fix(health-74): re-baseline 7 stale template-drift allowlist entries by stranske · Pull Request #2397 · stranske/Workflows

stranske · 2026-06-15T04:23:33Z

Source: Issue #2394

Automated Status Summary

Scope

What

P2b of the Dependabot→Renovate fleet migration: get the consumer fleet onto the shared preset (not generic Mend onboarding configs), and make the agent CI renovate[bot]-aware.

Distribution

Context for Agent

Related Issues/PRs

#2389
#1378

Tasks

templates/consumer-repo/.github/renovate.json (new) — 2-line config extending github>stranske/Workflows//renovate-presets/fleet.
sync-manifest.yml — create_only entry so maint-68 distributes it to consumers on the next sync. This is the point: consumers get the fleet preset (dev-tool exclusions owned by autofix-versions.env, grouped automerge-on-green, the vendored-minimatch cascade) instead of Renovate's generic config:recommended onboarding — which would otherwise fight autofix-versions.env over ruff/black/etc.

Acceptance criteria

agents-keepalive-loop.yml — the fingerprint step routes dependabot[bot]/renovate[bot] PRs to the existing should_run=false path before the authenticated API calls that 403 on the restricted bot-PR token. This reaches an already-handled state early; normal (human/agent) PRs are untouched.
maint-dependabot-auto-label.yml — also label renovate[bot] PRs agents:allow-change.
keepalive-runner.js — add renovate to NON_ASSIGNABLE_LOGINS.
sync_dependabot_campaign.js — campaign PR detector also matches renovate[bot] + renovate/ branches (+ test), kept under the dependabot classification for backward compat.

Head SHA: a89dbc7
Latest Runs: ✅ success — Gate
Required: gate: ✅ success

Workflow / Job	Result	Logs
Gate	✅ success	View run
Health 40 Sweep	❔ startup failure	View run
Health 44 Gate Branch Protection	❔ in progress	View run
Health 45 Agents Guard	✅ success	View run
Health 50 Security Scan	✅ success	View run
Health 52 Semgrep Scan	✅ success	View run
Health 74 Template Drift	✅ success	View run
Maint 52 Validate Workflows	✅ success	View run
PR 11 - Minimal invariant CI	✅ success	View run
Selftest CI	✅ success	View run

Summary by CodeRabbit

Chores
- Updated configuration allowlist documentation to provide detailed explanations for intentional baseline deviations.

coderabbitai · 2026-06-15T04:23:42Z

📝 Walkthrough

Walkthrough

Updates config/template-drift-allowlist.txt by replacing the generic "Existing reviewed baseline drift" reason text with a detailed 2026-06-14 intentional divergence rationale for Health 74 allowlist pairs 1, 5, 7, 8, 9, 11, and 15. No SHA fingerprints are modified.

Changes

Health 74 Template-Drift Allowlist Reason Rebaseline

Layer / File(s)	Summary
Reason field updates for pairs 1, 5, 7, 8, 9, 11, 15 `config/template-drift-allowlist.txt`	Header comment and `reason` values for seven allowlist pairs are updated from the generic baseline-drift phrasing to a detailed description of the 2026-06-14 intentional divergence (consumer action pinning, LangSmith tracing env vars, root workflow floating tags, repo-internal concurrency, sparse-checkout). No `main_sha256` or `template_sha256` values are changed.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

stranske/Workflows#2402: Also modifies config/template-drift-allowlist.txt for the same Health 74 allowlist entries, updating fingerprint data for the same workflow pairs touched here.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR only addresses the Health 74 template drift re-baselining but fails to deliver multiple key coding objectives from `#2394`: consumer renovate.json creation, sync-manifest.yml updates, and renovate[bot] CI parity changes to workflows and scripts.	Implement the missing objectives: create templates/consumer-repo/.github/renovate.json, update sync-manifest.yml with create_only entry, and modify agents-keepalive-loop.yml, maint-dependabot-auto-label.yml, keepalive-runner.js, and sync_dependabot_campaign.js for renovate[bot] support.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: re-baselining 7 stale template-drift allowlist entries for Health 74, which is the primary focus of this PR.
Out of Scope Changes check	✅ Passed	The PR changes are scoped to re-baselining the template-drift allowlist file, which is directly related to the Health 74 template drift issues mentioned in the PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/health-74-template-drift-rebaseline

