From 59daaf6eb7a9d1c36678124df3db4f74b68e56b5 Mon Sep 17 00:00:00 2001 From: Menglin Li Date: Sat, 27 Jun 2026 21:00:43 +0800 Subject: [PATCH 1/3] =?UTF-8?q?cleanup:=20docs=20(onboarding-checklist.md)?= =?UTF-8?q?=20=E2=80=94=20strip=20dead=20notify=20refs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/onboarding-checklist.md | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/docs/onboarding-checklist.md b/docs/onboarding-checklist.md index 07dfa4a..ab388df 100644 --- a/docs/onboarding-checklist.md +++ b/docs/onboarding-checklist.md @@ -10,33 +10,22 @@ | # | Requirement | Why | |---|---|---| | 1 | **Enable Dependency Graph** (Settings → Code security) | `reusable-dependency-review` hard-fails without it | -| 2 | Secrets available: `OCTO_BOT_TOKEN`, `PROJECT_TOKEN`, `TRIAGE_WEBHOOK_URL` | IM notify, board writes, triage agent. `TRIAGE_WEBHOOK_URL` is an org-level secret. | -| 3 | Know your repo's **IM `project_group_id`** (32-hex) | `octo-ci-status` / `octo-pr-review-feed` route to it; each repo has its own | -| 4 | Your main CI workflow is named **`CI`** | `octo-ci-status` matches it via `workflow_run` | +| 2 | Secrets available: `PROJECT_TOKEN` | board writes | ## Starter templates (recommended) Pick from Actions → New workflow: - **Octo — Security suite** — weekly CodeQL + per-PR dependency-review + secret-scan (set `language`) - **Octo — Repo governance** — history-check, pr-title-lint, labeler, stale -- **Octo — Issue automation** — welcome + add-to-board + IM notify + triage webhook - **Octo — Release drafter** — rolling draft release -## Known gotchas (learned from the cc-channel-octo onboarding experiment) - -1. **`octo-issue-notify` MUST forward `TRIAGE_WEBHOOK_URL`.** The older caller - template only passed `OCTO_BOT_TOKEN`, so the triage webhook was silently - skipped and the agent never ran. The `secrets:` block must include: - ```yaml - secrets: - OCTO_BOT_TOKEN: ${{ secrets.OCTO_BOT_TOKEN }} - TRIAGE_WEBHOOK_URL: ${{ secrets.TRIAGE_WEBHOOK_URL }} - ``` -2. **`pull_request_target` callers have a one-PR delay.** pr-title-lint, labeler, +## Known gotchas + +1. **`pull_request_target` callers have a one-PR delay.** pr-title-lint, labeler, pr-welcome, check-sprint, pr-review read the workflow definition from the *base* branch — they do not run on the PR that first adds them. They take effect on the next PR after merge. -3. **CodeQL is weekly-only + high-input-surface repos only.** Don't add per-PR +2. **CodeQL is weekly-only + high-input-surface repos only.** Don't add per-PR CodeQL; per-PR breadth is your own CI's `gosec`/`eslint`. Library/tool/mobile repos don't run CodeQL at all. From 20e80cc151ac9434e980d9aa55ddead5c0d6465f Mon Sep 17 00:00:00 2001 From: Menglin Li Date: Sat, 27 Jun 2026 21:00:47 +0800 Subject: [PATCH 2/3] =?UTF-8?q?cleanup:=20docs=20(workflow-architecture.md?= =?UTF-8?q?)=20=E2=80=94=20strip=20dead=20notify=20refs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/workflow-architecture.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/workflow-architecture.md b/docs/workflow-architecture.md index 6683482..bffc9d7 100644 --- a/docs/workflow-architecture.md +++ b/docs/workflow-architecture.md @@ -1,5 +1,13 @@ # Mininglamp-OSS — CI/CD & Automation Architecture +> **2026-06-27 update — Plane 6 notification chain removed.