Repository navigation
Add an org-wide repository hygiene sweep that runs on a public runner #123
Description
What to build
The Repository Hygiene guard fires on every opened/reopened/synchronize in fleet-infra and nix-config — roughly 73 runs a week, each a single job averaging 6.6 seconds and each billing a full minute. That is ~292 minutes/month.
The guard reads pull-request metadata. It needs no private repository content, so it can run in a public repo against the API and cost nothing.
Add an org-wide hygiene sweep to this repo that evaluates open pull requests across the organization on a schedule, and a scheduled caller in the public .github repo.
Understand the trade-off before building this. A sweep is not equivalent to the current gate. Today hygiene is a blocking per-PR check; a cron sweep is advisory — it reports after the fact and cannot stop a merge. If hygiene must stay blocking on any repo, this ticket should relocate only the repos where advisory is acceptable, and say plainly which ones stay on the per-PR gate. Do not silently downgrade a required check into a notification.
Report findings somewhere a human actually reads — a comment on the offending PR, or a single rolled-up issue — not just a workflow summary nobody opens.
Acceptance criteria
- An org-wide hygiene sweep runs from the public
.githubrepo and is billed as free - It reaches private-repo pull requests via an App token, with unreachable repos warned about rather than skipped silently
- A PR that violates hygiene is surfaced somewhere visible, not only in a run summary
- The decision about which repos keep the blocking per-PR gate is written down, with reasoning
- The sweep is verified to actually fail when given a known-bad PR — confirm the gate can fail before trusting that it passes
Blocked by
- None — can start immediately.
Activity
ExtraToast commentedon Aug 27, 2026
Correction to this issue's premise.
This issue says the sweep drops a per-PR blocking gate and tells the implementer to decide which repos keep it. That decision isn't needed — there is no blocking gate to keep.
Repository Hygieneis not a required status check in any repo in this org. OnlyPipeline Completeis, and no repo uses classic branch protection. Read directly from the rulesets:So the guard already only reported, and the advisory sweep is a like-for-like replacement rather than a downgrade.
Implemented in #125 and verified against the live org, including proving the gate can fail rather than only that it passed:
deny: **/*.yml(negative control)allowlist: .*exclude-reposfeat(hygiene): add an advisory org-wide repository hygiene sweep (#125)