ops: reduce comment density in PR #4433
Cut commentary from 104 to 24 lines across the new lint script, CI config, and pre-push hook. Kept only: policy reference, why pattern is loose, why scope is PR commits not history, and non-obvious CI behavior notes. No logic lines changed. Refs #4432
This commit is contained in:
atlas
mara
parent
bf8e309b19
commit
5bd68f9b8a
3 changed files with 19 additions and 99 deletions
|
|
@ -3,123 +3,78 @@ name: CI
|
|||
on:
|
||||
pull_request:
|
||||
branches: ["**"]
|
||||
# Lets `hive-forge ci-rerun` re-trigger CI via the workflow-dispatch API
|
||||
# without an empty commit. No effect on the PR-triggered runs above.
|
||||
# Lets `hive-forge ci-rerun` re-trigger CI via workflow-dispatch API
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
check:
|
||||
name: nix flake check
|
||||
runs-on: [hive-ci]
|
||||
# Bound the job so a wedged build fails in minutes instead of
|
||||
# hanging until the runner's 3h cap (or, when the runner itself
|
||||
# deadlocks, never). 30 min is well above a cold-cache rebuild
|
||||
# (~15 min observed) and well under the 3h hard cap — tune if a
|
||||
# legit cold build ever trips it.
|
||||
# 30 min is well above a cold-cache rebuild (~15 min observed) and well
|
||||
# under the runner's 3h cap
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: check
|
||||
# Runs all flake checks: formatting (treefmt+rustfmt), cargo test,
|
||||
# cargo clippy, and module evaluation. No --no-build: the checks
|
||||
# derivations are the canonical source of truth.
|
||||
run: nix flake check
|
||||
|
||||
tracker-tags:
|
||||
name: tracker-tag lint
|
||||
runs-on: [hive-ci]
|
||||
# Pure git+grep — seconds normally; a few minutes is already a hang.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: lint
|
||||
# Flags hash-number tracker tags in source (hive convention is
|
||||
# prose, not tags — /knowledge/hive-rules.md). Its own job, and
|
||||
# IS a required check on the forge (branch protection) — a hit
|
||||
# blocks merge. See scripts/check-issue-refs.sh.
|
||||
run: sh scripts/check-issue-refs.sh
|
||||
|
||||
comment-blocks:
|
||||
name: comment-block lint
|
||||
runs-on: [hive-ci]
|
||||
# Pure git+awk — seconds.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: lint
|
||||
# Flags contiguous comment blocks over 30 lines (a giant prose
|
||||
# block belongs in docs/ as implementation notes, not in source).
|
||||
# Own job, and IS a required check on the forge (branch
|
||||
# protection) — a hit blocks merge. See
|
||||
# scripts/check-comment-blocks.sh.
|
||||
run: sh scripts/check-comment-blocks.sh
|
||||
|
||||
doc-refs:
|
||||
name: doc-pointer lint
|
||||
runs-on: [hive-ci]
|
||||
# Pure git+grep — seconds.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: lint
|
||||
# Flags `docs/…md` paths and relative markdown links that no
|
||||
# longer resolve. Pointing at a doc is what the comment-block
|
||||
# lint above pushes people toward, so the pointers need a gate of
|
||||
# their own. See scripts/check-doc-refs.sh.
|
||||
run: sh scripts/check-doc-refs.sh
|
||||
|
||||
attribution-trailers:
|
||||
name: attribution-trailer lint
|
||||
runs-on: [hive-ci]
