ci(audit-self): warn-only trailer-backstop on staging→main promotions - #492
Merged
Conversation
The pr-commit-trailers backstop hard-fails on every staging→main promotion: the main..staging range (134 commits) inevitably includes trailerless commits (dependabot version bumps, merge commits), so the gate is permanently red and trains routine `gh pr merge --admin` override — the #discipline-theatre the project exists to prevent. Enforcement already happens at each feature→staging merge (this same job runs there); the promotion re-check is redundant. Make the two hard-enforce steps continue-on-error ONLY on promotion (head=staging && base=main). The steps still run and log violations (the record is preserved), but no longer block the job. All non-promotion PRs keep full hard enforcement. §1.7: forward-check applied — complies with no-paid-llm-in-ci (deterministic, no LLM in this gate) and reviewer-discipline (this enforcement edit is maintainer-reviewed via PR, not self-merged); backward-check sweep — relaxes only the promotion branch of pr-commit-trailers (.github/workflows/audit-self.yml:357), feature→staging enforcement unchanged, no other gate touched. Prior-art: skipped — CI workflow conditional edit (promotion exemption); no new capability, dependency, or code module added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
pr-commit-trailersbackstop (audit-self.yml) runs on every PR and hard-fails on commits lacking §1.7 / Prior-art trailers across<base>..HEAD. On a staging→main promotion that range is the whole accumulated history (134 commits for #488), which inevitably contains trailerless commits — e.g. dependabot621586aaa(bump esbuild and tsx, no trailers) and merge commits. So every promotion is permanently red and can only land viagh pr merge --admin.A gate that always fails and always gets overridden is
#discipline-theatre(the project's own anti-pattern) — it carries no promotion-relevant signal and erodes the override reflex.Fix
Add
continue-on-error: ${{ github.base_ref == 'main' && github.head_ref == 'staging' }}to the two hard-enforce steps. On a promotion the steps still run and log violations (the record is preserved), but no longer block the job. Every non-promotion PR keeps full hard enforcement — feature→staging is unchanged.This is safe because the same backstop already runs at each feature→staging merge, so promotion commits were enforced once already; the promotion re-check is redundant.
Scope: 2 lines + comments in one CI workflow file. No core enforcement code touched. Reviewer (maintainer) merges — enforcement file is maintainer-owned per the Artifact Ownership Contract.
§1.7 Forward-check applied
Checked against
no-paid-llm-in-ci(this gate stays deterministic — no LLM added),reviewer-discipline(the change is surfaced as a maintainer-reviewed PR rather than self-merged into the enforcement layer), anddoc-authority-hierarchy(CI workflow file — no Authoritative-for header required). Thecontinue-on-errormechanism is GitHub-native; no new dependency or module. The promotion condition (base=main && head=staging) cannot match feature→staging or any consumer PR.§1.7 Backward-check applied
Supersedes nothing; relaxes only the promotion path of
pr-commit-trailersat.github/workflows/audit-self.yml:357. Theci-successaggregate (audit-self.yml:700) stillneeds:this job — on promotion the job now resolvessuccess, so the aggregate goes green honestly. No other job, and no feature→staging enforcement, is affected. The trailer "record" purpose of the backstop is preserved (steps run + log on promotion); only the redundant block is removed.