feat(governance): require central Noema review#613
Open
seonghobae wants to merge 4 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the org-wide governance contract around the “CWL Central required workflows” ruleset by making the existing fail-closed Noema review workflow a required check, tightening the audit to enforce an exact two-approval policy, and expanding the scheduled audit to cover all repositories visible to the audit credential (not public-only). This keeps the repo’s ruleset-audit code/tests/docs aligned with the live organization ruleset configuration.
Changes:
- Add
.github/workflows/noema-review.ymlto the central required workflow list and extend audit tests to detect drift for the Noema workflow. - Update ruleset audit expectations: enforce exactly two approving reviews; align repository exclusions and inherited-scope probes (including
IRT-bibliography-set, restoring Argos inheritance). - Expand the scheduled ruleset audit repository enumeration from
type=publictotype=alland update rollout documentation accordingly.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
tests/test_central_required_workflow_ruleset_audit.py |
Updates expected ruleset payload, exclusions, inherited-scope probes, and adds a targeted drift test for the Noema required workflow. |
scripts/ci/audit_central_required_workflows.py |
Aligns the live-audit contract with the updated ruleset: adds Noema workflow requirement, updates exclusions, and requires exactly two approvals. |
docs/org-required-workflow-rollout.md |
Documents Noema as an active required workflow, two-approval policy, all-repo scope, and current rollout evidence. |
.github/workflows/audit-central-ruleset.yml |
Updates scheduled audit to enumerate org-visible repositories (type=all) and adjusts messaging to “organization” scope. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/central-noema-required-workflowcannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/central-noema-required-workflow, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 613 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-noema-required-workflow
# rebase path only: git push --force-with-lease origin HEAD:fix/central-noema-required-workflow- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
d5138ead01c23d06600298e3089d656dcddda6ae - Workflow run: 29962146730
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 613 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-noema-required-workflow
# rebase path only: git push --force-with-lease origin HEAD:fix/central-noema-required-workflow
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Merge Conflict Guidance
gh pr checkout 613 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-noema-required-workflow
# rebase path only: git push --force-with-lease origin HEAD:fix/central-noema-required-workflow |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
noema-review.ymlas the seventh organization required workflow.github,noema, andIRT-bibliography-setscopeLive evidence
18156473is active with exactly seven required workflows and exactly two approving reviews; stale-review dismissal, last-push approval, and thread resolution remain enforcedtype=allaudit covered 41 accessible repositories: only the three intended exclusions are not inherited, while all other 38 repositories inherit the rulesetContextualWisdomLab/argos#299now inherits the central ruleset; its already-open PR needs a new natural PR event before the newly required workflow is scheduledContextualWisdomLab/clearfolio#161has an exact-current-head Noema App approval on4512fb9e9b56ab95df3acd85ebec2e6b849335a7Validation
actionlintpython3 -m pytest -q— 635 passed