Repository navigation
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The regex-only workflow guard could miss YAML trigger forms. Parse YAML with pinned PyYAML, reject automatic events and unsupported alias/merge/document/tag constructs, and check every workflow before publication. Jenkins installs its existing Python CI environment before running the guard and its fixtures.
Add a local/Jenkins ancestry helper that verifies full commit IDs, checkpoint membership in the pinned campaign, and the exact non-first checkpoint merge parent. Replacement refs and graft files cannot fabricate that ancestry. Include the pinned 933-commit inventory, per-batch machine ledger, plan, explicit CI discovery gap, and the existing canonical-ledger cross-reference.
Validation: all 18 workflow files passed; four policy tests (multiple positive/negative YAML fixtures), six ancestry tests (including incremental checkpoints, wrong parents, replacement refs and grafts), ledger uniqueness/count checks, and git diff checks passed. CodeRabbit did not run because saved credentials were unavailable; parent source review corrected the incremental-target and YAML-merge cases. Jenkins full qualification remains pending. No Actions workflow was dispatched.
Stacked draft: depends on security PR #27; this PR targets its branch and cannot be merged independently. Subsequent upstream integration targets this branch. No automatic PR merge or main push is authorized. Initial AW worker evidence is preserved, but its missing acceptance binding left lifecycle acceptance pending; source verification and CI gates are recorded separately.