Repository navigation
yaml: KYAML for the estate-owned container config, with a ratchet (YAML-POLICY step 5) - #245
Conversation
…ML-POLICY step 5) Converts the three non-workflow YAML files that no third-party bot rewrites, per standards YAML-POLICY §3.4 and §5 step 5 (standards#1024): - build/container/compose.yaml - build/container/compose.example.yaml - build/container/stapeln/.gatekeeper.yaml The rewriter is standards scripts/kyaml-format.sh alone, the one rewriter the step-2 comment-preservation proof covers; it refuses any change to the parsed data. Names stay (Compose, the Containerfile label and svalinn find the files by name). .gatekeeper.yaml is now byte-identical to standards' _shared/container/.gatekeeper.yaml, which it copies. Estate Rules gains "Converted YAML stays KYAML": kyaml-format.sh --check from standards 75bd599 with yq 4.53.3, both sha256-verified, so the template carries no copy of the formatter. Out of scope, as in standards' own ratchet: workflows (step 6, standards#1025) and files a third-party bot or tool reads by schema or rewrites (dependabot, FUNDING, issue forms, settings, CodeRabbit, Copilot, GitLab CI, pre-commit). Evidence: comment lines unchanged (31/31, 18/18, 59/59); --check idempotent; --check exits 1 on main's compose.yaml (the ratchet can fail); docker compose v5.6.0 config gives an identical resolved config before and after, for compose.example.yaml and for a simulated mint of compose.yaml; check-lock-sync.sh in sync. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 5 minutes. View limit details
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Ported unchanged from #243 (93e38a0), whose net change it equals, so this PR's workflows get past "Set up job". It no-ops once #243 merges. GitHub's runner now rejects a lock record whose ref is its own SHA: Unable to resolve action `actions/checkout@3d3c42e…`: invalid lockfile pin. Run `gh actions-lock` to update the lockfile Every job of Governance, Hypatia Security Scan, Mirror to Git Forges, Rust CI and Secret Scanner failed at "Set up job" on main (84d4e99). The six standards reusables move from 6a92510 to 75bd599. Standards' own lock carries tag refs there (standards#1271, #1285), and lock-selfcheck.sh reports 75bd599 self-consistent. relock-standards-pin.sh at 75bd599 re-keyed this lock to it and copied those tags into the nine action records that had a self-SHA ref (cache, checkout, editorconfig-checker, setup-beam, codeql-action, setup-zig, scorecard-action, rust-cache, ssh-agent). No commit value changes; each tag was checked with git ls-remote to point at its recorded commit. Only reusable-workflow records keep a SHA ref (cicd-suite x2 and standards), the form standards' own lock uses. (cherry picked from commit 93e38a0) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
CI: why the standards-reusable jobs failed at "Set up job", and the fix ported Governance, Secret Scanner, Hypatia, Mirror and Rust CI all stopped before any step ran: This is not this PR's change. The standards reusables are pinned at I ported its fix commit Checked locally on the new head:
Generated by Claude Code |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8bc2c1a8c6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Note Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
|
🤖 Coding Agent task started for unit test generation. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
…het, and standards lock consistency
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The ratchet passed all three converted files to kyaml-format.sh by name. container.just deletes them at mint: no-stapeln drops the gatekeeper policy, a non-portable selection drops both Compose files, and no-container drops all three. kyaml-format.sh then fails on the missing files, so Estate Rules would be red in every narrowed mint. The step now checks the converted files that exist. In the template (archetypes/ present) a missing file is an error, so a file cannot drop out of the ratchet silently. In a minted repository each removed file gets a notice, and with none left the step says there is nothing to check. kyaml_ratchet_test.sh (CodeRabbit, be95dda) runs the step on fixture trees instead of this checkout: the template, the template missing a file, and the four narrowings. It still propagates formatter exits 0, 1 and 2. Against the old step it fails at "template missing a file". container_kyaml_test.sh pins the template's own placeholders, which container-init substitutes in a mint, so it now SKIPs outside the template, the same archetypes/ check check-template-conformance.sh uses. Estate Rules runs both tests. standards_lock_test.sh is removed. It restated the standards pin and lock records by hand, which check-lock-sync.sh and validate-actions-lock.sh already check, and #243 dropped its twin. Checked: both tests, check-lock-sync, validate-actions-lock (standards 75bd599), validate-template and validate_workflows pass. The new step passes against the real kyaml-format.sh at 75bd599 on the template's three files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