** The IM +> notification chain (`octo-ci-status`, `octo-issue-notify`, `octo-pr-result-notify`, +> `octo-pr-review-feed`, `octo-pr-review-feed-comment`, and the shared +> `actions/octo-notify` composite action) was decommissioned org-wide. Issue/PR +> automation now runs through cron-driven multica autopilots; CI state changes +> no longer push to IM. Sections below referring to those workflows are +> historical context only — do not use them as a target for new work. +> > The blueprint for every automation under the organization: reusable > workflows, their triggers, how they are versioned and distributed, and how > local git hooks relate to (but are **not** part of) the central system. @@ -79,7 +87,7 @@ contend for another workflow's source of truth. | **3 — Supply chain / release** | "How is it shipped?" | `reusable-release-drafter`, `reusable-release-publish` | | **4 — Repository governance** | "Is the repo tidy & well-formed?" | `reusable-history-check`, `reusable-pr-labeler`, `reusable-stale`, `reusable-pr-title-lint`, `workflow-sanity` | | **5 — Project board** | "Project management" | `auto-add-to-project`, `reusable-check-sprint` | -| **6 — Community & notification** | "How do we talk to humans?" | `issue-welcome`, `octo-ci-status`, `octo-issue-notify`, `octo-pr-result-notify`, `octo-pr-review-feed` + shared `actions/octo-notify` | +| **6 — Community & notification** | "How do we talk to humans?" | `issue-welcome` (the rest of Plane 6 — `octo-ci-status` / `octo-issue-notify` / `octo-pr-result-notify` / `octo-pr-review-feed` / `octo-notify` — was removed 2026-06-27) | ### Legend for state below - ✅ exists today, keep as-is From ec0415367737e9b367c5e989cac6dc717d301d8b Mon Sep 17 00:00:00 2001 From: Menglin Li Date: Sat, 27 Jun 2026 21:00:50 +0800 Subject: [PATCH 3/3] cleanup: delete stale CI/CD state snapshot --- docs/cicd-state-snapshot.md | 161 ------------------------------------ 1 file changed, 161 deletions(-) delete mode 100644 docs/cicd-state-snapshot.md diff --git a/docs/cicd-state-snapshot.md b/docs/cicd-state-snapshot.md deleted file mode 100644 index 519e3fc..0000000 --- a/docs/cicd-state-snapshot.md +++ /dev/null @@ -1,161 +0,0 @@ -# Mininglamp-OSS — CI/CD State Snapshot - -> Point-in-time inventory of the organization's reusable-workflow platform. -> Generated 2026-06-08, after Wave 2 + Wave 1 (versioning) + triage-exit. -> Updated 2026-06-17: CI-green is now an **enforced** required merge gate on the -> 5 core repos (OCT-7) — see §5a. -> Companion to `workflow-architecture.md` (the design); this is the *as-built* state. - ---- - -## 1. Headline status - -| Metric | Value | -|---|---| -| Reusable workflows (defs in `.github`) | 19 + 1 release automation | -| Composite actions | 1 (`octo-notify`) | -| Consumer repos on `@v1` | 21 / 21 (**100%**) | -| `@main` caller refs remaining | **0** (org-wide) | -| Version tags | `v1` (rolling) → `v1.1.1`; `v1.0.0`, `v1.1.0`, `v1.1.1` (immutable) | -| Release automation | ✅ active (tag push → roll `v1` + GitHub Release) | - ---- - -## 2. Reusable catalog (`.github/.github/workflows/`) - -| Reusable | Plane | Consumers | -|---|---|---| -| `auto-add-to-project.yml` | 5 board | 18 | -| `reusable-check-sprint.yml` | 5 board | 18 | -| `issue-welcome.yml` | 6 community | 17 | -| `octo-issue-notify.yml` | 6 notify (+triage webhook) | 17 | -| `octo-ci-status.yml` | 6 notify | 17 | -| `octo-pr-result-notify.yml` | 6 notify | 17 | -| `octo-pr-review-feed.yml` | 6 notify | 17 | -| `reusable-pr-contributor-welcome.yml` | 6 community | 19 | -| `reusable-pr-labeler.yml` | 4 governance | 18 | -| `reusable-history-check.yml` | 4 governance | 20 | -| `reusable-stale.yml` | 4 governance | 17 | -| `workflow-sanity.yml` | 4 self-check | 18 | -| `reusable-release-drafter.yml` | 3 release | 18 | -| `reusable-release-publish.yml` | 3 release | 19 | -| `reusable-codeql.yml` | 2 security | 11 | -| `reusable-docker-lint.yml` | 2 security | 8 | -| `reusable-dependency-review.yml` | 