From f5f52d26ed38fa96465722f5b78060b67708db4f Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 04:12:17 +0000 Subject: [PATCH 1/2] fix(ci): remove orphaned ci-investigator governance test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `eventrelay-ci-investigator` GitHub Actions workflow and its compiled `.lock.yml` were intentionally deleted in 0a5c672 / 07b8a2e ("remove EventRelay CI Investigator workflow — noise-only output; per repo cleanup"). The governance test `test_ci_investigator_requires_dedicated_codex_credential` was left behind and still reads both deleted files, so it raises FileNotFoundError on every run built off main since that cleanup — turning the required `test` job red on `main` and on every open PR branched from it. Remove the orphaned test. The sibling governance tests reference files that still exist (focused-coverage-controller.md, coverage.yml, ci.yml) and are unaffected; the full governance module now passes (8 passed). Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01VpUVACuBj4ahTsWC65CEe7 --- tests/unit/test_gh_aw_workflow_governance.py | 39 -------------------- 1 file changed, 39 deletions(-) diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py index 2a7a99e52..20b23e2d2 100644 --- a/tests/unit/test_gh_aw_workflow_governance.py +++ b/tests/unit/test_gh_aw_workflow_governance.py @@ -103,45 +103,6 @@ def test_focused_coverage_controller_can_read_authoritative_runs() -> None: assert "requires a separate approved GitHub App canary" in source -def test_ci_investigator_requires_dedicated_codex_credential() -> None: - workflow = _load_frontmatter( - ROOT / ".github/workflows/eventrelay-ci-investigator.md" - ) - triggers = workflow.get("on", workflow.get(True)) - assert triggers is not None - credential_gate = next( - step - for step in triggers["steps"] - if step.get("name") == "Require dedicated Codex credential" - ) - - assert credential_gate["id"] == "require_codex_credential" - assert credential_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" - assert "Dedicated CODEX_API_KEY is required" in credential_gate["run"] - assert "OPENAI_API_KEY" not in credential_gate["run"] - - compiled = _load_yaml( - ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml" - ) - pre_activation_steps = compiled["jobs"]["pre_activation"]["steps"] - activation = compiled["jobs"]["activation"] - agent_steps = compiled["jobs"]["agent"]["steps"] - - compiled_gate = next( - step - for step in pre_activation_steps - if step.get("id") == "require_codex_credential" - ) - assert compiled_gate["name"] == "Require dedicated Codex credential" - assert compiled_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}" - assert activation["needs"] == "pre_activation" - assert any(step.get("id") == "validate-secret" for step in activation["steps"]) - assert not any( - step.get("name") == "Require dedicated Codex credential" - for step in agent_steps - ) - - def test_live_smoke_modules_are_excluded_before_import(monkeypatch) -> None: monkeypatch.delenv("RUN_LIVE_E2E", raising=False) monkeypatch.delenv("RUN_LIVE_DEPLOY", raising=False) From 8647afb9c9627dcf6c64c775b1535112a8b1e1a2 Mon Sep 17 00:00:00 2001 From: Hayden Garvey <154503486+groupthinking@users.noreply.github.com> Date: Tue, 4 Aug 2026 05:21:43 +0000 Subject: [PATCH 2/2] fix(ci): drop dangling eventrelay-ci-investigator references from gh-aw validation The workflow's source .md and compiled .lock.yml were deleted in 0a5c672/07b8a2e, but gh-aw-validation.yml still compiled and diffed them, and the governance test asserted the stale reference was present. Remove the three dangling lines and flip the assertion to guard against reintroduction. Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com> --- .github/workflows/gh-aw-validation.yml | 3 --- tests/unit/test_gh_aw_workflow_governance.py | 4 +++- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/gh-aw-validation.yml b/.github/workflows/gh-aw-validation.yml index 8062fa45c..8f0b98fcc 100644 --- a/.github/workflows/gh-aw-validation.yml +++ b/.github/workflows/gh-aw-validation.yml @@ -62,7 +62,6 @@ jobs: - name: Compile and validate workflows run: | gh aw compile \ - eventrelay-ci-investigator \ canonical-pr-remediator \ focused-coverage-controller \ --validate \ @@ -71,7 +70,6 @@ jobs: - name: Run actionlint, zizmor, and poutine checks run: | gh aw compile \ - eventrelay-ci-investigator \ canonical-pr-remediator \ focused-coverage-controller \ --actionlint \ @@ -82,6 +80,5 @@ jobs: - name: Verify compiled lock files are committed run: | git diff --exit-code -- \ - .github/workflows/eventrelay-ci-investigator.lock.yml \ .github/workflows/canonical-pr-remediator.lock.yml \ .github/workflows/focused-coverage-controller.lock.yml diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py index 20b23e2d2..d74aae026 100644 --- a/tests/unit/test_gh_aw_workflow_governance.py +++ b/tests/unit/test_gh_aw_workflow_governance.py @@ -163,6 +163,8 @@ def test_gh_aw_validation_pins_runtime_version() -> None: step_scripts = [step.get("run", "") for step in workflow["jobs"]["validate-gh-aw"]["steps"]] combined = "\n".join(step_scripts) assert "gh extension install github/gh-aw --pin v0.82.14" in combined - assert "eventrelay-ci-investigator" in combined + # eventrelay-ci-investigator was removed (07b8a2e); validation must not + # compile or diff a workflow whose source and lock files no longer exist. + assert "eventrelay-ci-investigator" not in combined assert "canonical-pr-remediator" in combined assert "focused-coverage-controller" in combined