Repository navigation
Repoint organization-required workflows from actions to .github #237
Description
🤖 Generated by the Agentic Engineer
Problem
devantler-tech/actions cannot be archived while any organization-required workflow still resolves from it. An unavailable required source can block merges, so migrate through reviewed declarative adoption, verify native inheritance and exercise each changed rule on an ordinary consumer PR before retiring the legacy source.
Delivered and remaining evidence, 18 October 2026
- World at Ruin's required regression rule is declared in
deploy/and its live inherited rule now names the maintained catalogue (933213756). Retain its existing delivery and behavioral receipts; this checkpoint is not a new regression run. - The language-selected Go rule was adopted Observe-first in Observe the existing organization Go workflow rule before migrating its CI source #643/fix(gitops): observe the required Go workflow policy #644, then migrated with complete policy backfill in Move the existing organization Go workflow rule to the maintained catalogue #645/fix(ci): use the maintained required Go workflow #646. v7.16.2 is published and applied; the native rule and inherited KSail rule independently name the maintained source. The existing selector, bypasses and protections are unchanged. KSail #7864 supplied the qualifying ordinary consumer: all eight selected Go jobs passed with native cache-policy proof, so Move the existing organization Go workflow rule to the maintained catalogue #645 is closed. The separate mirror-warmer change and full system matrix are still unfinished under KSail #7862/#7864.
- Fresh public main-branch samples on KSail, World at Ruin, monorepo, this repository, go-template and dotnet-template still inherit legacy dependency review, auto-merge and workflow-vulnerability scanning (
948529001). Go-template also has a separate required Go rule still naming the legacy source; dotnet-template retains the legacy .NET test source. The template rules are declared; dependency review is imported Observe-only. The other observed families still require safe complete adoption before a source switch. - These six public samples are not a complete organization-wide ruleset census. Do not treat the initial five-workflow snapshot as exhaustive or archive the legacy repository on this sample alone.
Acceptance criteria
- Complete the organization-wide native inventory, including template-specific and overlapping rules; migrate every required reference to
948529001without weakening its policy. - The declared World at Ruin rule names the maintained source and its regression guard pins that source.
- Adopt remaining live-only rules through the reviewed declarative path, with complete observation/backfill before Update; retain any unsupported provider gap under Adopt supported GitHub rulesets and track remaining provider gaps #69.
- Read back every changed rule and exercise an ordinary PR on at least one repository per rule, with the actual required jobs selected and completed.
Keep #565 and KSail #7348 separate: source migration does not repair the managed CodeQL writer, satisfy a dependency-PR cache observation or prove a sustained repository cache budget. Preserve all historical failed checkpoints. No direct settings write, new integration or legacy archive is authorized by this progress update.
Activity
devantler commentedon Sep 25, 2026
Plan, from a read-only survey (2026-09-25)
Read from each repository's effective branch rules. Five organization rulesets require a workflow from
actions(948529001):deploy/today21102220World at Ruin regressionsworld-at-ruin-required-regressions.yamlrepositoryIdto933213756; update its regression test17213449DependencyReviewdependency-review.yamlforProviderstatus.atProvider(verified complete: conditions, OrganizationAdmin bypass,doNotEnforceOnCreate), then promote with the new source3716878EnableAutoMergeenable-auto-merge.yamlatProvider, then declare and promote14426226ScanGitHubActionsscan-for-workflow-vulnerabilities.yaml10320335Govalidate-go-project.yamlProvider v0.20.0 expresses repository-property conditions (#121), so every step goes through
deploy/, and nothing needs a UI change.Order.
main: one PR repoints the two declared rulesets and adopts the three UI-managed ones Observe-only.atProvideris read back, a second PR declares their full spec with the new source.Each repoint is verified by a pull request in one affected repository still getting that required check. The
validate-go-projectcopy here callsapply-signed-fixesat anactionscommit until its re-pin, and that call keeps working becauseactionsis only frozen, not archived.devantler commentedon Oct 2, 2026
Fresh native readback on 2026-10-02 still finds all five required-workflow families pointing at legacy Actions repository ID
948529001: dependency review, auto-merge, workflow security, Go validation and World at Ruin regressions. The current World at Ruin declaration retains that source, while dependency review remains identity-only and Observe-only.The existing two-stage adoption plan remains necessary: declare and reconcile the complete rulesets before repointing, then read back their effective source and run a qualifying consumer PR for every family. Catalogue CI cannot substitute for that consumer proof.
Blocker: effective required-workflow source migration and qualifying consumer checks are not delivered. Legacy archival in #240 remains downstream of this work.
devantler commentedon Oct 4, 2026
Verified migration gate — 2026-10-04
A complete metadata and effective default-branch rule census found 70 legacy required-workflow declarations across 22 active public repositories. All five families in the criteria still resolve from repository 948529001. The canonical deploy-guards rule already resolves from repository 933213756, but is outside these five families. The census binds complete recursive trees, verified blobs and structural YAML to observed default-branch commits; its final head rebind completed at 11:17:32 UTC.
#235 is closed and no longer blocks this work. The administrative organization-ruleset universe remains UNKNOWN because the current API authority cannot read it. Complete effective branch rules do not prove that administrative universe is complete. Do not change settings from a partial inventory.
The next implementation is to adopt the three live-only general rules through #69, confirm provider support for complete workflow source specifications, and repoint the existing Go and World at Ruin declarations. Each changed ruleset needs native source readback and a qualifying consumer pull request. Blocker: complete administrative ruleset/provider evidence and verified canonical execution for each family.
devantler commentedon Oct 8, 2026
Current-source correction at reviewed main
f5bdae4233b8f5c64a88de717b134205d8f6cc97: the World at Ruin required-regression declaration and its regression test already name canonical catalogue repository933213756. The earlier instruction to repeat that source edit is stale. This is declaration evidence; effective-source readback and a qualifying consumer run are still separate acceptance gates.The Go-template and .NET-template declarations still name the legacy catalogue. The existing staged plan remains appropriate for the other required-workflow families: first import the existing resources with Observe only, obtain their complete observed specification, then review any source change separately. Repository-projected rules do not prove the full administrative conditions, selectors or bypasses, so partial readback must not authorize Update. No GitHub settings were changed by this audit; #237 and legacy retirement #240 remain open.
devantler commentedon Oct 10, 2026
Effective-source readback, 2026-10-10
The rules GitHub actually applies to a default branch can be read with ordinary repository access (
GET /repos/{owner}/{repo}/rules/branches/main). That answers the readback gate left open on 2026-10-08 without organization-admin access.world-at-ruin-required-regressions.yaml933213756),refs/heads/mainvalidate-go-project.yamlactions(948529001),refs/heads/mainrun-dotnet-tests.yamlactions(948529001),refs/heads/maindependency-review.yaml,enable-auto-merge.yaml,scan-for-workflow-vulnerabilities.yamlactions(948529001),refs/heads/maindeploy/agree, and both still name the frozen repository. They are the next change throughdeploy/once this card is pulled into Ready; it is in Icebox today, and this note starts nothing.main, which changes with every merge here. Show first that this repository's copy passes on go-template's tree as a direct run, and repoint one template at a time.This projection shows the source of each applied rule. It does not show a ruleset's selectors or bypass list, so the Observe-first plan for the three organization-wide families stands. Nothing was changed in this run.
devantler commentedon Oct 18, 2026
Delivered by #644: accepted head
ca95b72a2785473641df859175bc4148f5ce5db6, signed mergee038a2ea5f78d31ac2ba57304b6a5f899d7b6b81at 2026-10-18 11:02:08 UTC. The accepted and merged Git trees are identical (50106a40bbf070451a9505efbc5af957e1b92952). Release v7.16.1 points to that merge and CD 39121651933 succeeded.Native readback confirms the signed OCI revision
7.16.1@sha256:07eb9ff3bc61fd38a17390243b000be260b98455c3137c8296d0b4fa9f30f693is verified and applied. The new Go rule observation is Ready, Synced and LastAsyncOperation successful, with onlyObserveauthority and external identity10320335.The previously unavailable complete organization selector is now positively observed: system property
languageincludesGo; the ref selector includes~DEFAULT_BRANCH. Existing OrganizationAdmin/always bypass, active enforcement,doNotEnforceOnCreate: true, workflow path and legacy source repository948529001are preserved. A fresh repository-level read remains identical to the pre-import policy. No GitHub setting or cluster resource was imperatively changed.This completes the read-only adoption prerequisite. It does not repoint the required Go workflow, reduce CI runtime, fix the managed CodeQL writer or satisfy the sustained cache-budget outcome. #237 retains source migration and qualifying consumer CI; #565 retains both-path cache acceptance.
devantler commentedon Oct 18, 2026
Source migration delivered on 2026-10-18 through #646, merged at 12:11:40 UTC as signed
8d2203af130a8c27b8b98b3d7146f76b5ade7a98. Accepted head499fcd00f41adec6569a6b38f0bb9efd93623e76and the merge have identical treea875305037e1b15459763482bb0050e9101d5c73. Full native validation passed; CodeRabbit returned a finding-free exact-head review after the earlier provider-schema finding was fixed with regression controls.v7.16.2 was published at 12:12:17 UTC. Release run
39126276906and signed-manifest CD39126314832succeeded. Read-only deployment verification found the source signature verified and the applied revision exactly7.16.2@sha256:77868c0f343bd1d4a38a368493432f332bf55d579caadb00b6dcb0f8b7f4c87b.The native ruleset is Ready and Synced at current generation 3. Its authority is exactly Observe/Update. A complete normalized comparison against the original observation confirms the only semantic policy change is required-workflow repository
948529001to933213756; branch/property scope, bypasses, enforcement, path and ref remain unchanged. GitHub's inherited KSail main-branch rule independently reads back the maintained source and unchangeddo_not_enforce_on_create: true.The next ordinary KSail consumer is the mirror-warmer increment #7862. Keep #645 open until its full selected required Go validation and cache policy are observed there. #237 still owns the other legacy required-workflow families; #565 and KSail #7348 retain their separate behavior/budget outcomes and all historical failed checkpoints. No sustained-budget or whole-workflow speedup is claimed from the source switch alone. No direct configuration write, new App, paid resource or cache deletion was used.