Replies: 2 comments 1 reply
-
Beta Was this translation helpful? Give feedback.
1 reply
-
|
📋 Initiative planned by the BMAD Scrum Master (Bob). Epic #684 — Tag-based release pinning for ALL first-party reusable workflows + org-wide compliance enforcement 6 stories created (inert — labelled
Open questions for review:
Review the epic and its sub-issue DAG, adjust as needed, then add |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Problem
First-party reusable workflows are pinned inconsistently. Concretely,
ci-failure-analyst-reusable.ymlis pinned to off-mainSHAs with inaccurate# mainannotations — verified onmain@a682741:main?db60a41…(old)fix/action-sha-pinning(unmerged)0ef7b615…(new, now on main via #640 + #520)fix/action-sha-pinning(unmerged)Result: the lock file,
templates/ci-failure-analyst.yml, anddocs/aw/ci-failure-analyst.mdall pin a commit that was never merged, and consumers copying the template inherit an off-main pin. The pr-review agent flagged this on #520 (MEDIUM, needs-human).The agreed direction
Adopt tag-based release pinning + release versions for all reusable workflows — the standard already defined in
petry-projects/.githuband adopted by dev-lead (@dev-lead/stable,dev-lead/vX.Y.Z) and pr-review (@pr-review/stable). Replace SHA-# mainpins with channel/version tags backed bycut-release.sh-style cuts.Scope
# main(e.g.ci-failure-analyst, and any others under.github/workflows/*callers +templates/*+docs/aw/*)..githubstandard.# mainSHA pins.tests/dev-lead/integration/test_auto_rebase_stub.py,test_dependency_audit_stub.py) so a SHA/off-main pin can't merge for any reusable — make tag-pinning a CI-enforced standard, not per-workflow bespoke tests.petry-projects/.githubstandards + downstream callers).Deliverables
.githubcovering all reusables (not just dev-lead/pr-review).Open questions (for ideation)
@<name>/stable+vX.Y.Z) or per-tier?cut-release.shby OrganizationAdmin, as today, vs. a release workflow)?ci-failure-analystpin (repin to an on-main SHA now, or fast-track its first tag)?Originally filed as a bug from PR #520's pr-review finding; reframed per maintainer as an initiative covering all reusable workflows + compliance.
Beta Was this translation helpful? Give feedback.
All reactions