|
||||
# Pure git — seconds.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: lint
|
||||
# Flags Co-Authored-By trailers with Claude/Anthropic attribution
|
||||
# in PR commits (hive convention in /knowledge/hive-rules.md forbids
|
||||
# them — an attribution line in a prompt is not a control). Own
|
||||
# job, and IS a required check on the forge (branch protection) — a
|
||||
# hit blocks merge. See scripts/check-attribution-trailers.sh.
|
||||
run: sh scripts/check-attribution-trailers.sh
|
||||
|
||||
prose-lint:
|
||||
name: prose lint (vale)
|
||||
runs-on: [hive-ci]
|
||||
# A `vale sync` + full docs/ run took under a minute in testing.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: lint
|
||||
# Styles (Microsoft + alex + write-good, named in .vale.ini's
|
||||
# `Packages` line) are fetched fresh from the Vale Package Hub each
|
||||
# run rather than vendored, so this job always lints against
|
||||
# upstream's current rules. Failing red on a hit is intentional --
|
||||
# the existing docs/ tree has a standing backlog of warning- and
|
||||
# suggestion-level rule hits, so this job stays red on unrelated
|
||||
# PRs until that backlog is worked down (tracked separately, as a
|
||||
# follow-up to the error-only work below). Not wired into branch
|
||||
# protection -- see the sibling job below for the error-only slice
|
||||
# that is.
|
||||
# Styles are fetched fresh from Vale Package Hub each run (not vendored).
|
||||
# Not wired into branch protection — see prose-lint-errors below for the
|
||||
# error-only slice that is.
|
||||
run: XDG_DATA_HOME="$PWD/.vale-data" nix shell nixpkgs#vale --command sh -c 'vale sync && vale docs'
|
||||
|
||||
prose-lint-errors:
|
||||
name: prose lint (vale, errors)
|
||||
runs-on: [hive-ci]
|
||||
# Own `vale sync` rather than reusing the sibling job's: each job gets
|
||||
# a fresh checkout/environment, so there is nothing to share between
|
||||
# them without an artifact-upload step this doesn't need.
|
||||
timeout-minutes: 5
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: lint
|
||||
# The error-level-only slice of the sibling job above.
|
||||
# `--minAlertLevel=error` changes what vale both reports AND exits
|
||||
# non-zero on, so this job's pass/fail tracks only error-severity
|
||||
# rule hits, not the warning/suggestion backlog the sibling job
|
||||
# carries. Split out so this one alone can be a required check
|
||||
# (forge branch protection) without blocking merges on the
|
||||
# pre-existing backlog the sibling job still surfaces.
|
||||
# Error-level-only slice. Split out so this job alone can be a required
|
||||
# check without blocking merges on the warning/suggestion backlog.
|
||||
run: XDG_DATA_HOME="$PWD/.vale-data" nix shell nixpkgs#vale --command sh -c 'vale sync && vale --minAlertLevel=error docs'