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

agents-workflows-bot · 2026-06-15T04:26:49Z

Automated Status Summary

Head SHA: 617e65b
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Updated automatically; will refresh on subsequent CI/Docker completions.

Keepalive checklist

Scope

What

P2b of the Dependabot→Renovate fleet migration: get the consumer fleet onto the shared preset (not generic Mend onboarding configs), and make the agent CI renovate[bot]-aware.

Distribution

Context for Agent

Related Issues/PRs

#2389
#1378

Tasks

templates/consumer-repo/.github/renovate.json (new) — 2-line config extending github>stranske/Workflows//renovate-presets/fleet.
sync-manifest.yml — create_only entry so maint-68 distributes it to consumers on the next sync. This is the point: consumers get the fleet preset (dev-tool exclusions owned by autofix-versions.env, grouped automerge-on-green, the vendored-minimatch cascade) instead of Renovate's generic config:recommended onboarding — which would otherwise fight autofix-versions.env over ruff/black/etc.

Acceptance criteria

agents-keepalive-loop.yml — the fingerprint step routes dependabot[bot]/renovate[bot] PRs to the existing should_run=false path before the authenticated API calls that 403 on the restricted bot-PR token. This reaches an already-handled state early; normal (human/agent) PRs are untouched.
maint-dependabot-auto-label.yml — also label renovate[bot] PRs agents:allow-change.
keepalive-runner.js — add renovate to NON_ASSIGNABLE_LOGINS.
sync_dependabot_campaign.js — campaign PR detector also matches renovate[bot] + renovate/ branches (+ test), kept under the dependabot classification for backward compat.

Copilot

Pull request overview

This PR restores Health 74 (Template Drift) to green by re-baselining (refreshing) stale allowlist fingerprints for intentional drift between selected root agents-*.yml workflows and their templates/consumer-repo/ counterparts, without changing any workflow/template content.

Changes:

Refreshed main_sha256 / template_sha256 fingerprints for 7 allowlisted workflow pairs whose normalized content changed since the last baseline.
Replaced generic “reviewed baseline drift” reasons with per-entry rationale documenting intentional divergence.
Added a dated header note describing why these entries were re-baselined instead of aligned.

+# The divergence is intentional, not a missing consumer improvement: consumer
+# template workflows SHA-pin third-party actions per the fleet action-pin contract
+# (docs/HISTORY.md, PR #1925) and carry LangSmith tracing env, while the root
+# Workflows-repo copies use floating major tags plus repo-internal concurrency +


-reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
+main_sha256 = 4dacff89dfef1ffadcd1e3d781aa8cc82bafa6433e3f0d65208f4576ffefe6bd
+template_sha256 = b6e4ff7bef753216bde90ccd4cc6e505b02a02df7be8b5aaa7e191077a1335d6
+reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.


-reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
+main_sha256 = 1448fe5a8c98cb7383bddf375eea1e39c4ad293cd35011634755b77783afff1a
+template_sha256 = 0687139513b4b148b1a792a652bdd55e13eef88fc661659f597c2506d967a7e7
+reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.


-reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
+main_sha256 = 66e1b7a23c0178d558c0e88f1c75de00f228d2eda23e7bb9c744a6fd909aaf5f
+template_sha256 = d64c0ed82527ed7aea9a85aa163659baa55d118a17a984b00cbb28fb18afe2dd
+reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.


