Skip to content

ci: the resolver reads the low-risk file names from ci.json (ADR-1131) - #982

Merged
github-actions[bot] merged 1 commit into
mainfrom
ci/resolver-reads-ci-json
Nov 11, 2026
Merged

ci: the resolver reads the low-risk file names from ci.json (ADR-1131)#982
github-actions[bot] merged 1 commit into
mainfrom
ci/resolver-reads-ci-json

Conversation

@cdeust

@cdeust cdeust commented Nov 11, 2026

Copy link
Copy Markdown
Owner

What

The post-merge resolver no longer hardcodes the Dependabot low-risk file names (ADR-1126). It reads them from ci.json, key low_risk_files; for Cortex: ["uv.lock", "pyproject.toml"].

  • The list is read from the default branch through the contents API, so a pull request cannot change its own tier.
  • It is read only for pull requests opened by dependabot[bot].
  • A missing file, missing key, invalid JSON or malformed list ends the resolver red. There is no built-in list.
  • Files match by basename in any directory; a path under .github/ is never low-risk.
  • The contract job of pipeline.yml and pipeline-post-merge.yml accepts the new key and reports it when missing or malformed.
  • Two stale comments are corrected: the resolver header named a review job that no pipeline has, and the tag job pointed to .github/workflows/ci.yml, which no longer exists.

Why

Owner decision of 2026-11-10: the CI is the same in every repository and Cortex is the source. The low-risk file names were the only lines of the resolver that differed between repositories. Recorded in ADR-1131, with the rejected alternative (moving the required job names to ci.json would let a repository weaken its own merge gate).

Checks

  • Resolver test files: 55 passed, 44 subtests passed.
  • tests_py/infrastructure/test_project_wiki_mirror.py: 38 passed.
  • ruff check, ruff format --check, scripts/check_craftsmanship.py: clean.
  • The three workflow files parse as YAML.
  • tests_py/scripts as a whole, local: 1981 passed, 6 failed. The 6 are in test_ci_mutation_scope.py (No module named 'ci_mutation_lines' in a temporary copy) and fail the same way locally without this change; they pass in CI on main.

Not verified

No live run of the contents-API read: it is covered by fakes only. The first Dependabot pull request after the merge exercises it.

Follow-up, not in this pull request

Each sibling repository takes these files together with its own low_risk_files in ci.json.

Generated by Claude Code

@claude
ci: the resolver reads the low-risk file names from ci.json (ADR-1131)
c66316c 
The resolver of pipeline-post-merge.yml held Cortex's dependency file names
(uv.lock, pyproject.toml), so the file could not be copied to another
repository as it is. The names move to a new required ci.json key,
low_risk_files, read from the default branch through the contents API. A
missing file, a missing key or a malformed list fails the resolver: no list
is built in.

A changed file is matched by its file name in any directory, and a path
under .github/ is never low risk, as the sibling repositories already do.

The ci.json validator embedded in the contract job of pipeline.yml and
pipeline-post-merge.yml accepts the key and reports its absence.

Comments: pipeline-post-merge.yml no longer lists a review job the pipeline
does not have, and pipeline.yml no longer points to .github/workflows/ci.yml,
which is gone.

Owner decision 2026-11-10: every repository's CI is identical to Cortex's.

Co-Authored-By: Claude Fable 5.2 <[email protected]>
Claude-Session: https://claude.ai/code/session_018kyZYrKg46KKYpvLPXcW4M
Signed-off-by: Claude <[email protected]>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T05:33:57.566123Z c66316c PR opened
🔒 Security Review ✅ Completed 2026-11-11T05:35:34.285482Z c66316c PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@claude

claude Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @cdeust's task in 2m 18s —— View job

Review of PR #982 (review 1 of 3)

I found no Blockers.

  • A PR cannot change its own tier. ci.json is read from the default branch.
  • Every failure stops the run. A missing file, a missing key, invalid JSON, a malformed list and an HTTP error all end the resolver red.
  • Matching by file name does not open a new path. The commit must still be a single, verified commit from Dependabot.

The review comment has three Notes, none of which need action before merge.

Verdict: approve

@claude

claude Bot commented Nov 11, 2026

Copy link
Copy Markdown

Review 1 of 3: PR #982

I found no Blockers. Five reviewer agents ran: code quality, performance, test coverage, documentation and security. I checked their findings against the diff.

What I checked and found sound:

  • A PR cannot change its own tier. The resolver reads ci.json through the contents API without a ref, so it always gets the default branch. A PR that edits ci.json is not low-risk itself, so it goes through review.
  • Every failure stops the run. A 404 or 403 raises PostMergeError in GitHub.request. Invalid base64, UTF-8 or JSON raises a ValueError, which is caught. A file over 1 MB comes back with encoding: "none" and is refused by the require. None of these messages start with the WAITING prefix, so the resolver ends red and nothing merges without review.
  • Matching by file name does not open a new path. The commit must still be a single commit authored by Dependabot, committed by web-flow and verified. dependabot.yml declares uv only at directory: "/". A rename is checked under both its old and new name, so renaming a file out of .github/ is still refused.
  • The two validators match. _low_risk_faults is the same in pipeline.yml and pipeline-post-merge.yml, and a test checks that. The resolve job has the contents permission the read needs.

Notes, no action before merge

  • test_ci_low_risk_tier.py:125: the only rename test renames a file out of .github/, so it never reaches the file-name check. A test that renames mcp_server/server.py to uv.lock would pin that previous_filename is still checked.
  • CHANGELOG.md:195: "can be copied to the other repositories as they are" overstates. Both workflows still need scripts/tests/test_no_main_comparison.py and .github/claude-cli, which the "Not done here" section of ADR-1131 acknowledges.
  • pipeline-post-merge.yml:424: the list comes from the default branch, but the resolver checks that the PR base is main. Adding ?ref=main would keep the two the same if the default branch were ever renamed.

View job run
Verdict: approve

@github-actions
github-actions Bot merged commit bbe537b into main Nov 11, 2026
18 checks passed
This was referenced Nov 11, 2026
Merged
Merged
Merged
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cdeust @claude