Repository navigation
fix(ci): no gate enforces the workflow policies — PR triggers, workflow_dispatch, and per-job timeouts are convention only #1406
Description
Problem
Two workflow policies in this repo are enforced by nothing but memory:
- No-PR-trigger policy (Drew, 2026-11-02; commit
0c4ea315ed, PR ci: add workflow_dispatch where missing (no-PR-trigger policy) #1401): "CI never runs on pull requests; workflows run on push to main, on schedule, or by manual dispatch." That change only addedworkflow_dispatchto the four workflows that lacked it — it added no check that the policy stays true. - Per-job
timeout-minutesrule (CI: add timeout-minutes caps to every job in every workflow #61): already regressed twice and caught manually both times — fix(ci): test.yml's ci-fix job has no timeout-minutes — per-job gap the file-level check cannot see (#61 rule) #1326 (test.yml's ci-fix job, "per-job gap the file-level check cannot see") and fix(ci): branch-cleanup workflow job has no timeout-minutes — the one runnable job that regressed #61's cap rule #1184 (branch-cleanup job, "the one runnable job that regressed CI: add timeout-minutes caps to every job in every workflow #61's cap rule").
The repo's other house rules all have regression gates for exactly this reason (script/check-bounded-http.ts, check-proto-reads.ts, check-numeric-boundaries.ts, check-doc-env-vars.ts, wired as steps in .github/workflows/test.yml — "or the class regrows one call at a time"). None of them looks at .github/workflows/ at all: grep -rn "timeout-minutes|workflow_dispatch|pull_request" script/*.ts returns no hits.
Evidence (verified 2026-11-02 on main 424c8d6f18)
All 29 workflows currently comply — this is a missing regression net, not a live violation:
- 0 workflows declare a
pull_requestorpull_request_targettrigger. - 29/29 workflows declare
workflow_dispatch. - 0 non-reusable jobs are missing
timeout-minutes(jobs withuses:excluded — reusable-workflow caller jobs cannot take the key, cf. fix(ci): test.yml's ci-fix job has no timeout-minutes — per-job gap the file-level check cannot see (#61 rule) #1326's agents.yml note).
A new or edited workflow that adds a PR trigger, omits workflow_dispatch, or omits a job timeout would pass every existing gate and ship silently.
Acceptance criteria
- A new gate in the house shape —
script/check-workflows.ts+script/check-workflows.test.ts+ acheck:workflowspackage.json script + test.yml steps mirroring the other gates — fails (exit 1, naming workflow + job/rule) when any workflow:- declares a
pull_requestorpull_request_targettrigger, - lacks
workflow_dispatch, or - has a job without
timeout-minutes(jobs using a reusable workflow viauses:exempt).
- declares a
- The gate passes clean on the current 29 workflows.
- Trigger matching is exact-key:
pull_request_review_comment(opencode.yml) andissue_commentare comment triggers, not PR CI triggers — the ci: add workflow_dispatch where missing (no-PR-trigger policy) #1401 policy commit counted the repo as compliant with those present, and the gate must not flag them. - The YAML handling copes with the real files:
on:is boolean-true under YAML 1.1 parsers, and triggers appear in string, list, and map forms across the 29 files (tests pin at least the map and list forms plus theon:quirk). - Gate tests cover one synthetic violation of each rule and the compliant-tree case.
Out of scope (possible follow-on dispositions, not this gate unless triage disagrees): concurrency queue: max rules (#151/#156/#179 family) and top-level permissions: (#118).
Related: #1401 (policy), #61 / #1326 / #1184 (timeout rule and its manual catches), #1127 / #865 / #995 (the gate pattern this follows).
Activity
dezren39 commentedon Nov 2, 2026
🤖 Agent note · filed
3 remaining items
Merge pull request #1415 from developing-today/queue/6371-1406-check-…
dezren39 commentedon Nov 2, 2026
Implemented and merged in PR #1415 (merge commit
a8762eb1ad354f260e5840409db66e728038a39d, head1a2f3a201b0193004877d36923c22b23a69a2467).script/check-workflows.ts+script/check-workflows.test.tsin the house gate shape: fails naming workflow + job/rule on apull_request/pull_request_targettrigger (exact-key matching —pull_request_review_comment/issue_commentare not flagged), a missingworkflow_dispatch, or a non-reusable job withouttimeout-minutes. YAML handling covers string/list/map trigger forms and theon:-as-boolean-true quirk.check:workflowsin rootpackage.json; gate test + gate steps in.github/workflows/test.ymlmirroring the other gates.bun test check-workflows.test.ts— 12 pass, 0 fail;bun run check:workflows— exits 0 on all 29 workflows. Codex review on the merged head: completed,has_any_findings=false,has_unresolved_findings=false. CodeRabbit was rate-limited (NEUTRAL, no findings).Closing as completed by #1415.