Skip to content

Commit 059ca6f

Browse files
joonfijoonfi
committed
Update: Fix full govops features and additional suite + fix org gov aggregate-fourth.
1 parent 1e48a19 commit 059ca6f

8 files changed

Lines changed: 105 additions & 120 deletions

‎.github/workflows/gcp-approval-gate.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,35 +16,37 @@ jobs:
1616
runs-on: ubuntu-latest
1717

1818
steps:
19-
- name: Skip forks without write permission
20-
if: github.event.pull_request.head.repo.fork == true && github.event.pull_request.maintainer_can_modify != true
19+
- name: Skip if token cannot write to this PR
20+
if: >
21+
github.event.pull_request.head.repo.fork == true &&
22+
github.event.pull_request.maintainer_can_modify != true
2123
run: |
22-
echo "Skipping Advisory Gate — fork PR has no write permission."
24+
echo "Skipping comment — fork PR does not grant write permissions."
2325
exit 0
2426
2527
- uses: actions/checkout@v4
2628

2729
- name: Load severity (best effort)
28-
id: severity
30+
id: sev
2931
run: |
3032
if [[ -f SEVERITY.txt ]]; then
3133
echo "severity=$(cat SEVERITY.txt)" >> $GITHUB_OUTPUT
3234
else
3335
echo "severity=Unknown" >> $GITHUB_OUTPUT
3436
fi
3537
36-
- name: Post advisory gate comment
38+
- name: Post advisory comment
3739
uses: peter-evans/create-or-update-comment@v4
3840
with:
3941
token: ${{ secrets.GITHUB_TOKEN }}
4042
issue-number: ${{ github.event.pull_request.number }}
4143
body: |
4244
### 🛂 GovOps Advisory Approval Gate
4345
44-
Severity classification: **${{ steps.severity.outputs.severity }}**
46+
Severity classification: **${{ steps.sev.outputs.severity }}**
4547
46-
GovOps approval is **advisory only**.
47-
Final enforcement is performed exclusively by:
48+
GovOps approval is **advisory only**
49+
Final enforcement is handled by:
4850
4951
✅ rexce (Phase‑2 validator)
50-
✅ Xcectua (Phase‑4 automation)
52+
✅ Xcectua (Phase‑4 automation)

‎.github/workflows/gcp-dashboard.yml‎

Lines changed: 34 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,49 @@
1-
name: GovOps GCP Dashboard Generator
1+
name: GovOps Severity Annotator
22

33
on:
4-
schedule:
5-
- cron: "0 */6 * * *"
4+
pull_request:
5+
branches: ["main"]
66
workflow_dispatch:
77

88
permissions:
9-
contents: write
9+
contents: read
10+
pull-requests: write
11+
issues: write
1012

1113
jobs:
12-
dashboard:
14+
annotate:
15+
name: Severity Annotator
1316
runs-on: ubuntu-latest
1417

1518
steps:
19+
- name: Skip if token cannot write to this PR
20+
if: >
21+
github.event.pull_request.head.repo.fork == true &&
22+
github.event.pull_request.maintainer_can_modify != true
23+
run: |
24+
echo "Skipping severity annotation — fork PR has no write permissions."
25+
exit 0
26+
1627
- uses: actions/checkout@v4
1728

18-
- name: Generate dashboard
29+
- name: Load severity
30+
id: sev
1931
run: |
20-
echo "# 🧭 GovOps GCP Dashboard" > DASHBOARD.md
21-
echo "Updated: $(date -u)" >> DASHBOARD.md
22-
echo "" >> DASHBOARD.md
32+
if [[ -f SEVERITY.txt ]]; then
33+
echo "severity=$(cat SEVERITY.txt)" >> $GITHUB_OUTPUT
34+
else
35+
echo "severity=Unknown" >> $GITHUB_OUTPUT
36+
fi
2337
24-
echo "## P0 (Critical)" >> DASHBOARD.md
25-
gh pr list --label "gcp/p0-critical" --json number,title,url,author \
26-
| jq -r '.[] | "* [" + .title + "](" + .url + ") by @" + .author + ""' >> DASHBOARD.md
27-
echo "" >> DASHBOARD.md
38+
- name: Post annotation
39+
uses: peter-evans/create-or-update-comment@v4
40+
with:
41+
token: ${{ secrets.GITHUB_TOKEN }}
42+
issue-number: ${{ github.event.pull_request.number }}
43+
body: |
44+
### 🔎 Governance Severity Annotation
2845
29-
- name: Commit dashboard
30-
run: |
31-
git config user.name "github-actions[bot]"
32-
git config user.email "github-actions[bot]@users.noreply.github.com"
33-
git add DASHBOARD.md
34-
git commit -m "Update GovOps GCP Dashboard" || true
35-
git push || true
46+
Severity: **${{ steps.sev.outputs.severity }}**
47+
48+
Advisory: GovOps does not enforce governance.
49+
Enforcement occurs via **rexce** + **Xcectua**.

‎.github/workflows/gcp-review.yml‎

Lines changed: 17 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,15 @@ jobs:
1616
runs-on: ubuntu-latest
1717

1818
steps:
19-
- name: Skip forks without write permission
20-
if: github.event.pull_request.head.repo.fork == true && github.event.pull_request.maintainer_can_modify != true
19+
- name: Skip if token cannot write to this PR
20+
if: >
21+
github.event.pull_request.head.repo.fork == true &&
22+
github.event.pull_request.maintainer_can_modify != true
2123
run: |
22-
echo "Skipping GCP Reviewer — fork PR has no write permission."
24+
echo "Skipping GCP Reviewer — fork PR does not grant write permissions."
2325
exit 0
2426
25-
- name: Checkout govops
26-
uses: actions/checkout@v4
27+
- uses: actions/checkout@v4
2728
with:
2829
fetch-depth: 0
2930

@@ -36,62 +37,29 @@ jobs:
3637
echo "number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
3738
echo "url=${{ github.event.pull_request.html_url }}" >> $GITHUB_OUTPUT
3839
39-
- name: Download governance diff artifact (best effort)
40-
uses: actions/download-artifact@v4
41-
with:
42-
name: xentred-governance-diff-${{ github.run_id }}
43-
continue-on-error: true
44-
45-
- name: Generate GovOps GCP Review Packet
40+
- name: Load classification + severity
4641
run: |
4742
mkdir -p review
43+
[[ -f CLASSIFICATION.md ]] && cp CLASSIFICATION.md review/CLASSIFICATION.md || echo "No classification" > review/CLASSIFICATION.md
44+
[[ -f SEVERITY.txt ]] && cp SEVERITY.txt review/SEVERITY.txt || echo "Unknown" > review/SEVERITY.txt
4845
49-
CLASSIFICATION="No classification artifact found"
50-
if [[ -f CLASSIFICATION.md ]]; then
51-
CLASSIFICATION="$(cat CLASSIFICATION.md)"
52-
fi
53-
54-
SEVERITY="Unknown"
55-
if [[ -f SEVERITY.txt ]]; then
56-
SEVERITY="$(cat SEVERITY.txt)"
57-
fi
58-
59-
cat > review/GCP_REVIEW.md <<'EOF'
60-
# 🧩 GovOps Governance Change Proposal (GCP) Review Packet
61-
62-
## ✅ Summary
63-
GovOps provides advisory governance review only.
64-
65-
## ✅ Severity
66-
<SEVERITY>
67-
68-
## ✅ Classification
69-
<CLASSIFICATION>
70-
71-
## ✅ Reviewer Checklist
72-
- [ ] Contract / boundary impacts validated
73-
- [ ] rexce contract changes confirmed
74-
- [ ] No shadow validators
75-
- [ ] PDR boundaries preserved
76-
77-
EOF
78-
79-
sed -i "s|<SEVERITY>|$SEVERITY|g" review/GCP_REVIEW.md
80-
sed -i "s|<CLASSIFICATION>|$CLASSIFICATION|g" review/GCP_REVIEW.md
81-
82-
- name: Upload GCP Review Packet
46+
- name: Upload review packet
8347
uses: actions/upload-artifact@v4
8448
with:
8549
name: govops-gcp-review-${{ github.run_id }}
8650
path: review/
8751
retention-days: 14
8852

89-
- name: Post GovOps summary comment
53+
- name: Post summary comment
9054
uses: peter-evans/create-or-update-comment@v4
9155
with:
9256
token: ${{ secrets.GITHUB_TOKEN }}
9357
issue-number: ${{ steps.meta.outputs.number }}
9458
body: |
9559
### 🧩 GovOps GCP Review Packet Ready
96-
Advisory-only review completed.
97-
``
60+
61+
Severity: **$(cat review/SEVERITY.txt)**
62+
Classification summary attached (artifact).
63+
64+
GovOps review is **advisory only**.
65+
Enforcement: **rexce** (Phase‑2) + **Xcectua** (Phase‑4).

‎.github/workflows/gcp-severity-annotator.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,28 @@ on:
66
workflow_dispatch:
77

88
permissions:
9-
pull-requests: write
109
contents: read
10+
pull-requests: write
11+
issues: write
1112

1213
jobs:
1314
annotate:
14-
name: Severity-based PR Annotator
15+
name: Severity Annotator
1516
runs-on: ubuntu-latest
1617

1718
steps:
18-
- name: Load classification severity
19-
id: severity
19+
- name: Skip if token cannot write to this PR
20+
if: >
21+
github.event.pull_request.head.repo.fork == true &&
22+
github.event.pull_request.maintainer_can_modify != true
23+
run: |
24+
echo "Skipping severity annotation — fork PR has no write permissions."
25+
exit 0
26+
27+
- uses: actions/checkout@v4
28+
29+
- name: Load severity
30+
id: sev
2031
run: |
2132
if [[ -f SEVERITY.txt ]]; then
2233
echo "severity=$(cat SEVERITY.txt)" >> $GITHUB_OUTPUT
@@ -32,15 +43,7 @@ jobs:
3243
body: |
3344
### 🔎 Governance Severity Annotation
3445
35-
**Severity:**
36-
**${{ steps.severity.outputs.severity }}**
37-
38-
| Level | Meaning |
39-
|-------|---------|
40-
| 🟥 P0 | Contract / boundary change — GCP mandatory |
41-
| 🟧 P1 | Circuit / workflow change — GovOps review required |
42-
| 🟨 P2 | Documentation — advisory review |
43-
| 🟩 P3 | Low-risk / metadata |
46+
Severity: **${{ steps.sev.outputs.severity }}**
4447
45-
This annotation is **advisory only**.
46-
Enforcement remains with **rexce** (validator) and **Xcectua** (Phase‑4 automation).
48+
Advisory: GovOps does not enforce governance.
49+
Enforcement occurs via **rexce** + **Xcectua**.

‎.github/workflows/xentred-gcp.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
name: Xentred GCP Packet
22

33
on:
4-
pull_request:
4+
pull_request_target:
55
branches: ["main"]
6-
workflow_dispatch:
76

87
permissions:
98
contents: read
@@ -12,16 +11,17 @@ permissions:
1211

1312
jobs:
1413
gcp:
15-
name: Generate GCP Packet
1614
runs-on: ubuntu-latest
17-
1815
steps:
1916
- uses: actions/checkout@v4
17+
with:
18+
ref: ${{ github.event.pull_request.head.sha }}
2019

21-
- name: Build GCP packet
20+
- name: Generate GCP packet
2221
run: bash .github/scripts/xentred-gcp.sh
2322

24-
- uses: actions/upload-artifact@v4
23+
- name: Upload GCP packet
24+
uses: actions/upload-artifact@v4
2525
with:
2626
name: xentred-gcp-${{ github.run_id }}
2727
path: gcp/

‎.github/workflows/xentred-governance-diff.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,27 @@
11
name: Xentred Governance Diff Classification
22

33
on:
4-
pull_request:
4+
pull_request_target:
55
branches: ["main"]
6-
workflow_dispatch:
76

87
permissions:
98
contents: read
109
pull-requests: write
1110
issues: write
1211

1312
jobs:
14-
governance-diff:
15-
name: Classify Governance Diff
13+
diff:
1614
runs-on: ubuntu-latest
1715

1816
steps:
1917
- uses: actions/checkout@v4
2018
with:
21-
fetch-depth: 0
19+
ref: ${{ github.event.pull_request.head.sha }}
2220

2321
- name: Run governance diff
24-
run: bash .github/scripts/xentred-governance-diff.sh
22+
run: bash .github/scripts/gov-diff.sh
2523

26-
- name: Upload artifact
24+
- name: Upload diff packet
2725
uses: actions/upload-artifact@v4
2826
with:
2927
name: xentred-governance-diff-${{ github.run_id }}

‎.github/workflows/xentred-governance-validate.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,25 @@
11
name: Xentred Governance Validation
22

33
on:
4-
push:
4+
pull_request_target:
55
branches: ["main"]
6-
pull_request:
6+
push:
7+
branches: ["main"] # keep push validation for direct commits
78

89
permissions:
910
contents: read
1011

1112
jobs:
12-
validate-governance:
13-
name: Validate Xentred Against Canonical Governance Contract
13+
validate:
14+
name: Run canonical governance validator
1415
runs-on: ubuntu-latest
1516

1617
steps:
1718
- name: Checkout Xentred
1819
uses: actions/checkout@v4
1920
with:
21+
ref: ${{ github.event.pull_request.head.sha }}
2022
fetch-depth: 0
2123

22-
# ✅ Canonical Phase‑2 validator
2324
- name: Run rexce validator
24-
uses: Irradi-ato-rs/rexce/.github/actions/validate@main
25+
uses: Irradi-ato-rs/rexce/.github/workflows/rexce-validation.yml@main

0 commit comments

Comments
 (0)