chore(repo): retire inherited Stoplight CI and org references - #17
Merged
Conversation
Every workflow in this fork was filtered to branches that do not exist here. commit.yml ran on pull requests targeting `develop`, post-develop-merge.yml on pushes to `develop`, and markdown-links.yml on `master` or `develop`. This repository's default branch is `main`. The result was that no test, no lint and no build has ever run on this fork — all 27 Actions runs to date were the inherited Jira integration firing on issue labels. That Jira workflow called a reusable workflow out of `stoplightio/.github` at `@master`, with `secrets: inherit`, on every issue label event. An organization that does not maintain this code controlled code that ran in this repository with this repository's secrets in scope. It is deleted. Also retired: FUNDING.yml, which pointed sponsorship at upstream's Treeware listing; the CODEOWNERS entries, which named an unresolvable Stoplight team plus three AsyncAPI maintainers who never agreed to review pull requests here; and the Code of Conduct, which routed harassment reports to a repository this project does not control. Attribution to Spectral is unchanged and stays in the README, the LICENSE and the git history. This removes routing that did not work, not the lineage. Refs #15, #10, #9 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 3, 2026
kinlane
commented
Aug 3, 2026
kinlane
left a comment
kinlane
left a comment
Contributor
Author
There was a problem hiding this comment.
LGTM - more needed house keeping.
kinlane
added a commit
that referenced
this pull request
Aug 3, 2026
Option 1 from #33. Workflows and composite actions were the one category of file nothing verified, because the pull_request trigger ignored .github/** — so the riskiest edits in the repository were also the only unreviewed-by-machine ones. On 3 August that shipped three CI configuration changes to main without a single check running, and two of them were wrong: #17 retired the inherited workflows no CI ok #31 safe.directory, cache keys, test-windows no CI WRONG (host path in a container) #32 the upstream watcher no CI WRONG (same bug, caught by hand) Both were found by manually triggering things afterwards. That is not a system, and there is no reason to expect it to hold. The cost is a full matrix run when a workflow comment changes. At this volume that is a few minutes and worth it. Note the setting is defensible upstream, where the pull request volume is far higher — it is wrong here, which is a good reminder that inherited configuration can be correct in its original home and wrong in this one. README.md stays ignored, per the decision on #33. This also unblocks the required-status-checks criterion in #10: with .github/** ignored, a pull request touching only workflows would never report the Commit check, and a required check that never reports leaves the pull request permanently unmergeable. Closes #33 Refs #10, #29, #16 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #16. Refs #15, #10, #9.
The finding and the evidence are in #16. This is the fix.
Workflows
jira-issue-label-added.yaml— calledstoplightio/.github/...@masterwithsecrets: inheriton every issue label event. The only workflow that has ever run here, 27 times.commit.yml—pull_requestfilterdevelop→main. This is what makes CI exist at all.post-develop-merge.yml→post-main-merge.yml,pushfilterdevelop→main.markdown-links.yml—pull_requestfiltermaster/develop→main.Org references that routed to the wrong people
.github/CODEOWNERS— was* @stoplightio/oss-spectral, a team GitHub cannot resolve from this org, so review requests silently went nowhere. It also named@magicmatatjahu @smoya @jonaslagonion the AsyncAPI rulesets — real maintainers who never agreed to review pull requests on this fork and would have been pinged by it. Their work stays credited in NOTICE and the git history; a file that pages them is the wrong place for it..github/CODE_OF_CONDUCT.md— was the Stoplight Community Code of Conduct, routing harassment reports to a repository this project does not control. Replaced with Contributor Covenant 2.1 and a reporting address that reaches a maintainer. The commitment is unchanged; the address now works..github/FUNDING.yml— pointed sponsorship at upstream's Treeware listing. Deleted rather than retargeted; there is no funding destination to name yet, and inventing one would be worse than having none.Note on scope
Attribution to Spectral is untouched. This removes routing that did not work, not the lineage — the README, the LICENSE and the git history all still say where this came from, and #9's NOTICE says it more explicitly.
commit.ymlhaspaths-ignore: .github/**, so this pull request will not itself trigger it. The first PR that touches code will be the real test, and that result belongs in #3.