Skip to content

Incorporate #322: publisher TOCTOU pin, carry-policy blessing, snippet nits - #323

Merged
ptr727 merged 3 commits into
developfrom
incorporate-322-postsync
Jul 16, 2026
Merged

Incorporate #322: publisher TOCTOU pin, carry-policy blessing, snippet nits#323
ptr727 merged 3 commits into
developfrom
incorporate-322-postsync

Conversation

@ptr727

@ptr727 ptr727 commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Incorporates the four post-sync leftovers from the Financial-Modeling standup (#322).

  1. Publisher TOCTOU - publish now checks out github.sha (the dispatch-time commit) instead of github.ref_name (a moving pointer), so a commit landing between dispatch and checkout can no longer be released unvalidated. NBGV classification is unaffected (GITHUB_REF still names the branch). Matches the pin Financial-Modeling ships.
  2. .github/ wording - "GitHub-consumed configuration - workflows, Dependabot" (Dependabot config is not Actions-owned).
  3. Tasks snippet - header says every command-executing task is type: process (aggregators are dependsOn-only), and Python Format/Python Test use the object group form (isDefault) so Run Build/Test Task runs the gate as CODESTYLE documents.
  4. Carry policy - the Downstream Carry section blesses the owner-directed shape as standard: a downstream repo carries locally adapted, repo-scoped AUDIT.md + spec/secrets.json for self-audit against its committed repo-config/ baseline; the hub's fleet-wide audit stays authoritative and the hub is never linked. (A spec/files.json baseline entry for these is deliberately deferred until more of the fleet adopts the shape.)

Validation: actionlint clean, markdownlint 0 errors, editorconfig clean, snippet JSONC parses, EOLs preserved.

Closes #322.

🤖 Generated with Claude Code

…t nits

- publish-release.yml: checkout pins github.sha - the branch name is a moving
  pointer, so a commit landing between dispatch and checkout was released
  unvalidated; GITHUB_REF still names the branch for NBGV classification.
- repo-config/README.md: .github/ holds GitHub-consumed configuration
  (workflows, Dependabot), not "Actions-owned"; the Downstream Carry section
  blesses the adapted repo-scoped self-audit carry (local AUDIT.md +
  spec/secrets.json auditing the repo against its committed repo-config
  baseline) as the standard shape - hub audit stays authoritative, hub never
  linked.
- vscode-tasks-python.json: the aggregators are dependsOn-only (header says
  command-executing tasks are type: process), and the object group form makes
  Python Format / Python Test the default build/test tasks.

Closes #322 (fires on promotion).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 16, 2026 15:30

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR incorporates the remaining post-sync updates from issue #322 by tightening the release workflow's checkout semantics (avoiding a TOCTOU window), refining repo governance wording and downstream carry guidance, and polishing the Python VS Code tasks snippet to better match documented task behavior.

Changes:

  • Pin the publish workflow checkout to the dispatch-time commit (github.sha) to prevent releasing a post-dispatch commit that was not validated.
  • Update repo-config/README.md wording around .github/ usage and add downstream carry guidance for adapted self-audit files.
  • Adjust the Python VS Code tasks snippet to clarify which tasks are type: process and set default build/test tasks via the object-form group.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
repo-config/README.md Refines .github/ wording and adds carry-policy guidance for adapted downstream self-audit artifacts.
catalog/snippets/configs/vscode-tasks-python.json Clarifies header comment and sets Python Format/Python Test as default build/test tasks using object-form group.
.github/workflows/publish-release.yml Pins checkout to github.sha (dispatch-time commit) and updates the surrounding commentary.

Comment thread repo-config/README.md
Comment thread .github/workflows/publish-release.yml Outdated
The Adapted-self-audit-carry bullet contradicted the remaining "hub-only"
parentheticals (file list, Secrets) - both now point at Downstream Carry; the
publisher checkout comment shrinks back to one line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 16, 2026 15:37

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comment thread repo-config/README.md Outdated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 16, 2026 15:53
@ptr727
ptr727 merged commit 3f3fe86 into develop Jul 16, 2026
7 checks passed
@ptr727
ptr727 deleted the incorporate-322-postsync branch July 16, 2026 15:54

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

ptr727 added a commit that referenced this pull request Jul 16, 2026
#326)

Promotes two squashed increments:

- **#323** (#322 incorporation) - publisher TOCTOU pin (checkout the
dispatch-time commit), .github/ wording, adapted self-audit carry
blessed as the standard downstream shape, tasks-snippet default
build/test groups.
- **#324** (#310 slice D) - spec/audit.py, the on-demand live fleet
audit: settings/rulesets/secret-names/file-presence/branch-facts vs the
ground truth, per-repo error isolation, tree-based divergence detection.
Owner-initiated by design. The baseline App-pair requirement stays
fleet-wide (owner-confirmed: the codegen App merges Dependabot PRs on
every tier, operational included).

Refs #310 (the cold-start self-test matrix remains the open acceptance
item).

Closes #322.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants