Repository navigation
ci: add reusable report-only governance engine - #31
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
Co-Authored-By: Codex <noreply@openai.com>
|
@codex review Please independently review the current complete diff at head |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12b099e26e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Co-Authored-By: Codex <noreply@openai.com>
|
@codex review Please independently re-review the complete current diff at exact head |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
AI assistance
Automated implementation assistance in the configured coding host; model provenance follows the job receipt.
What changed
Add one public reusable, read-only review observer and pinned machine policy. The observer checks complete patches and current candidate bindings, recognizes separately configured independent review and owner records, and exports only a minimal SHADOW summary. Existing gates, required checks and repository settings are untouched.
How verified
36 observer tests, 36 documentation-checker tests and 9 secret-scan tests pass. Actionlint, documentation phase 2 (zero blocking findings), staged identifier check, current-tree secret scan and diff checks pass. Adverse cases include one recorded fail-before concrete-defect override regression, plus redaction and snapshot-re-read mutations detected by tests.
Why
Prepare one tool-independent repository-native engine for the two explicitly approved report-only pilots. The current policy identity lists are empty; observations remain pending where review or owner evidence is needed. All results retain merge_authorized=false. Native required-check acceptance, baseline exceptions, durable writer admission, atomic freshness and merge queues remain unsupported. Source preparation is separate from hosted runtime acceptance.
Risk
R2: adds workflows and governance source. No source checkout or execution from a candidate, inherited secrets, write token, status publication, label mutation, merge, deployment or setting change. Keep this PR Draft until current CI is green; owner-governance red checks remain binding. Pilot callers will pin this exact candidate and depend on central integration.