-reason = Existing reviewed baseline drift; align the template or update this fingerprint deliberately.
+main_sha256 = 77ad66407906ed124fa29f2933d4a73e116e1b220d8197e2fc0dc709395394c9
+template_sha256 = c015cde7332ececa95ce064a47761f319009ee7b4c7fecc44759d26a906b4abb
+reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.


Health 74 "Check Template Drift" was RED on main: 7 of 15 allowlisted root->template workflow pairs had stale fingerprints, so they showed as unallowlisted drift (exit 1). They went stale after action-version bumps (#2391/#2394) and root feature work changed the normalized content of both sides without re-baselining. Each of the 7 was examined; all are intentional, bidirectional divergence rather than a missing consumer improvement: - consumer template workflows SHA-pin third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and carry LangSmith tracing env; - the root Workflows-repo copies use floating major tags plus repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv); - agents-63-issue-intake is additionally an alias-mapped Workflows-internal superset (~1.7k lines) vs the 216-line consumer intake template. Aligning the template to root would strip the contractually-required consumer action pins from all consumers, so the entries are re-baselined (fingerprints refreshed + documented reasons) rather than aligned. The 8 already-passing entries are untouched. Verified: scripts/check_template_drift.py --allowlist config/template-drift-allowlist.txt now reports 0 unallowlisted drift (15 allowlisted, 3 in sync), exit 0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> # Conflicts: # config/template-drift-allowlist.txt

Copilot AI review requested due to automatic review settings June 15, 2026 04:23

stranske temporarily deployed to agent-standard June 15, 2026 04:24 — with GitHub Actions Inactive

Copilot started reviewing on behalf of stranske June 15, 2026 04:24 View session

Copilot AI reviewed Jun 15, 2026

View reviewed changes

stranske force-pushed the fix/health-74-template-drift-rebaseline branch from 387a838 to a89dbc7 Compare June 17, 2026 02:59

stranske temporarily deployed to agent-standard June 17, 2026 02:59 — with GitHub Actions Inactive

stranske merged commit f6378d5 into main Jun 17, 2026
72 of 76 checks passed

stranske deleted the fix/health-74-template-drift-rebaseline branch June 17, 2026 03:01

coderabbitai Bot mentioned this pull request Jun 26, 2026

chore(deps): update stranske/workflows digest to a525e6e #2539

Merged

1 task

coderabbitai Bot mentioned this pull request Jul 7, 2026

fix: pin consumer LLM workflow installs #2730

Merged

This was referenced Jul 24, 2026

Re-baseline Health 74 template-drift fingerprints (fix red main) #2815

Merged

fix+harden: Health 74 template drift — restore green, then stop the weekly re-baseline churn #2816

Closed

This was referenced Jul 31, 2026

fix: port auto-label campaign guards to consumers #2851

Merged

fix(consumers): vendor config into the consumer LLM-client workflows #2861

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(health-74): re-baseline 7 stale template-drift allowlist entries - #2397

fix(health-74): re-baseline 7 stale template-drift allowlist entries#2397
stranske merged 1 commit into
mainfrom
fix/health-74-template-drift-rebaseline

stranske commented Jun 15, 2026 •

edited by stranske-keepalive Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

❌ Failed checks (1 warning)

Uh oh!

agents-workflows-bot Bot commented Jun 15, 2026 •

edited by stranske-keepalive Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

stranske commented Jun 15, 2026 • edited by stranske-keepalive Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Automated Status Summary

Scope

What

Distribution

Context for Agent

Related Issues/PRs

Tasks

Acceptance criteria

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

❌ Failed checks (1 warning)

Uh oh!

agents-workflows-bot Bot commented Jun 15, 2026 • edited by stranske-keepalive Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Automated Status Summary

Keepalive checklist

Scope

What

Distribution

Context for Agent

Related Issues/PRs

Tasks

Acceptance criteria

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

stranske commented Jun 15, 2026 •

edited by stranske-keepalive Bot

Loading

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

agents-workflows-bot Bot commented Jun 15, 2026 •

edited by stranske-keepalive Bot

Loading