/pages)." Fixed in 1c9d3f9: reworded to state what's excluded (content/ and the vendored theme) without overclaiming that content/ is entirely imported, since it also holds newly-authored posts. |
There was a problem hiding this comment.
🟢 Approval recommended
The workflow migration correctly wires the hub reusable gate with appropriate exclusions and preserves repo-specific validation via the new validate-hook composite action.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Lite
* Fix Prose-Gate Findings in the Develop-vs-Main Diff The hub's validate-task.yml adoption (#99) put the fleet doc-lint block's prose-gate step in this repo's own required CI for the first time, and it diffs the promotion PR against main rather than against develop. That surfaced pre-existing findings from earlier PRs (#97, #98) that their own diff-scoped reviews never covered: - .gitattributes, merge-bot-pull-request.yml: comment sentences wrapped across lines. - TODO.md: two semicolons in prose, and two backtick-quoted mentions of checks/check-eol-pins.py, deleted by #98, in prose that was already narrating its retirement in the past tense. * Fix Comma Splice Introduced by the Semicolon Fix Splitting into two sentences avoids both the semicolon the prose gate flags and the comma splice a single comma introduced.
Adopts the hub's reusable
validate-task.ymlper RESYNC.md's "Adopting the Gates" section, unblocked by ptr727/ProjectTemplate#924, #950, and #957.What changed
.github/workflows/test-pull-request.yml,publish-release.yml,deploy-site.yml: theirvalidatejobs now callptr727/ProjectTemplate/.github/workflows/validate-task.yml@cd7bae9... # 2.0.448instead of the local./.github/workflows/validate-task.yml, withmarkdown-exclude-globsset to keep the vendored PaperMod theme and the imported WordPress content archive out of the hub's markdownlint pass, andrepo-gate-exclude-globsset to keep the same vendored theme out of the hub's sha-pin scan..github/workflows/validate-task.yml(this repo's carried copy) is deleted..github/actions/validate/action.yml: this repo's own validate hook, carrying what the hub's generic lint/unit-test jobs don't cover: config/environment-docs checks and the Hugo build plus URL-parity gate. It carries no shell-script step, since the hub's shell lint step (as of #950/2.0.445) covers extensionless scripts by shebang and runsshfmtalongsideshellcheck. Its checkout-deepening step pins an explicitref(a real review finding, fixed in 51d01f2), so it always resolves to the same commit the rest of the job validated.Follow-ups filed against the hub while working on this
shfmtand its*.shglob missed a tracked extensionless script. Fixed and released as 2.0.445, which is what let this repo's validate hook drop its own duplicate shell-check step entirely.sha-pincheck scanned every tracked workflow file repo-wide with no exclusion point, failing on the vendored PaperMod theme's own upstream CI pins. Fixed and released as 2.0.448 (repo-gate-exclude-globs), adopted here.Verified
scripts/docker_lint.py --linter actionlint --linter editorconfig-checker,scripts/prose_lint.py --diff origin/develop, andscripts/repo_gate.py --check sha-pin --exclude 'themes/*/**'all pass clean, 0 findings.Summary by CodeRabbit