|
||||
|
|
|
|||
|
|
@ -1,69 +1,43 @@
|
|||
#!/bin/sh
|
||||
# CI lint: flags Co-Authored-By trailers with Claude/Anthropic attribution in
|
||||
# PR commits. The hive convention in /knowledge/hive-rules.md forbids these
|
||||
# trailers — an attribution line in a prompt is not a control. This gate is.
|
||||
# Flags Co-Authored-By trailers with Claude/Anthropic attribution in PR commits.
|
||||
# The hive convention in /knowledge/hive-rules.md forbids these trailers.
|
||||
#
|
||||
# Emits a CI error annotation per offending commit and exits 1 if any commit
|
||||
# in the PR's range carries a prohibited trailer. Runs as its own CI job and
|
||||
# IS a required check on the forge (branch protection) — a hit blocks merge.
|
||||
# Pattern is loose (case-insensitive, matches `claude`, `anthropic`, or
|
||||
# `noreply@anthropic.com` anywhere after `co-authored-by`) to cover variants
|
||||
# like `Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>`.
|
||||
#
|
||||
# Pattern: case-insensitive `co-authored-by` followed by `claude`, `anthropic`,
|
||||
# or `noreply@anthropic.com` anywhere in the line. Covers variants seen in the
|
||||
# wild: `Co-Authored-By: Claude`, `Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>`.
|
||||
#
|
||||
# Scope: commits in the PR's range (BASE..HEAD), not the entire history — old
|
||||
# commits must not fail the build. In CI, BASE is the target branch
|
||||
# (GITHUB_BASE_REF / github.event.pull_request.base.ref in GH Actions; similar
|
||||
# vars in Forgejo). Falls back to origin/main for local runs.
|
||||
# Scope is the PR's commits (BASE..HEAD), not entire history — old commits
|
||||
# must not fail the build.
|
||||
set -eu
|
||||
|
||||
# Determine base ref: in CI (pull_request event), use the PR's base branch;
|
||||
# locally, default to origin/main. CI env vars: GITHUB_BASE_REF (GitHub
|
||||
# Actions), similar for Forgejo/Gitea (not standardized across runners, so we
|
||||
# check both common patterns).
|
||||
if [ -n "${GITHUB_BASE_REF:-}" ]; then
|
||||
# GitHub Actions / Forgejo Actions pull_request context
|
||||
base="origin/${GITHUB_BASE_REF}"
|
||||
elif [ -n "${CI_COMMIT_REF_NAME:-}" ]; then
|
||||
# GitLab-style variable (some Forgejo setups)
|
||||
base="origin/main"
|
||||
else
|
||||
# Local run or unknown CI — default to origin/main
|
||||
base="origin/main"
|
||||
fi
|
||||
|
||||
# Ensure the base ref exists (in CI, actions/checkout@v3 fetches the PR head
|
||||
# but may not fetch the base branch by default — fetch it if missing).
|
||||
# actions/checkout@v3 fetches the PR head but may not fetch the base branch
|
||||
if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
|
||||
# Extract branch name and fetch it
|
||||
branch="${base#origin/}"
|
||||
git fetch origin "$branch" 2>/dev/null || true
|
||||
# If still missing, fall back to main
|
||||
if ! git rev-parse --verify "$base" >/dev/null 2>&1; then
|
||||
base="origin/main"
|
||||
git fetch origin main 2>/dev/null || base="HEAD~10"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Get all commits in the PR's range. `--reverse` lists oldest first (clearer
|
||||
# for annotation output). `--format=%H` gets the full commit sha.
|
||||
commits="$(git log --reverse --format='%H' "${base}..HEAD" 2>/dev/null || true)"
|
||||
|
||||
if [ -z "$commits" ]; then
|
||||
# No commits in range — either not on a PR branch, or nothing new. Pass.
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Check each commit's full message for the prohibited trailer pattern.
|
||||
# Case-insensitive grep for `co-authored-by` + any of `claude`, `anthropic`,
|
||||
# `noreply@anthropic.com`.
|
||||
hits=""
|
||||
for sha in $commits; do
|
||||
msg="$(git log -1 --format='%B' "$sha")"
|
||||
# Match case-insensitive co-authored-by AND (claude OR anthropic OR noreply@anthropic.com)
|
||||
# Use grep -E with -i for case-insensitive matching
|
||||
if printf '%s\n' "$msg" | grep -qiE 'co-authored-by.*claude|co-authored-by.*anthropic|co-authored-by.*noreply@anthropic\.com'; then
|
||||
# Found a hit — build annotation
|
||||
subject="$(git log -1 --format='%s' "$sha")"
|
||||
hits="${hits}${sha}|${subject}
|
||||
"
|
||||
|
|
|
|||
|
|
@ -1,17 +1,8 @@
|
|||
#!/bin/sh
|
||||
# Git pre-push hook: runs the tracker-tag, comment-block and doc-pointer
|
||||
# lints against the working tree before any push lands on the remote.
|
||||
# Catches issues that would fail CI and require a follow-up commit
|
||||
# (common failure mode: a nix comment containing a hash-issue-number
|
||||
# tag added mid-session).
|
||||
# Install: ln -sf ../../scripts/pre-push .git/hooks/pre-push
|
||||
#
|
||||
# Install (once per clone):
|
||||
# ln -sf ../../scripts/pre-push .git/hooks/pre-push
|
||||
#
|
||||
# The hook runs against the full working tree (not just staged or
|
||||
# pushed files) to match what CI sees: `nix flake check` builds from
|
||||
# the committed tree, so an untracked hit on a staged file would still
|
||||
# trip CI.
|
||||
# Runs against the full working tree (not just staged or pushed files) to match
|
||||
# what CI sees: `nix flake check` builds from the committed tree.
|
||||
set -eu
|
||||
|
||||
repo_root="$(git rev-parse --show-toplevel)"
|
||||
|
|
|
|||
Loading…
Reference in a new issue