From ad45bb418cf840a3ab62ca16ec500d988f2b00f1 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 18 Jul 2026 10:45:16 -0700 Subject: [PATCH] Describe the 5D audit as reporting defects, not failing AUDIT.md is a read-only procedure: its secrets check echoes "MISSING (defect)" and defines no non-zero exit contract. Two sentences in WORKFLOW.md still said the audit "asserts" names exist and "fails" if it cannot query them, wording inherited from when configure.sh performed the audit and exited non-zero on drift. Describe the behavior AUDIT.md actually has: it checks the names and reports a missing name or a failed query as a defect. Co-Authored-By: Claude Opus 4.8 (1M context) --- WORKFLOW.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/WORKFLOW.md b/WORKFLOW.md index 5c9b74f..4e6872e 100644 --- a/WORKFLOW.md +++ b/WORKFLOW.md @@ -590,8 +590,9 @@ Follow the read-only audit in [`AUDIT.md`](./AUDIT.md) (section 6). It confirms the `main`/`develop` rulesets enforce the required merge method + status check + signed commits + strict-off, and the repository settings (auto-merge, allowed merge methods) are in place, reporting any drift. A missing or incorrect configuration item is a defect (D10). Secret *values* cannot be read -back, so the audit asserts the names exist (failing if it cannot query them); the GitHub App installation is a -best-effort check (a precise check needs app-level auth, so it notes rather than fails). The NuGet.org trusted-publishing +back, so the audit checks that the names exist, reporting a missing name or a failed query as a defect; the +GitHub App installation is a best-effort check (a precise check needs app-level auth, so it notes rather +than reports a defect). The NuGet.org trusted-publishing policy (D4.7) lives outside GitHub and cannot be checked by `gh api`, so it sits outside AUDIT.md's drift report entirely - it is a manual checklist item, verified on NuGet.org (see section 6). @@ -664,5 +665,5 @@ baseline and reports drift without changing anything; that procedure **is** the `repo-config/configure.sh [owner/repo] [release|operational]` applies the baseline to a repo (idempotent; both arguments optional - the repo defaults to the current one, and the model to the registry lookup, falling back to `release` with a warning when no registry is present). -Secret values cannot be read back, so the audit asserts the names exist (failing if they cannot be queried); -the App installation is a best-effort check. +Secret values cannot be read back, so the audit checks that the names exist, reporting a missing name or a +failed query as a defect; the App installation is a best-effort check.