chore(sdlc): re-stamp canonical FuzeSDLC workflow stack - #126
Merged
Conversation
…ync reconcile-capable) One-time manual bootstrap onto the fuze:managed marker system: governance-sync.yml is now reconcile-capable (not detect-only) for .github/workflows/**, claude-ci-autofix.yml is renamed to fuze-ci-autofix.yml, adds the fuze-push-identity composite action, the gate-required-checks/gate-api-version/gate-vacuous-check/gate-federation-contract gates, and the fuze-code-review approval workflow. Canonical clone was ahead of the repo's pinned baselineRef=v1 (v1.9.0), so baselineRef is bumped to main in this same PR per sdlc-bootstrap's own --allow-canonical-drift guidance, avoiding a governance-sync flip-flop back to the old templates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session-Id: fe3aa738-cb24-4315-a29b-29834ddea892
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #126 +/- ##
=======================================
Coverage 41.06% 41.06%
=======================================
Files 81 81
Lines 6171 6171
Branches 250 252 +2
=======================================
Hits 2534 2534
Misses 3634 3634
Partials 3 3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # ubuntu-latest puts one job back on a GitHub-hosted machine -- and on a | ||
| # private repo, never runs it at all. | ||
| runner: ubuntu-latest | ||
| secrets: inherit No newline at end of file |
| # ubuntu-latest puts one job back on a GitHub-hosted machine -- and on a | ||
| # private repo, never runs it at all. | ||
| runner: ubuntu-latest | ||
| secrets: inherit No newline at end of file |
| - name: Mint fuze-agent App installation token | ||
| id: app | ||
| if: inputs.app-id != '' && inputs.private-key != '' | ||
| uses: actions/create-github-app-token@v1 |
| - name: Mint fuze-agent App token | ||
| id: app_token | ||
| continue-on-error: true | ||
| uses: actions/create-github-app-token@v1 |
| - name: Mint fuze-agent App token | ||
| id: app_token | ||
| continue-on-error: true | ||
| uses: actions/create-github-app-token@v1 |
| # safe direction for a security gate is to run and go red, never to quietly not run. | ||
| - name: Upload SARIF (skipped on private repos — code scanning unavailable) | ||
| if: always() && !github.event.repository.private | ||
| uses: github/codeql-action/upload-sarif@v3 |
| # long note on the same step in gate-sast above for why this is not continue-on-error. | ||
| - name: Upload SARIF (skipped on private repos — code scanning unavailable) | ||
| if: always() && !github.event.repository.private | ||
| uses: github/codeql-action/upload-sarif@v3 |
| # long note on the same step in gate-sast above for why this is not continue-on-error. | ||
| - name: Upload SARIF (skipped on private repos — code scanning unavailable) | ||
| if: always() && !github.event.repository.private | ||
| uses: github/codeql-action/upload-sarif@v3 |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | ||
| with: { python-version: '3.12' } | ||
| - uses: actions/setup-node@v7 |
| - name: Mint fuze-agent App token | ||
| id: app_token | ||
| continue-on-error: true | ||
| uses: actions/create-github-app-token@v1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One-time manual bootstrap onto the fuze:managed marker system (governance-sync was
DETECT-ONLY for .github/workflows/** until a repo carries the reconcile-capable
governance-sync.yml).
Delivers:
uses: izzywdev/FuzeSDLC/.github/workflows/reusable-claude-ci-autofix.yml@main—the FuzeSDLC-reusable variant, not the AITools one — so this is a straight rename)
gate-federation-contract, fuze-code-review approval workflow
baselineRef bumped v1 -> main in .fuze/manifest.json in this same PR: the operator's
FuzeSDLC clone was 85 commits ahead of the repo's pinned v1 (v1.9.0), which predates the
fuze:managed marker mechanism entirely. Per sdlc-bootstrap's own --allow-canonical-drift
guidance, the pin must move with the drop or governance-sync will fetch canonical at the
stale v1 ref on the next PR and revert these files right back.
Ran with
scripts/bootstrap/main.py --only workflows --allow-canonical-drift --adopt-canonical, diffed and reviewed before committing. No repo-authored,non-canonical workflow (ci.yml, build-and-push.yml, deploy-platform.yml, release-gate.yml,
seal-secrets.yml, registration-test.yml) was touched — only files in the canonical
workflow stack.
🤖 Generated with Claude Code