From 67ec149ce1df67aa47de3ac098749102bb0b5cc7 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 02:12:21 +0000 Subject: [PATCH] fix(ci): finish removal of eventrelay-ci-investigator workflow Commit 07b8a2e removed .github/workflows/eventrelay-ci-investigator.md (the CI Investigator source) but left dangling references behind, so the `test` job is red on main and on every open PR: - tests/unit/test_gh_aw_workflow_governance.py:: test_ci_investigator_requires_dedicated_codex_credential loaded the deleted .md/.lock.yml and failed with FileNotFoundError (1 failed, 7941 passed). - .github/workflows/gh-aw-validation.yml still ran `gh aw compile eventrelay-ci-investigator` and diffed the removed .lock.yml, which would fail the validation workflow at runtime. This completes the intended cleanup: drop the obsolete governance test, remove the stale `eventrelay-ci-investigator` assertion from test_gh_aw_validation_pins_runtime_version, and drop the three dangling references from gh-aw-validation.yml. canonical-pr-remediator and focused-coverage-controller are untouched. Verified: test_gh_aw_workflow_governance.py 8 passed; gh-aw-validation.yml parses; ruff clean. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01Q3EkDi3YzmMyGvHizXKaPf --- .github/workflows/gh-aw-validation.yml | 3 -- tests/unit/test_gh_aw_workflow_governance.py | 40 -------------------- 2 files changed, 43 deletions(-) diff --git a/.github/workflows/gh-aw-validation.yml b/.github/workflows/gh-aw-validation.yml index 8062fa45c..8f0b98fcc 100644 --- a/.github/workflows/gh-aw-validation.yml +++ b/.github/workflows/gh-aw-validation.yml @@ -62,7 +62,6 @@ jobs: - name: Compile and validate workflows run: | gh aw compile \ - eventrelay-ci-investigator \ canonical-pr-remediator \ focused-coverage-controller \ --validate \ @@ -71,7 +70,6 @@ jobs: - name: Run actionlint, zizmor, and poutine checks run: | gh aw compile \ - eventrelay-ci-investigator \ canonical-pr-remediator \ focused-coverage-controller \ --actionlint \ @@ -82,6 +80,5 @@ jobs: - name: Verify compiled lock files are committed run: | git diff --exit-code -- \ - .github/workflows/eventrelay-ci-investigator.lock.yml \ .github/workflows/canonical-pr-remediator.lock.yml \ .github/workflows/focused-coverage-controller.lock.yml diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py index 2a7a99e52..e944019db 100644 --- a/tests/unit/test_gh_aw_workflow_governance.py +++ b/tests/unit/test_gh_aw_workflow_governance.py @@ -103,45 +103,6 @@ def test_focused_coverage_controller_can_read_authoritative_runs() -> None: assert "requires a separate approved GitHub App canary" in source -def test_ci_investigator_requires_dedicated_codex_credential() -> None: - workflow = _load_frontmatter( - ROOT / ".github/workflows/eventrelay-ci-investigator.md" - ) - triggers = workflow.get("on", workflow.get(True)) - assert triggers is not None - credential_gate = next( - step - for step in triggers["steps"] - if step.get("name") == "Require dedicated Codex credential" - ) - - assert credential_gate["id"] == "require_codex_credential" - assert credential_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" - assert "Dedicated CODEX_API_KEY is required" in credential_gate["run"] - assert "OPENAI_API_KEY" not in credential_gate["run"] - - compiled = _load_yaml( - ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml" - ) - pre_activation_steps = compiled["jobs"]["pre_activation"]["steps"] - activation = compiled["jobs"]["activation"] - agent_steps = compiled["jobs"]["agent"]["steps"] - - compiled_gate = next( - step - for step in pre_activation_steps - if step.get("id") == "require_codex_credential" - ) - assert compiled_gate["name"] == "Require dedicated Codex credential" - assert compiled_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" - assert activation["needs"] == "pre_activation" - assert any(step.get("id") == "validate-secret" for step in activation["steps"]) - assert not any( - step.get("name") == "Require dedicated Codex credential" - for step in agent_steps - ) - - def test_live_smoke_modules_are_excluded_before_import(monkeypatch) -> None: monkeypatch.delenv("RUN_LIVE_E2E", raising=False) monkeypatch.delenv("RUN_LIVE_DEPLOY", raising=False) @@ -202,6 +163,5 @@ def test_gh_aw_validation_pins_runtime_version() -> None: step_scripts = [step.get("run", "") for step in workflow["jobs"]["validate-gh-aw"]["steps"]] combined = "\n".join(step_scripts) assert "gh extension install github/gh-aw --pin v0.82.14" in combined - assert "eventrelay-ci-investigator" in combined assert "canonical-pr-remediator" in combined assert "focused-coverage-controller" in combined