Repository navigation
fix(baselines): loosening a ratchet baseline needs the user's command (#348) #1346
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Mechanical gates on every PR and push. These are the toolkit's own local checks, promoted to | |
| # CI so a contribution from any machine gets the same floor: scripts parse, routing renders, | |
| # no macOS-only regressions, no client data. Judgement stays in review; this is only the floor. | |
| name: toolkit checks | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| jobs: | |
| checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # check-pr-discipline.sh needs the merge base with the PR's target branch. | |
| fetch-depth: 0 | |
| - name: Scripts parse under bash and node (check-scripts.sh) | |
| run: bin/check-scripts.sh | |
| # PRs only: the two merge-queue rules that broke by hand on 2026-09-01 (three of five | |
| # queued PRs missing their CHANGELOG line; BUG-96..100 assigned twice in one day by | |
| # sessions forked from stale masters). Push-to-master runs skip it: the diff basis is | |
| # the PR relationship, and master itself is where the numbers become taken. | |
| - name: PR discipline — changelog rides along, BUG numbers collision-free | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| git fetch --no-tags origin "${{ github.base_ref }}" | |
| bin/check-pr-discipline.sh "origin/${{ github.base_ref }}" | |
| - name: Routing tables in sync with skill-routing.tsv (render-routing.sh --check) | |
| run: bin/render-routing.sh --check | |
| - name: MDL rules by kind cover every rule and match skills/generated (mdl-rules.sh --check) | |
| run: bin/mdl-rules.sh --check | |
| - name: No macOS-only assumptions reintroduced (check-portability.sh) | |
| run: bin/check-portability.sh | |
| # The public toolkit never cites a private tier (a personal repo, a company brain): five | |
| # skills once pointed at files only one person had. templates/company-brain/ is the | |
| # sanctioned private tier; this is the direction it must never be cited from. | |
| - name: No private-tier citations (check-no-private-citations.sh) | |
| run: bin/check-no-private-citations.sh | |
| # The client-NAME denylist is personal and local by design: it lives in the maintainer's | |
| # gitignored .leakguard-deny and runs in their pre-commit/pre-push hooks | |
| # (bin/install-hooks.sh) — never in the repo, never required of contributors. In CI the | |
| # guard runs in allow-no-denylist mode: the generic probes (emails, GUIDs, absolute | |
| # local paths) still gate every PR, but a missing name list is a warning, not a red X. | |
| # If the LEAKGUARD_DENY repo secret is ever set, name matching activates here too. | |
| # LEAKGUARD_BASE turns on the script's step 7, a WARN-ONLY report of capitalised words | |
| # the PR's diff introduces that the base branch didn't have — it never fails this step. | |
| # The explicit fetch is belt-and-braces: fetch-depth: 0 above already pulls full history, | |
| # but this step must not depend on running after check-pr-discipline.sh's own fetch. | |
| - name: Leak guard, generic probes only (check-no-client-data.sh) | |
| env: | |
| LEAKGUARD_DENY: ${{ secrets.LEAKGUARD_DENY }} | |
| LEAKGUARD_ALLOW_NO_DENYLIST: "1" | |
| LEAKGUARD_BASE: origin/${{ github.base_ref || 'master' }} | |
| run: | | |
| git fetch --no-tags origin "${{ github.base_ref || 'master' }}" | |
| bin/check-no-client-data.sh | |
| # The two fixture suites. Added 2026-09-08 after a bisect found both red since 2026-08-20: | |
| # two deliberate exit-code changes (PENDING → exit 3, Stage 0 advisory → exit 0) updated | |
| # only the fixtures their authors ran, and nothing here ran the rest — so five stale | |
| # fixtures and one Mac-only dependency sat red for nineteen days while every PR was green. | |
| # run-tests.sh is self-contained (~20 s); run-all.sh drives every wave2 fixture with its | |
| # own declared subject (~5 min). Slow is fine; silent is not. | |
| - name: Guard-script fixtures (tests/run-tests.sh) | |
| run: bash tests/run-tests.sh | |
| - name: Gate and instrument fixtures (tests/wave2/run-all.sh) | |
| run: bash tests/wave2/run-all.sh | |
| # Standalone fixtures at tests/ root. Added 2026-10-05: test-lint-delivery.sh (14 cases, | |
| # several proving a project's hand-tuned lint rule survives a sync) was never run here, | |
| # because neither runner above looks at tests/test-*.sh. A glob, not a list, so the next | |
| # standalone fixture cannot be orphaned the same way. | |
| - name: Standalone fixtures (tests/test-*.sh) | |
| run: | | |
| rc=0 | |
| for t in tests/test-*.sh; do | |
| echo "### $t" | |
| bash "$t" || { echo "FAILED: $t"; rc=1; } | |
| done | |
| exit $rc | |
| # Lint-rule unit suite. Added 2026-10-08 with UX001/UX002: executes the Starlark rules | |
| # under go.starlark.net at mxcli's pinned version (tests/lint-rules/starrun, built here | |
| # with the runner's Go), so rule logic is proven before any field calibration. Not under | |
| # the glob above because it needs Go and lives in its own directory. | |
| - name: Lint-rule unit suite (tests/lint-rules/test-ux-rules.sh) | |
| run: bash tests/lint-rules/test-ux-rules.sh | |
| - name: Lint-rule unit suite (tests/lint-rules/test-batch1-rules.sh) | |
| run: bash tests/lint-rules/test-batch1-rules.sh | |
| - name: Lint-rule unit suite, batch 2 (tests/lint-rules/test-batch2-rules.sh) | |
| run: bash tests/lint-rules/test-batch2-rules.sh | |
| - name: Lint-rule unit suite, batch 3 (tests/lint-rules/test-batch3-rules.sh) | |
| run: bash tests/lint-rules/test-batch3-rules.sh | |
| - name: Lint-rule unit suite, batch 4 (tests/lint-rules/test-batch4-rules.sh) | |
| run: bash tests/lint-rules/test-batch4-rules.sh | |
| # ADVISORY, never a gate (added with tests/advisory/authoring-audit.py): prints near-duplicate | |
| # rules across skills/agents/CLAUDE.md and routing top-3 hits for the labelled phrasings | |
| # (CLAUDE.md rule 8). Its own job, so it reports even when a gate above is red, and it cannot | |
| # turn the PR red: continue-on-error on job and step, `|| true` on both runs. Stdlib Python, ~15 s. | |
| authoring-audit: | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Authoring audit, advisory (routing, dupes) | |
| continue-on-error: true | |
| run: | | |
| python3 tests/advisory/authoring-audit.py routing || true | |
| python3 tests/advisory/authoring-audit.py dupes --top 40 || true |