Repository navigation
feat(governance): migrate remaining required workflows to maintained automation - #676
Conversation
Code coverage overviewLanguages: Go, C# Go / code-coverage/test
C# / code-coverage/dotnet
Go / code-coverage/go
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
Validated head The regression first failed against the old policies, then passed after complete backfill and the reviewed source switch. It compares every declared policy field with the observed state, permitting only the maintained repository source and required provider encodings. It also rejects an additional undeclared legacy source. All 113 refusal controls, both template-specific guards, the existing trusted-regression guard and all fourteen baseline commands pass; shellcheck passes on the changed tests. Self-review: selectors, default-branch scope, bypasses, creation behavior, workflow paths and refs are preserved. The four imported rules gain Update only after their complete observations; they gain no Create, Delete or LateInitialize authority. The two existing managed template rules retain their previous lifecycle. No direct settings write or new integration is involved. This is source/configuration evidence, not a native migration receipt. After publication, independently read back all changed rules and exercise an ordinary qualifying consumer PR per rule with the actual required jobs selected and completed. Keep #237 open until those gates pass, and keep the legacy repository available throughout consumer migration. |
@coderabbitai review |
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (11 skipped: 1… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description check The description states that the six remaining required-workflow policies move from the legacy automation repository to maintained automation while preserving protections and repository scope. This dir… Title check The title clearly summarizes the main change: migrating the remaining required workflows to maintained automation. It is concise, specific, and relevant to the changeset. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description states that the six remaining required-workflow policies move from the legacy automation repository to maintained automation while preserving protections and repository scope. This directly matches the changeset.
-
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (11 skipped: 11 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 Checkov (3.3.20)
-
deploy/organization-rulesets/kustomization.yaml
-
Checkov retry budget exhausted before isolating this batch
-
Warning
CI annotation context is incomplete: annotation collection unavailable or limited
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Current-head readiness supplement: The runtime effect remains deliberately gated after publication: complete native policy readback and ordinary qualifying consumer PR execution per rule are still required by #237. No caller migration or repository deletion is authorized by configuration evidence alone. The reviewed ruleset tests exercise rendered desired policies and 113 refusal mutations; this PR changes configuration consumed by reconciliation rather than directly modifying live settings. |
1 participant
Why
Required checks still depend on the legacy automation repository, preventing its safe deletion.
What
Move the remaining six required-workflow policies to maintained automation while preserving their existing protections and repository scope.
Part of #237