Repository navigation
feature/Template-ships-pipelexs-cla · L-261001-05e000 - #8
Merged
Merged
Conversation
Every job in cla.yml, guard-branches.yml, version-check.yml, changelog-check.yml and github-release.yml now runs only in Pipelex/pipelex-starter-python, so a repository created with "Use this template" inherits them inert instead of failing every pull request on the CLA app's missing secrets or asking its contributors to sign Pipelex's CLA. The guard keeps the template's required checks posting. The bootstrap script now deletes those workflows and the release skill (MAINTAINER_ONLY_PATHS), and a test holds that list against the guards on disk. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01UcXtZsHrK9JVCxL2BMhUvU
Under pull_request_target the default checkout is the default branch, so the job diffed two base branches and never saw a pull request's own changes; and its author_association == 'CONTRIBUTOR' condition skipped first-time authors. It now trusts only authors with write access, resolved from their effective repository permission as pipelex-sdk-python and mthds-python already do, and reads the pull request's files from the API instead of a local diff, so nothing of the head is checked out and the list is exactly the pull request's changes against its merge base. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01UcXtZsHrK9JVCxL2BMhUvU
AGENTS.md and CLAUDE.md survive /bootstrap, so the rule on guarding the template's own workflows, which names the bootstrap script and its test, pointed at deleted files in every derived project. The rule now lives in the header of each maintainer-only workflow and in the release skill, both of which bootstrap deletes, and CLAUDE.md says the bootstrap and release skills go with the bootstrap. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01UcXtZsHrK9JVCxL2BMhUvU
…enamed projects The job reader matched only a bare job key, so a key carrying a trailing comment was skipped: the job vanished from the check, or took the `if:` of the job above it, and the guard test passed with an unguarded maintainer-only job. It now reads the comment and fails on any other line two spaces in under `jobs:` that is not a job key. The README's manual checklist now deletes the bootstrap skill and its test, as the skill does once it has run, so a project renamed by hand does not keep a test that holds its own workflows to the template's layout. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01UcXtZsHrK9JVCxL2BMhUvU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A repository made with "Use this template" inherited the template's own CLA assistant, branch-flow guard, release checks and GitHub Release job, so its pull requests failed for want of the CLA app's secrets or asked its contributors to sign Pipelex's CLA. Every job in those workflows now runs only in
Pipelex/pipelex-starter-python, which keeps the template's required checks posting, and/bootstrapdeletes them along with the template'sreleaseskill, with a test holding the deletion list against the guards. The review also found thatprotect-workflowsnever read the pull request it guards underpull_request_target, so it now trusts authors by their effective permission and reads the pull request's files from the API.Closes L-261001-05e000
🤖 Generated with Claude Code
https://claude.ai/code/session_01UcXtZsHrK9JVCxL2BMhUvU
Summary by cubic
Stops repositories made with "Use this template" from inheriting Pipelex's own CLA assistant, branch-flow guard, release checks, and GitHub Release job, which made their pull requests fail for want of the CLA app's secrets or ask contributors to sign Pipelex's CLA.
cla.yml,guard-branches.yml,version-check.yml,changelog-check.yml, andgithub-release.ymltoPipelex/pipelex-starter-pythononly, so the template's required checks keep posting while derived projects run them inert./bootstrapnow deletes those workflows and thereleaseskill viaMAINTAINER_ONLY_PATHS, after the survivor check so an aborted run removes nothing; the guard test now reads job keys with trailing comments and fails on unreadable lines, so an unguarded job cannot hide, and it holds the list against the guards on disk.protect-workflows, which underpull_request_targetdiffed two base branches and never saw the pull request's files; it now trusts only authors with write access, resolved from effective repository permission, and reads the pull request's file list from the API./bootstrap, so a hand-renamed project keeps no test pinning its workflows to the template's layout.Written for commit eb94c1f. Summary will update on new commits.