fix: converge governance gates and cognitive security contracts#22333
fix: converge governance gates and cognitive security contracts#22333BrianCLong wants to merge 43 commits intomainfrom
Conversation
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Important Review skippedToo many files! This PR contains 160 files, which is 10 over the limit of 150. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (160)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 30bec66f5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| import path from 'node:path'; | ||
| import { parseArgs } from 'node:util'; | ||
|
|
||
| import { sha256Buffer, stableStringify } from '../../lib/admissibility.ts'; |
There was a problem hiding this comment.
generate-admissibility-bundle.ts imports sha256Buffer and stableStringify from lib/admissibility.ts, but that module currently exports only evaluateAdmissibility and types. As a result, invoking this script fails at module load time (missing named exports), so the admissibility bundle generator cannot run in CI or locally until those exports are added or the import is corrected.
Useful? React with 👍 / 👎.
| const input = fs.readFileSync(file, "utf8"); | ||
| const result = spawnSync( | ||
| "python3", | ||
| [ |
There was a problem hiding this comment.
This verifier shells out to python3 and imports yaml, but the workflows that call it install Node dependencies only and do not install Python packages. On runners that do not already have PyYAML preinstalled, the check exits before doing any contract validation, which blocks required CI gates (pr-gate/ci-guard) for reasons unrelated to policy drift.
Useful? React with 👍 / 👎.
| {"context": "ci-guard / attestation-bundle-verifier"}, | ||
| {"context": "merge-surge / merge-queue"}, | ||
| {"context": "merge-surge / pr-fast"}, | ||
| {"context": "security-gates / gate"} |
There was a problem hiding this comment.
The applied branch-protection payload now omits pr-gate / gate even though the canonical required-check sources in this same change set include it. Running this script will therefore push a weaker protection policy than intended and immediately create drift against the repository’s required-check contracts.
Useful? React with 👍 / 👎.
Pull request was closed
1 participant
Supersedes closed #22319. Continuing governance and CI convergence on the live branch tip. Branch-triggered workflow runs on fix/golden-main-governance-convergence-20260331 are the authoritative signal while checks settle on the new PR object.