fix(ci): CI hygiene extracted from #126 — .hypothesis untrack, pre-commit wiring, four-workflow remediation (stack 9/9)#137
Merged
Conversation
.hypothesis/ has been in .gitignore all along, but 92 of its cache files were already committed to the repo at some point before the ignore rule was added (git only ignores new paths, it doesn't untrack existing ones). Every test run that exercises Hypothesis-based property tests mutates these files, so they showed up as noisy, unrelated diffs every time `pre-commit run --all-files` (trailing-whitespace, end-of-file-fixer) touched them locally or in CI. Untracking them so the ignore rule actually takes effect. Co-authored-by: Igor Beylin <cryptoxdog@users.noreply.github.com> (cherry picked from commit 2b93071)
trailing-whitespace / end-of-file-fixer (from .pre-commit-config.yaml) were failing on 5 pre-existing docs. Whitespace-only changes, no content edits. Co-authored-by: Igor Beylin <cryptoxdog@users.noreply.github.com> (cherry picked from commit 0923b07)
ci-quality.yml's quality-gate job referenced needs.lint-format.result, needs.secrets-scan.result, and needs.yaml-validate.result using GitHub Actions dot notation. Dot notation doesn't work for job IDs containing a hyphen -- `-` is parsed as subtraction -- so those three always evaluated to an empty string, not the job's actual result. Every `if [[ "" == "failure" ]]` was therefore always false: quality-gate could report a passing summary even when lint-format or secrets-scan failed. semgrep's result wasn't checked at all (missing from the fail conditions, independent of the hyphen bug). Fixed by switching to bracket syntax (needs['lint-format'].result, etc.) for the three hyphenated job IDs, and added the missing semgrep check. Co-authored-by: Igor Beylin <cryptoxdog@users.noreply.github.com> (cherry picked from commit 1e45870)
…ate fix Documents the new Phase 2.5 (precommit job), the mypy scope/blocking fix, the ci-quality.yml quality-gate hyphen-notation bug fix, the pytest -x removal, and the current SKIP list for the precommit job with rationale for each skipped hook. Also notes that ci-gate and quality-gate need to be configured as required status checks in branch protection to actually block merges -- a workflow job failing does not, by itself, prevent merging. Co-authored-by: Igor Beylin <cryptoxdog@users.noreply.github.com> (cherry picked from commit 3e0a205)
…de-sync, pr-review-enforcement, terminology-guard Applied from cognitive-engine-graphs-open-pr-remediation-v2 126/apply.sh on the rebased #125 baseline. Post-checks passed: git apply --check, git diff --check, YAML validation on all four workflows, changed-path allowlist. (cherry picked from commit c69d595)
Two changes to .github/workflows/ci.yml: 1. New "precommit" job (Phase 2.5), required by ci-gate. Runs `pre-commit run --all-files` via pre-commit/action so every hook in .pre-commit-config.yaml is enforced on every PR/push -- regardless of whether a contributor (human or agent) ran `pre-commit install` locally, or bypassed hooks with `git commit -n`. Skips two hooks with SKIP=gitleaks,packet-envelope-prohibited (both explained inline and in docs/CI_PIPELINE.md): gitleaks's `--staged` semantics don't apply to a plain CI checkout and secret scanning is already handled correctly by the `security` job's gitleaks-action; the packet-envelope hook has 23 pre-existing violations representing a real, separately tracked architecture migration (PacketEnvelope -> TransportPacket), not a CI-config problem. 2. Fixed the "Run Mypy Type Checker" step in the lint job. It ran `mypy .` (whole repo) piped through `|| echo "... non-blocking"`, which silenced every result -- and `mypy .` itself has always failed immediately with "Source file found twice under different module names" (tools/auditors/base.py vs auditors.base) before checking a single file, so this step has effectively always been a no-op. Now runs the same scoped, verified-working invocation as `make lint` / ci-quality.yml (`mypy engine/ --config-file=pyproject.toml --ignore-missing-imports --exclude chassis`), with no silencing, so real type errors now fail the job. ci-gate's fan-in now also requires `precommit` and fails if it fails. Verified locally: `pre-commit run --all-files SKIP=gitleaks,packet-envelope-prohibited` exits 0 on the current tree (after the preceding commits in this PR); `mypy engine/ ...` exits 0. Co-authored-by: Igor Beylin <cryptoxdog@users.noreply.github.com> (cherry picked from commit f87b54e)
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
ℹ️ Ignored 92 generated/cache file(s) from size accounting. ❌ PR Too Large 📋 Best Practices for Large Changes
🚫 This PR is blocked until reviewable size limits are met. |
- Remove legacy tools/check_packet_envelope_prohibited.py (23 stale refs, drifting regex) - Rewire ci.yml validate job, terminology-guard.yml, and pre-commit to the SDK scanner - Add tools/packet_envelope_gate.py: thin pre-commit wrapper delegating to l9-ci-sdk - Add .l9/baselines/packet-envelope.yml: 19 owned PacketEnvelope debt entries (issue #138) - Add .l9/baselines/test-quarantine.yml: 39 owned failing-test entries (issue #139) - Add .github/workflows/baseline-ratchet-caller.yml: thin caller pinned to l9-ci-core@8e3d74d3 / l9-ci-sdk@d8ec01f1, fail-closed - CODEOWNERS: real owner (@cryptoxdog); .l9/baselines/** requires owner review - All debt entries expire 2026-10-21 with machine-evaluable removal conditions
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v6 |
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v5 |
|
|
||
| - name: Install Runtime + Dev Dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip |
| # Needed for the "language: system" local hooks (pytest-unit, | ||
| # deprecated-import checks, etc.) which shell out to the ambient | ||
| # `python3` rather than an isolated pre-commit-managed env. | ||
| pip install -r requirements.txt |
| # deprecated-import checks, etc.) which shell out to the ambient | ||
| # `python3` rather than an isolated pre-commit-managed env. | ||
| pip install -r requirements.txt | ||
| pip install -r requirements-dev.txt |
| pip install -r requirements-dev.txt | ||
|
|
||
| - name: Run Pre-commit Hooks | ||
| uses: pre-commit/action@v3.0.1 |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| "docs/CI_PIPELINE.md (baseline ratchet).", | ||
| file=sys.stderr, | ||
| ) | ||
| except (json.JSONDecodeError, ValueError): |
- First ratchet run (29972728543) truthfully surfaced 22 docker-dependent tests erroring in CI with AttributeError: 'GraphDriver' object has no attribute 'execute_write' (invisible in sandbox where docker is absent). Added to .l9/baselines/test-quarantine.yml with CI fingerprints, owner, expiry 2026-10-21, removal_condition test-passes (61 entries total; issue #139 amended). - Re-pin l9-ci-core to 12efdc25 (PR Quantum-L9/l9-ci-core#39): fixes --exclude-dir semantics so the provisioned SDK under .l9/runtime is excluded from the PacketEnvelope scan (removes 6 spurious findings).
