From 6632f755ee9da4aef4806084635de91d6d0a107b Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 01:53:22 +0000 Subject: [PATCH] fix(ci): drop stale eventrelay-ci-investigator governance checks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The EventRelay CI Investigator workflow (.md + .lock.yml) was intentionally removed in 07b8a2e ("noise-only output; per repo cleanup"), but two governance hooks still referenced it, leaving `main` — and every PR branched from it — red: - test_ci_investigator_requires_dedicated_codex_credential asserted the removed workflow files exist, failing the `test` job repo-wide (1 failed, 7919 passed). - .github/workflows/gh-aw-validation.yml still ran `gh aw compile eventrelay-ci-investigator` and diffed its deleted .lock.yml, so the gh-aw Validation workflow would fail against files that no longer exist. Codify the removal instead: assert the investigator files stay absent (mirroring test_obsolete_agentic_verification_loop_removed) and drop the investigator from the gh-aw validation compile/diff steps and its pin test. canonical-pr-remediator and focused-coverage-controller remain the authoritative agentic workflows. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_011GfJq7eGJ3FgkwJHu1YUYi --- .github/workflows/gh-aw-validation.yml | 3 -- tests/unit/test_gh_aw_workflow_governance.py | 49 +++++--------------- 2 files changed, 11 insertions(+), 41 deletions(-) diff --git a/.github/workflows/gh-aw-validation.yml b/.github/workflows/gh-aw-validation.yml index 8062fa45c..8f0b98fcc 100644 --- a/.github/workflows/gh-aw-validation.yml +++ b/.github/workflows/gh-aw-validation.yml @@ -62,7 +62,6 @@ jobs: - name: Compile and validate workflows run: | gh aw compile \ - eventrelay-ci-investigator \ canonical-pr-remediator \ focused-coverage-controller \ --validate \ @@ -71,7 +70,6 @@ jobs: - name: Run actionlint, zizmor, and poutine checks run: | gh aw compile \ - eventrelay-ci-investigator \ canonical-pr-remediator \ focused-coverage-controller \ --actionlint \ @@ -82,6 +80,5 @@ jobs: - name: Verify compiled lock files are committed run: | git diff --exit-code -- \ - .github/workflows/eventrelay-ci-investigator.lock.yml \ .github/workflows/canonical-pr-remediator.lock.yml \ .github/workflows/focused-coverage-controller.lock.yml diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py index 2a7a99e52..8f0eee27c 100644 --- a/tests/unit/test_gh_aw_workflow_governance.py +++ b/tests/unit/test_gh_aw_workflow_governance.py @@ -103,43 +103,13 @@ def test_focused_coverage_controller_can_read_authoritative_runs() -> None: assert "requires a separate approved GitHub App canary" in source -def test_ci_investigator_requires_dedicated_codex_credential() -> None: - workflow = _load_frontmatter( - ROOT / ".github/workflows/eventrelay-ci-investigator.md" - ) - triggers = workflow.get("on", workflow.get(True)) - assert triggers is not None - credential_gate = next( - step - for step in triggers["steps"] - if step.get("name") == "Require dedicated Codex credential" - ) - - assert credential_gate["id"] == "require_codex_credential" - assert credential_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" - assert "Dedicated CODEX_API_KEY is required" in credential_gate["run"] - assert "OPENAI_API_KEY" not in credential_gate["run"] - - compiled = _load_yaml( - ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml" - ) - pre_activation_steps = compiled["jobs"]["pre_activation"]["steps"] - activation = compiled["jobs"]["activation"] - agent_steps = compiled["jobs"]["agent"]["steps"] - - compiled_gate = next( - step - for step in pre_activation_steps - if step.get("id") == "require_codex_credential" - ) - assert compiled_gate["name"] == "Require dedicated Codex credential" - assert compiled_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" - assert activation["needs"] == "pre_activation" - assert any(step.get("id") == "validate-secret" for step in activation["steps"]) - assert not any( - step.get("name") == "Require dedicated Codex credential" - for step in agent_steps - ) +def test_obsolete_ci_investigator_workflow_removed() -> None: + # The EventRelay CI Investigator workflow (source .md and compiled .lock.yml) + # was intentionally removed in 07b8a2e ("noise-only output; per repo cleanup"). + # Guard against reintroduction; canonical-pr-remediator and + # focused-coverage-controller remain the authoritative agentic workflows. + assert not (ROOT / ".github/workflows/eventrelay-ci-investigator.md").exists() + assert not (ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml").exists() def test_live_smoke_modules_are_excluded_before_import(monkeypatch) -> None: @@ -202,6 +172,9 @@ def test_gh_aw_validation_pins_runtime_version() -> None: step_scripts = [step.get("run", "") for step in workflow["jobs"]["validate-gh-aw"]["steps"]] combined = "\n".join(step_scripts) assert "gh extension install github/gh-aw --pin v0.82.14" in combined - assert "eventrelay-ci-investigator" in combined + # eventrelay-ci-investigator was removed (07b8a2e); validation must no longer + # compile or diff it, otherwise the gh-aw Validation workflow fails at runtime + # against a source/lock file that no longer exists. + assert "eventrelay-ci-investigator" not in combined assert "canonical-pr-remediator" in combined assert "focused-coverage-controller" in combined