Skip to content

chore(ci): add verify gate, CODEOWNERS for main - #8

Closed
G1DO wants to merge 5 commits into
mainfrom
chore/main-verify-gate
Closed

chore(ci): add verify gate, CODEOWNERS for main#8
G1DO wants to merge 5 commits into
mainfrom
chore/main-verify-gate

Conversation

@G1DO

@G1DO G1DO commented Oct 20, 2026

Copy link
Copy Markdown
Owner

Audit fix on main only. Does not touch release/ccpe-v1.0 or default branch.

Adds:

  • .github/workflows/verify.yml invoking poe verify (test, migrate, build, check:hygiene, diagrams), full-history gitleaks scan via .gitleaks.toml, single aggregating gate as sole required check, nightly schedule on main.
  • .github/CODEOWNERS real owner @G1DO + wildcard fallback.
  • .gitleaks.toml allowlisting synthetic SYNTHETIC-001 placeholders.
  • Versioned .mmd sources, decisions index, poe task verbs, ml_engine CLI wired to real forecaster (clears stub hygiene).

Human once (do not run in CI):

  • Protect main, block pushes, require gate. See commands in PR comments.
  • Going forward: PR-only + Closes/Refs trailers.

Verify:

  • gh api repos/G1DO/smart-cloud-optimizer/branches/main/protection
  • CI green (gate) on this PR.

Refs: main audit (no .github @1be8cc6, no CODEOWNERS, main unprotected 404, direct pushes 78c1a2f,8e224a6,503e3d6)

G1DO added 5 commits October 20, 2026 06:34
@G1DO
chore(ci): add verify gate, CODEOWNERS, and hygiene/diagram sources f…
1db1e3c 
…or main

Add .github/workflows/verify.yml invoking poe verify (test, migrate,
build, check:hygiene, diagrams) with full-history gitleaks scan and a
single aggregating gate job as the sole required check. Nightly schedule
covers main. Add .github/CODEOWNERS (real owner @G1DO + wildcard fallback)
and .gitleaks.toml allowlisting synthetic SYNTHETIC-001 placeholders so the
history scan stays green. Include versioned .mmd diagram sources, decisions
index, and poe task verbs. Wire ml_engine CLI to real forecaster to clear
stub-marker hygiene check.

Refs: main audit (no .github, no CODEOWNERS, unprotected main)
@G1DO
fix(ci): invoke poe via binary (python -m poe unavailable on runner)
db30911 
Refs: main audit (PR #8)
@G1DO
fix(deps): pin pulp <4 (4.x removes LpVariable + PULP_CBC_CMD)
c3d6710 
CI on PR #8 showed 5 optimizer failures with pulp 4.1.0:
LpVariable.__init__() unexpected cat. Optimizer uses 2.x/3.x API.
Pin to >=2.7,<4 for reproducible verify + docker builds.

Refs: #8
@G1DO
fix(docs): remove pasted mermaid block (canonical is .mmd)
00561ae 
diagrams task fails closed on pasted blocks; overview now points to
versioned .mmd sources validated by mmdc.

Refs: #8
@G1DO
fix(ci): use puppeteer no-sandbox for mmdc (CI chrome sandbox)
7689a42 
Poe diagrams now passes --puppeteerConfigFile ./puppeteer.json so both
local and CI render .mmd via mmdc without sandbox failures. Update task
comments to reflect .gitleaks.toml secrets scan in CI.

Refs: #8
@G1DO

G1DO commented Oct 28, 2026

Copy link
Copy Markdown
Owner Author

Closing as superseded by #9, which merged this PR's gate (.github/workflows/verify.yml), CODEOWNERS and the docs/architecture/*.mmd sources into main on 2026-10-20. This branch now differs from main in 46 files and has been open 8 days. Its one unique fix, the pulp pin (c3d6710, fix(deps): pin pulp <4), will land in its own PR: main is red because pulp>=2.7.0 resolves to pulp 4, which fails 5 tests in tests/test_optimizer.py (LpVariable.__init__() got an unexpected keyword argument 'cat'). The commits remain reachable at refs/pull/8/head.

@G1DO G1DO closed this Oct 28, 2026
@G1DO
G1DO deleted the chore/main-verify-gate branch October 28, 2026 00:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@G1DO