Incorporate #322: publisher TOCTOU pin, carry-policy blessing, snippet nits - #323
Merged
Conversation
…t nits - publish-release.yml: checkout pins github.sha - the branch name is a moving pointer, so a commit landing between dispatch and checkout was released unvalidated; GITHUB_REF still names the branch for NBGV classification. - repo-config/README.md: .github/ holds GitHub-consumed configuration (workflows, Dependabot), not "Actions-owned"; the Downstream Carry section blesses the adapted repo-scoped self-audit carry (local AUDIT.md + spec/secrets.json auditing the repo against its committed repo-config baseline) as the standard shape - hub audit stays authoritative, hub never linked. - vscode-tasks-python.json: the aggregators are dependsOn-only (header says command-executing tasks are type: process), and the object group form makes Python Format / Python Test the default build/test tasks. Closes #322 (fires on promotion). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR incorporates the remaining post-sync updates from issue #322 by tightening the release workflow's checkout semantics (avoiding a TOCTOU window), refining repo governance wording and downstream carry guidance, and polishing the Python VS Code tasks snippet to better match documented task behavior.
Changes:
- Pin the publish workflow checkout to the dispatch-time commit (
github.sha) to prevent releasing a post-dispatch commit that was not validated. - Update
repo-config/README.mdwording around.github/usage and add downstream carry guidance for adapted self-audit files. - Adjust the Python VS Code tasks snippet to clarify which tasks are
type: processand set default build/test tasks via the object-formgroup.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| repo-config/README.md | Refines .github/ wording and adds carry-policy guidance for adapted downstream self-audit artifacts. |
| catalog/snippets/configs/vscode-tasks-python.json | Clarifies header comment and sets Python Format/Python Test as default build/test tasks using object-form group. |
| .github/workflows/publish-release.yml | Pins checkout to github.sha (dispatch-time commit) and updates the surrounding commentary. |
The Adapted-self-audit-carry bullet contradicted the remaining "hub-only" parentheticals (file list, Secrets) - both now point at Downstream Carry; the publisher checkout comment shrinks back to one line. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ptr727
added a commit
that referenced
this pull request
Jul 16, 2026
#326) Promotes two squashed increments: - **#323** (#322 incorporation) - publisher TOCTOU pin (checkout the dispatch-time commit), .github/ wording, adapted self-audit carry blessed as the standard downstream shape, tasks-snippet default build/test groups. - **#324** (#310 slice D) - spec/audit.py, the on-demand live fleet audit: settings/rulesets/secret-names/file-presence/branch-facts vs the ground truth, per-repo error isolation, tree-based divergence detection. Owner-initiated by design. The baseline App-pair requirement stays fleet-wide (owner-confirmed: the codegen App merges Dependabot PRs on every tier, operational included). Refs #310 (the cold-start self-test matrix remains the open acceptance item). Closes #322. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Incorporates the four post-sync leftovers from the Financial-Modeling standup (#322).
publishnow checks outgithub.sha(the dispatch-time commit) instead ofgithub.ref_name(a moving pointer), so a commit landing between dispatch and checkout can no longer be released unvalidated. NBGV classification is unaffected (GITHUB_REFstill names the branch). Matches the pin Financial-Modeling ships..github/wording - "GitHub-consumed configuration - workflows, Dependabot" (Dependabot config is not Actions-owned).type: process(aggregators aredependsOn-only), andPython Format/Python Testuse the object group form (isDefault) so Run Build/Test Task runs the gate as CODESTYLE documents.AUDIT.md+spec/secrets.jsonfor self-audit against its committedrepo-config/baseline; the hub's fleet-wide audit stays authoritative and the hub is never linked. (Aspec/files.jsonbaseline entry for these is deliberately deferred until more of the fleet adopts the shape.)Validation: actionlint clean, markdownlint 0 errors, editorconfig clean, snippet JSONC parses, EOLs preserved.
Closes #322.
🤖 Generated with Claude Code