chore(governance): define contribution areas + auto-merge for prose#487
Open
plind-junior wants to merge 2 commits into
Open
chore(governance): define contribution areas + auto-merge for prose#487plind-junior wants to merge 2 commits into
plind-junior wants to merge 2 commits into
Conversation
onboarding open-source contributors safely means drawing a line between the parts they can move fast on and the core they must not touch unreviewed. - .github/CODEOWNERS: the hard backstop. the load-bearing paths (review gate, receipts, audit log, storage, schema, kb.* surface, packaging, ci) require a code-owner review; nothing else does. no default owner, so contributor- friendly areas stay fast. - .github/workflows/auto-merge.yml: prose-only prs (docs, top-level markdown, issue templates) get github auto-merge enabled and merge themselves on green ci. it only reads the changed-file list — never checks out or runs pr code — so pull_request_target's token is never exposed to untrusted input. examples/, tests/, adapters/, and all code fall through to human review. - GOVERNANCE.md: the human-readable area map (core / contributor-friendly / auto-merge-safe) tied to the existing decision bars, plus the one-time owner setup (branch protection + allow-auto-merge). - CONTRIBUTING.md: replace "there is no auto-merge" with the three lanes. classifier verified against 18 representative paths; workflow yaml validated. the owner still must enable branch protection + allow-auto-merge in repo settings for either mechanism to bite.
📝 WalkthroughWalkthroughThe PR adds core-path ownership rules, a prose-only auto-merge workflow, and documentation describing automated checks, contribution areas, review requirements, and merge routing. ChangesContribution routing
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Contributor
participant PullRequest
participant GitHubActions
participant BranchProtection
Contributor->>PullRequest: Open or update pull request
PullRequest->>GitHubActions: Trigger workflow
GitHubActions->>GitHubActions: Classify changed files and check draft status
GitHubActions->>BranchProtection: Request squash auto-merge for safe prose-only changes
BranchProtection-->>PullRequest: Apply required checks and review rules
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
docs
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/auto-merge.yml (1)
43-54: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFix the
CODEOWNERSpath in the case statement.The
CODEOWNERSfile is located at.github/CODEOWNERS. The currentCODEOWNERSpattern only matches a top-level file. Although changes to.github/CODEOWNERSstill correctly fail the check by falling through to the*) return 1 ;;catch-all, updating this to match the actual file path clarifies the explicit intent.💡 Proposed refactor
is_safe() { case "$1" in # governance / security / contract docs are owner-reviewed - SECURITY.md|GOVERNANCE.md|CONTRIBUTING.md|CODEOWNERS) return 1 ;; + SECURITY.md|GOVERNANCE.md|CONTRIBUTING.md|.github/CODEOWNERS) return 1 ;; spec/*) return 1 ;; # the protocol contract, not prose docs/*) return 0 ;; # curated prose docs🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/auto-merge.yml around lines 43 - 54, Update the is_safe case pattern to explicitly match .github/CODEOWNERS instead of the top-level CODEOWNERS name, preserving its return 1 behavior and leaving all other path rules unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Around line 17-18: Update the prose-only auto-merge path description in
CONTRIBUTING.md to remove examples/**, leaving docs/**, top-level markdown, and
issue templates listed as eligible paths. Keep the wording consistent with the
exclusions defined in GOVERNANCE.md and auto-merge.yml.
---
Nitpick comments:
In @.github/workflows/auto-merge.yml:
- Around line 43-54: Update the is_safe case pattern to explicitly match
.github/CODEOWNERS instead of the top-level CODEOWNERS name, preserving its
return 1 behavior and leaving all other path rules unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2477e285-c5e8-4ca7-9938-6f8db6c36b21
📒 Files selected for processing (4)
.github/CODEOWNERS.github/workflows/auto-merge.ymlCONTRIBUTING.mdGOVERNANCE.md
Comment on lines
+17
to
+18
| - **prose-only** (`docs/**`, `examples/**`, top-level markdown, issue | ||
| templates) merges itself once CI is green — no maintainer needed. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Remove examples/** from the auto-merge list.
GOVERNANCE.md and the auto-merge.yml workflow explicitly exclude examples/** from auto-merge because examples can carry runnable code. Listing it here as a prose-only auto-merge path creates a contradiction that might confuse contributors when their PRs do not merge automatically.
🐛 Proposed fix
- - **prose-only** (`docs/**`, `examples/**`, top-level markdown, issue
+ - **prose-only** (`docs/**`, top-level markdown, issue
templates) merges itself once CI is green — no maintainer needed.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - **prose-only** (`docs/**`, `examples/**`, top-level markdown, issue | |
| templates) merges itself once CI is green — no maintainer needed. | |
| - **prose-only** (`docs/**`, top-level markdown, issue | |
| templates) merges itself once CI is green — no maintainer needed. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` around lines 17 - 18, Update the prose-only auto-merge path
description in CONTRIBUTING.md to remove examples/**, leaving docs/**, top-level
markdown, and issue templates listed as eligible paths. Keep the wording
consistent with the exclusions defined in GOVERNANCE.md and auto-merge.yml.
This was referenced Jul 16, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
onboarding open-source contributors safely means drawing a line between the parts they can move fast on and the core they must not touch unreviewed.
classifier verified against 18 representative paths; workflow yaml validated. the owner still must enable branch protection + allow-auto-merge in repo settings for either mechanism to bite.
What changed
Why
What might break
VEP
Tests
make checkpasses locally (lint + mypy + pytest)CHANGELOG.mdupdated under## [Unreleased]Summary by CodeRabbit
New Features
Documentation