SonarCloud failed the quality gate on new code (Security Rating B) over "Use '[[' instead of '['" in kyaml_ratchet_test.sh and container_kyaml_test.sh. Both scripts run under bash, so every test, including those in the mocked curl and sha256sum, now uses [[ ]]. Each comparison is quoted or literal, so no test changes meaning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
|
🤖 Coding Agent task started for unit test generation. |
|
SonarCloud still fails "B Security Rating on New Code" on 98d59dd. 26b483a cleared every failure-level annotation (the
The last is the only one with a security flavour. It is the assertion that the minted I can't confirm which issue sets the rating: sonarcloud.io is outside this session's network policy, so the issue list is unreadable here. Blocked until that's readable or the issue is reviewed in SonarCloud. I've asked the owner. Everything else on this head is green or still running. CodeRabbit's 98d59dd tests pass locally and are already Estate Rules steps. Generated by Claude Code |
#244 landed on main (b4d19ee). It and this branch both appended Estate Rules steps after the conformance self-test and a Changed entry to the changelog. Both sides are kept: main's governance steps come first, then the KYAML install, ratchet and tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
#249 landed on main (6a8bd11). It and this branch each added a Changed entry at the top of the changelog. Both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
|
Note Unit test generation is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
|
🤖 Coding Agent task started for unit test generation. |
2 participants
Summary
Does the part of the KYAML migration (standards YAML-POLICY §3.4, §5 step 5, standards#1024) that policy allows right now in the template. It converts the three estate-owned, non-workflow YAML files that no third-party bot rewrites. It also adds a CI ratchet so the converted files stay KYAML. Every repository minted from the template inherits both.
Scope follows standards' own Self Test ratchet. These are deliberately not converted:
.github/workflows/*.yml). They wait for step 6 (standards#1025). That step does not start until Dependabot andgh actions-lockemit KYAML, or until their drift is accepted in writing..github/dependabot.yml,FUNDING.yml, the issue forms,settings.yml(Probot),.coderabbit.yaml,.github/copilot/coding-agent.yml,ci/.gitlab-ci.ymlandci/.pre-commit-config.yaml.pre-commit autoupdaterewritesrev:lines in block style.Changes
build/container/compose.yaml,compose.example.yamlandstapeln/.gatekeeper.yamlare now KYAML content. The names stay, because Compose, the Containerfile label and svalinn find these files by name (§3.4).scripts/kyaml-format.sh, the one the step-2 comment-preservation proof covers. It refuses any change to the parsed data..gatekeeper.yamlis now byte-identical to standards'_shared/container/.gatekeeper.yaml, which it copies.kyaml-format.sh --checkfrom standards75bd599with yq 4.53.3, both sha256-verified, so the template carries no copy of the formatter that could drift. A yq that cannot write KYAML makes the script exit 2 (red), never green.RSR Quality Checklist
Required
kyaml-format.sh)unsafeblocks without// SAFETY:comments.envfiles includedAs Applicable
CHANGELOGor release notes updatedTesting
kyaml-format.shraised no data-change refusal on any file. Comment lines are unchanged (31/31, 18/18, 59/59).--checkpasses on the branch and is idempotent. It exits 1 on main'scompose.yaml, so the ratchet can fail.docker composev5.6.0configgives the same resolved config before and after:compose.example.yaml(absolute paths aside);compose.yamlafter a simulated mint (placeholders substituted the waycontainer.justdoes it).compose.yamlfails validation on its{{SERVICE_NAME}}placeholder, the same way before and after.sha256sum --check.check-lock-sync.shis in sync. Nouses:was added.Generated by Claude Code
Summary by CodeRabbit