2 security | **0** ⚠️ new, unadopted | -| `reusable-secret-scan.yml` | 2 security | **0** ⚠️ new, unadopted | -| `reusable-pr-title-lint.yml` | 4 governance | **0** ⚠️ new, unadopted | -| `release.yml` (`.github` self) | infra | n/a (tag-triggered) | - -Composite action: **`octo-notify`** — single outbound transport (IM + webhook), -used by all 4 notification workflows. - ---- - -## 3. Consumer coverage matrix - -Legend: ● consumes · — not · (all refs `@v1`) - -``` -repo vis board sprint welcome issue-nfy ci-stat pr-rslt pr-rvw pr-wel labeler hist stale sanity rel-dft rel-pub codeql docker -octo-server pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-web pub ● ● ● ● ● ● ● ● ● — ● ● ● ● ● ● -octo-im pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-matter pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-smart-summary pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-speech pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-version-sync priv ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-admin pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● -octo-deployment pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● — ● -octo-adapters pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● — -octo-fleet priv ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● — -octo-lib pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● — -octo-cli pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● — — -octo-daemon-cli priv ● ● ● ● ● ● ● ● ● ● ● ● ● ● — — -octo-android pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● ● — -octo-ios pub ● ● ● ● ● ● ● ● ● ● ● ● ● ● — — -claw-channel-octo priv ● ● ● ● ● ● ● ● ● ● ● ● ● ● — — -openclaw-channel-octo pub ● ● ● ● ● ● ● ● ● ● ● ● ● — ● ●(codeql) -``` - -### Meta / independent repos (intentionally outside the platform) -| repo | vis | status | -|---|---|---| -| `.github` | pub | platform host; consumes some reusables as a normal repo, **no issue self-triggers** (§4a exit) | -| `community` | pub | governance/release only; **issue automation removed** (§4a exit) | -| `openclaw` | pub | **independent** (58 own workflows) — only `history-check`/`stale` overlap historically; self-governed | -| `hermes-agent` | pub | **independent** (16 own workflows, own osv/supply-chain stack) | -| `hermes-channel-octo` | pub | minimal: `history-check` only | -| `cc-channel-octo` | pub | **bare** — only its own `ci.yml`, consumes no reusable | -| `octo-website` | priv | **no workflows** | - ---- - -## 4. Versioning & supply chain - -- **All 21 consumers pin `@v1`** (rolling major alias). Zero `@main` residue. -- `v1` → `v1.1.1` (commit `392c7a9`). Immutable anchors: `v1.0.0`, `v1.1.0`, `v1.1.1`. -- `release.yml` auto-rolls `v1` and cuts a GitHub Release on every `vX.Y.Z` push - (verified live 3×). Pre-releases do not advance the alias. -- Internal `uses:` (notify workflows → `octo-notify`) pinned `@v1` → callers get a - fully version-frozen graph (no transitive `@main` leak). -- Third-party actions SHA-pinned; downloaded binaries SHA256-verified. - ---- - -## 5. Gaps & next-wave candidates - -| Gap | Detail | Wave | -|---|---|---| -| **3 new reusables unadopted** | `dependency-review`, `secret-scan`, `pr-title-lint` exist but **0 consumers** | needs rollout (rulesets / per-repo callers) | -| **No language CI reusable** | go/node quality removed by #65; no org test/lint baseline | Wave 3 | -| **CodeQL is per-PR on 11 repos** | should be weekly schedule + scoped to high-risk only | Wave 4 | -| **Runner/checkout drift** | mix of `ubuntu-latest`/`ubuntu-24.04`, checkout v4/v6 across defs | Wave 5 | -| **No