… core f5d6570 Round-2 remediation from run 29973174988: - Adopt l9-ci-sdk b390dc7 (bare-hex normalization): run-random object IDs (ContractViolation[gs_<32hex>]) and content hashes no longer churn test-failure fingerprints; 29 quarantine fingerprints recomputed under the new normalizer. - Replace 2 env-dependent signatures with the CI-observed truth (engine/ dir-listing order; OPENAI_API_KEY absent on runners). - Drop duplicate wave6 entry introduced by the round-1 CI append (duplicate fingerprints are malformed per the comparator). - Re-pin caller to l9-ci-core f5d6570 (SDK bump) and bump the pre-commit gate wrapper SDK revision to match. Ledger: 60 entries (39 call-failures + 21 GraphDriver.execute_write setup errors). Both ledgers validate; local compare-scan PASS (19/19).
Round-3 remediation from run 29973857555 (58/61 matched):
- 2 set-iteration-order signature diffs (sandbox rendered
{'handlers.py', 'boot.py'}; CI renders {'boot.py', 'handlers.py'}):
adopt CI rendering, fingerprints verified equal to the run-3
observed values.
- Add the missed 22nd GraphDriver.execute_write entry
(tests/performance/test_sync_throughput.py incremental-update
throughput), fingerprint verified against the run-3 observation.
Ledger: 61 entries; validate-ledger passes; ledgered fingerprint set
now exactly equals the CI-observed set (61/61, zero diff both ways).
…malization) Adopts l9-ci-sdk#20 via l9-ci-core#41/#42: rendered set literals in failure signatures are canonicalized, so the two chassis-contract quarantine fingerprints are now stable regardless of hash-seed- dependent set iteration order (ratchet runs 29973857555 vs 29974211074 rendered opposite element orders). No ledger changes needed: existing fingerprints already match the canonical (sorted) rendering. Local verification: validate-ledger PASS (61 quarantine, 19 packet-envelope), compare-scan PASS 19/19 known, 0 new.
…sis dep - tools/packet_envelope_gate.py: pass --exclude-dir .l9 (scanner matches single path parts; '.l9/runtime' never matched), preventing the provisioned SDK source from polluting the PacketEnvelope scan in the pre-commit hook. Mirrors l9-ci-core#39. - requirements-dev.txt: add hypothesis (tests/property/* hard-import it; the precommit job installs only requirements.txt + requirements-dev.txt, causing 2 collection errors in the pytest-unit hook). The remaining pytest-unit hook failure (test_chassis_app noop_lifecycle) is pre-existing ledgered debt (.l9/baselines/test-quarantine.yml, #139).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stack position 9/9 (base:
fix/action-refs, PR #136). Extracts the clean, reviewable pieces of draft #126 per the remediation plan, so #126 can be closed without merging its 108-file wholesale diff.What is extracted from #126
.hypothesiscache untracking.hypothesis/cache files (already gitignored); pure deletionsci-quality.ymldocs/CI_PIPELINE.mdrewrite for pre-commit-in-CI, blocking mypy, quality-gate fixcontracts.ymlmypy aligned topyproject.tomlconfig;docs-code-sync.ymllink checker rewritten (correct relative-link resolution, aggregated failures, no silent subshell exits);pr-review-enforcement.ymlexcludes generated/cache files from size accounting and hardens config parsing;terminology-guard.ymlenforces on changed files so new debt blocks without punishing PRs for legacy debtprecommitjob inci.yml(Phase 2.5), wired into theci-gatefan-in as a blocking checkWhat is deliberately NOT preserved
SKIP=packet-envelope-prohibitedis removed. The pre-commit job skips onlygitleaks(index-based hook with no CI equivalent; covered by thesecurityjob). The 23 pre-existing PacketEnvelope references will keep this job honestly red until the CI baseline-ratchet system (R1–R6) lands with a per-finding fingerprint ledger. Blanket-skipping would hide new violations, not just known ones. Documented inci.ymlanddocs/CI_PIPELINE.md.Verification
yaml.safe_loadon every file in.github/workflows/)..hypothesisfiles changed; the remaining 92 are pure cache deletions thatpr-review-enforcement.yml(in this very PR) now excludes from size accounting.Supersedes the remaining content of #126, which should be closed.