Skip to content

Kyaml campaign step6 - #1194

Closed
hyperpolymath wants to merge 2 commits into
mainfrom
kyaml-campaign-step6
Closed

hyperpolymath wants to merge 2 commits into
mainfrom
kyaml-campaign-step6

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Closes #

Type of change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (would change existing behaviour)
  • 🕳️ Soundness fix (fixes a checker/proof false-negative)
  • 📖 Documentation
  • 🧹 Refactor / tech debt (behaviour-preserving)
  • ⚡ Performance
  • 🔧 Build / CI / tooling

How has this been verified?

Checklist

  • My commits are signed (git commit -S).
  • I ran the project's own checks/tests locally and they pass.
  • New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
    prose CC-BY-SA-4.0); I did not relicense existing files.
  • Docs are updated, and no public claim now overstates what the code does.
  • I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

Step 5 of KYAML adoption (standards#1024): migrate estate-authored
non-bot YAML files to KYAML format.

- Converted 22 non-workflow YAML files across standards repo
- Used yq -o kyaml via scripts/kyaml-format.sh
- Preserves all comments per yaml-comment-proof (standards#1021)
- Added missing SPDX headers to 3 files
- All files now pass kyaml-format.sh --check

KYAML adoption ruled by D280: 'KYAML everywhere, workflows included.'
Step 6 of KYAML adoption (standards#1025): migrate workflows to KYAML format.

- Converted all 60 workflow files to KYAML
- Updated self-test.yml KYAML ratchet to gate all workflows
- Used yq -o kyaml via scripts/kyaml-format.sh
- Preserves all comments per yaml-comment-proof (standards#1021)
- All workflows now pass kyaml-format.sh --check

KYAML adoption ruled by D280: 'KYAML everywhere, workflows included.'
Precondition verified: GitHub Actions parses KYAML (standards#1020)
Precondition verified: gh actions-lock handles KYAML (standards#1022)
@coderabbitai

coderabbitai Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 9aa4bb61-b251-4374-9e5c-ab97d63f5cda
📥 Commits

Reviewing files that changed from the base of the PR and between 8453510 and 67db5ee.

