Blog: twenty-seven CI runs, and not one of them a test

[kinlane]

A status note on 3 August's work in spotlight-tools, plus a roadmap data refresh.

Not merging — this publishes to the live site, so it is yours to review first.

The post

The framing is the honest one rather than the flattering one: the day's plan was the boring list (security settings, SECURITY.md, package metadata, branch protection), and the list turned up three things worse than anything on it.

• No test has ever run on this fork. All 27 Actions runs in its history were the inherited Jira workflow; every other workflow was filtered to develop or master, which do not exist here.
• That Jira workflow called stoplightio/.github@master with secrets: inherit on every issue label event. The post is careful to say there is no evidence anything happened and none is implied — the point made is the shape of the exposure, in a project founded on exactly that class of failure.
• Three published claims were wrong — the 42-branch premise in Blog: correct the build claim on 3 Aug, and add the follow-up #7, the "commit.yml already runs tests" premise in Research: industry rulesets, and why there is only one #10, and the framing of build(deps): bump actions/setup-node from 4 to 7 #3. Corrected as comments rather than edits, and the post says so.

It also carries the two arguments worth making publicly:

• A cleanup is not a find-and-replace. ~3,800 mentions across 578 files, most of which must not be touched — own package names, schema $id identifiers, and changelog links to real upstream issue numbers, which are correct and whose rewriting would be falsifying a changelog.
• Forking the linter did not fork the supply chain. Ten separately-published @stoplight/* packages remain live runtime dependencies. The post states plainly that this is a fair criticism of the project and does not have an answer yet.

It ends on what is not done — build unverified, nothing published, scope undecided, contributing guide only stapled — and on the claim it is actually willing to make: today's work made the project answerable, not better.

Two things I would particularly like a second read on: whether the Jira/secrets: inherit section is worded fairly toward upstream, and whether the closing section undersells or oversells the day.

Roadmap refresh

_data/roadmap.json regenerated via scripts/fetch_roadmap.py against both repositories. 18 items — 4 ready, 3 consensus, 10 discussing, 1 raised, 2 with pull requests.

Note that #7's title is included in that data and was retitled today, since the old one ("Map the 42 inherited branches to the 38 open upstream PRs") stated the number that turned out to be wrong and was rendering on the public roadmap page.

bundle exec jekyll build passes.

[kinlane]

Looks like a summary of the work accomplished -- keeps the provenance of what has been happening, which is my goal.