enforced distribution** | reusable *adoption* is per-repo opt-in (no org rulesets / required workflows). **CI-green merge gate now enforced** on the 5 core repos (§5a, OCT-7); broader required-workflow distribution still pending | Wave 5 | -| **No starter templates** | new repos hand-copy callers | Wave 5 | -| **Secret scanning L0/platform** | only CI layer planned; platform push-protection + local hooks not yet enabled | Plane 2 | - ---- - -## 5a. Enforced merge gates — CI-green (OCT-7, 2026-06-17) - -`CI green` is now a **required status check** on `main` for all 5 core repos — -red CI blocks merge. The existing `enforce_admins=true` and 3-approval review -requirement are **preserved unchanged** on all 5; `strict` (require-up-to-date) -is intentionally **off** to avoid forced-rebase churn (red CI still blocks -regardless of base freshness). - -Two patterns, chosen per repo's CI shape: - -| Repo | Required context(s) | Pattern | Why | -|---|---|---|---| -| `octo-server` | `Build`, `Test`, `Vet`, `Lint`, `Personal MsgSendReq Lint`, `i18n Extract Check`, `i18n Lint` | direct job contexts | non-matrix jobs; job-level `if:` skips report as `skipped`, which GitHub counts as passing on docs-only PRs (no perma-block) | -| `octo-web` | `Build` | direct job context | single non-matrix build job | -| `octo-admin` | `CI Gate` | aggregate gate | `build` is a matrix job (node 18/20); a skipped matrix job collapses to one un-suffixed `build` context, a running one expands to per-combo contexts → neither is safely requirable | -| `octo-adapters` | `CI Gate` | aggregate gate | `build` is a 3-OS matrix (same matrix-skip hazard) | -| `octo-deployment` | `CI Gate` | aggregate gate | CI used **workflow-level** `pull_request.paths` (perma-block hazard: a PR touching no yaml/kustomize never creates a check). Path filter removed; gate added | - -**`CI Gate` job** (added to admin/adapters/deployment `ci.yml`): `if: always()`, -`needs:` the repo's jobs, fails iff a needed job concluded `failure`/`cancelled` -(`skipped`/`success` pass). One stable context, immune to matrix expansion and -path-filter skips — the robust required-check target for path-filtered pipelines. - -**Validated with throwaway test PRs (closed after):** -- *Direct pattern (octo-server):* deliberately-red build → `Build`=FAILURE → merge **blocked**; docs-only PR → all code jobs `skipped` → **not** blocked by the gate. -- *Aggregate pattern:* malformed-yaml PR on octo-deployment → `CI Gate`=FAILURE → **blocked**; docs-only PR on octo-admin → `build` skipped, `CI Gate`=SUCCESS → **not** perma-blocked. - -> **Bootstrap note:** the 3 `CI Gate` jobs had to land on `main` before the gate -> context could be required, but no second reviewer was available (only CEO/CTO -> agents active; agents are not GitHub reviewers). Each gate PR was admin-merged -> after its own `CI Gate` ran green, via a brief `enforce_admins` toggle, then -> full protection (enforce_admins + 3 reviews + required `CI Gate`) was restored -> in the same operation. octo-server/octo-web needed no workflow change. - ---- - -## 6. Health signals (verified this session) -- ✅ Notification refactor live & green in production (octo-deployment, octo-server real runs) -- ✅ Triage webhook fires where `TRIAGE_WEBHOOK_URL` is set (octo-deployment issue #107 labeled) -- ✅ `@v1` migration green across canary + batch (0 startup_failures = all refs resolve) -- ✅ Release automation verified live (v1.0.0, v1.1.0, v1.1.1 alias rolls) -- ⚠️ Pre-existing, version-independent check failures observed (check-sprint without - `Closes #`, welcome 403, hadolint) — not regressions; flagged for repo owners.