📒 Files selected for processing (82)
  • .github/workflows/actions-lock-gate.yml
  • .github/workflows/affinescript-verify.yml
  • .github/workflows/allowlist-preflight-reusable.yml
  • .github/workflows/apply-workflow-pins.yml
  • .github/workflows/boj-build.yml
  • .github/workflows/canon-spine-lockstep.yml
  • .github/workflows/casket-pages.yml
  • .github/workflows/changelog-reusable.yml
  • .github/workflows/changelog.yml
  • .github/workflows/check-suite-monitor.yml
  • .github/workflows/ci-pipeline.yml
  • .github/workflows/codeql-reusable.yml
  • .github/workflows/codeql.yml
  • .github/workflows/debt-measure.yml
  • .github/workflows/deed-conformance.yml
  • .github/workflows/dependabot-lock-regen.yml
  • .github/workflows/doc-format.yml
  • .github/workflows/dyadt-verify.yml
  • .github/workflows/echidna-verify.yml
  • .github/workflows/elixir-ci-reusable.yml
  • .github/workflows/elixir-ci.yml
  • .github/workflows/github-backup-mirror-reusable.yml
  • .github/workflows/governance-reusable.yml
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan-reusable.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/instant-sync.yml
  • .github/workflows/k9-contractile.yml
  • .github/workflows/label-triage.yml
  • .github/workflows/labels.yml
  • .github/workflows/launcher-standard-lockstep.yml
  • .github/workflows/lock-selfcheck.yml
  • .github/workflows/lock-sync-gate.yml
  • .github/workflows/lockfile-drift-detect.yml
  • .github/workflows/makefile-blocker.yml
  • .github/workflows/mirror-reusable.yml
  • .github/workflows/mirror.yml
  • .github/workflows/no-js-scan.yml
  • .github/workflows/pages-archive.yml
  • .github/workflows/pages.yml
  • .github/workflows/propagate-hooks.yml
  • .github/workflows/provisioning-check-reusable.yml
  • .github/workflows/readme-derive-reusable.yml
  • .github/workflows/readme-derive.yml
  • .github/workflows/registry-verify.yml
  • .github/workflows/rust-ci-reusable.yml
  • .github/workflows/scorecard-enforcer.yml
  • .github/workflows/scorecard-reusable.yml
  • .github/workflows/scorecard.yml
  • .github/workflows/secret-scanner-reusable.yml
  • .github/workflows/secret-scanner.yml
  • .github/workflows/security-gate-pr-target.yml
  • .github/workflows/self-ci.yml
  • .github/workflows/self-test.yml
  • .github/workflows/settings-drift-detect.yml
  • .github/workflows/signed-push-smoke.yml
  • .github/workflows/spark-theatre-gate.yml
  • .github/workflows/tag-ruleset-canon.yml
  • .github/workflows/tailscale-connect-reusable.yml
  • .github/workflows/uuid-v7.yml
  • .verisimdb/compose.yml
  • 3-practice/session-management-standards/continuity/checkpoint-before-major-change/PROTOCOL.yaml
  • 3-practice/session-management-standards/continuity/emergency-termination/PROTOCOL.yaml
  • 3-practice/session-management-standards/continuity/planned-session-close/PROTOCOL.yaml
  • 3-practice/session-management-standards/continuity/recovery-operation/PROTOCOL.yaml
  • 3-practice/session-management-standards/continuity/repo-intake/PROTOCOL.yaml
  • 3-practice/session-management-standards/handover/collaborative-transfer/PROTOCOL.yaml
  • 3-practice/session-management-standards/handover/full-transfer/PROTOCOL.yaml
  • 3-practice/session-management-standards/handover/human-transfer/PROTOCOL.yaml
  • 3-practice/session-management-standards/handover/model-transfer/PROTOCOL.yaml
  • 3-practice/session-management-standards/verify/maintenance-sweep/PROTOCOL.yaml
  • 3-practice/session-management-standards/verify/release-audit/PROTOCOL.yaml
  • 3-practice/session-management-standards/verify/substantial-completion/PROTOCOL.yaml
  • rhodium-standard-repositories/FUNDING.yml
  • rhodium-standard-repositories/examples/rhodium-minimal/FUNDING.yml
  • rhodium-standard-repositories/satellites/palimpsest-license/.rvc/config.yml
  • rhodium-standard-repositories/satellites/palimpsest-license/TOOLS/validation/haskell/stack.yaml
  • rhodium-standard-repositories/satellites/palimpsest-license/integrations/api/openapi/palimpsest-license-api.yaml
  • rhodium-standard-repositories/satellites/rsr-certifier/FUNDING.yml
  • rhodium-standard-repositories/satellites/rsr-certifier/container/compose.yml
  • rhodium-standard-repositories/satellites/rsr-certifier/container/k8s/deployment.yaml
  • rhodium-standard-repositories/satellites/state.scm/FUNDING.yml
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Oct 7, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@hyperpolymath
hyperpolymath enabled auto-merge (squash) October 7, 2026 10:06
@hyperpolymath
hyperpolymath disabled auto-merge October 7, 2026 10:53
@hyperpolymath

Copy link
Copy Markdown
Owner Author

Closing without merging. Automerge disarmed first.

  • Commit 1 (0866af83, step 5) already landed, squashed, as feat(yaml): KYAML step 5 - migrate non-workflow YAML to KYAML (22 files) #1193.
  • Commit 2 (67db5ee9, step 6) converts 60 workflows in one commit. That fails the gates of KYAML step 6/6 — workflows, only if step 4 rules them in scope #1025, which is still open:
    • KYAML step 6/6 — workflows, only if step 4 rules them in scope #1025 requires reversible batches, never estate-wide in one commit.
    • It requires every converted workflow to be proven to have run (jobs >= 1 plus an executed-step marker). This head had zero pull_request runs, because GitHub does not run them on a conflicted PR.
    • It requires the gh actions-lock extractor to be tested on flow-style mappings. A workflow that loses lock coverage dies at startup with jobs=0, and the producers of all three required contexts (governance / Actions lockfile verify, uses ⊆ actions.lock, scan / gitleaks) are among the 60 converted files.
    • The Dependabot / gh actions-lock emitted-YAML drift has not yet been ruled on in writing.
  • With automerge armed, resolving the 11 conflicting workflows would have landed all of this unverified.

The branch is kept (refs/pull/1194/head is permanent too), so step 6 can be re-cut in batches under #1025.

🤖 Generated with Claude Code

@hyperpolymath
hyperpolymath deleted the kyaml-campaign-step6 branch October 8, 2026 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant