aaronrene / overseer-kit public
governance-closeout-github-actions.yml yaml
108 lines 4.0 KB
Raw
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83 chore(governance): sync handover+roadmap to 84db8c8 (drift:… Human 9 hours ago
1 # Example: post-merge governance closeout nudge (§PMHF.7). OPT-IN template only.
2 # Vendored by ok sync — copy to .github/workflows/governance-closeout.yml in consumer
3 # repos when wanted (Tier 2 confirm-once). Not required for the CLI floor:
4 # `ok status --exit-code` and `ok land-closeout` remain the always-on primary.
5 #
6 # Frozen bans (§PMHF.7):
7 # - No `git push` to main from this workflow.
8 # - No applying governance-sync patches directly onto main in CI (dry-run only here;
9 # a docs PR, if ever used, must commit to a feature branch and open PR → main).
10 # - No Cursor-only steps.
11 # - No secrets beyond the standard GITHUB_TOKEN for comment/PR.
12 #
13 # Preferred v1 is comment-only: when the dry-run plan shows D1/D2 drift or
14 # `ok land-closeout` is not ok, the workflow fails (visible check) and comments the
15 # plan summary + frozen land-b remediation on the merged PR when detectable.
16 #
17 # Degrade path: when CI is unavailable, run `ok land-closeout` locally — never treat
18 # CI unavailability as pass; agents still run land-b / ok governance-sync.
19
20 name: governance-closeout
21
22 on:
23 push:
24 branches: [main] # adjust to your vcs.git.main_branch when different
25 workflow_dispatch:
26
27 permissions:
28 contents: read # read-only checkout — structurally cannot push to main
29 pull-requests: read
30 issues: write # PR conversation comment (nudge) only
31
32 jobs:
33 closeout:
34 runs-on: ubuntu-latest
35 steps:
36 - uses: actions/checkout@v4
37
38 - name: Set up Python
39 uses: actions/setup-python@v5
40 with:
41 python-version: "3.11"
42
43 - name: Install Overseer Kit CLI dependencies
44 run: pip install PyYAML
45
46 - name: Governance-sync dry-run plan (read-only; never applies on main)
47 run: |
48 set -o pipefail
49 ./cli/ok governance-sync --dry-run | tee governance-closeout-plan.txt
50
51 - name: Land closeout probe (exit 2 keeps the check red until land-b)
52 env:
53 GH_TOKEN: ${{ github.token }}
54 run: |
55 set -o pipefail
56 status=0
57 ./cli/ok land-closeout --probe-merged-pr --json \
58 | tee land-closeout.json || status=$?
59 if grep -Eq "D1=drifted|D2=drifted" governance-closeout-plan.txt; then
60 status=2
61 fi
62 {
63 echo "## Governance closeout"
64 echo '```'
65 cat governance-closeout-plan.txt
66 cat land-closeout.json
67 echo '```'
68 } >> "$GITHUB_STEP_SUMMARY"
69 exit $status
70
71 - name: Comment land-b remediation on the merged PR (nudge only)
72 if: failure()
73 uses: actions/github-script@v7
74 with:
75 script: |
76 const fs = require('fs');
77 const plan = fs.existsSync('governance-closeout-plan.txt')
78 ? fs.readFileSync('governance-closeout-plan.txt', 'utf8').slice(0, 4000)
79 : '(no plan output)';
80 const body = [
81 '**Governance closeout incomplete after merge to main.**',
82 '',
83 'land_closeout-remediation: land-b required: ok governance-sync --dry-run',
84 'then apply; paste land-b; do not re-paste land-a',
85 '',
86 '<details><summary>governance-sync dry-run plan</summary>',
87 '',
88 '```',
89 plan,
90 '```',
91 '</details>',
92 ].join('\n');
93 const prs = await github.rest.repos.listPullRequestsAssociatedWithCommit({
94 owner: context.repo.owner,
95 repo: context.repo.repo,
96 commit_sha: context.sha,
97 });
98 const merged = prs.data.find((pr) => pr.merged_at);
99 if (merged) {
100 await github.rest.issues.createComment({
101 owner: context.repo.owner,
102 repo: context.repo.repo,
103 issue_number: merged.number,
104 body,
105 });
106 } else {
107 core.info('No associated merged PR found — remediation stays in the job summary.');
108 }
File History 1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199 fix(ISR): default require_independent_second_reviewer to require Human minor ⚠ 8 hours ago