From d609468607795a3f51f47527b1e20738974f6502 Mon Sep 17 00:00:00 2001 From: gauravs19 Date: Sun, 7 Jun 2026 00:01:10 +0530 Subject: [PATCH] fix: harden repo hygiene and CI plumbing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - generate_diagrams.py: replace hardcoded absolute Windows path with Path(__file__)-relative target so any contributor can run it - rules/29-agentic-ai-governance.md: repair UTF-8 mojibake on related- standards table (replacement chars rendered as broken boxes on GitHub) - .gitignore: add .specs/, Python cache, venv, and OS artefacts; prevents accidental commit of generated client architecture docs - .github/workflows/archpilot-lint.yml: replace non-existent gauravs19/archpilot-reviewer@v1 action (was silently never running from wrong workflows/ directory) with a real Python + archpilot lint step that gates PRs touching .specs/ or rules/ - workflows/archpilot-review.yml: deleted (wrong directory, broken action, wrong API key ref — superseded by .github/workflows/archpilot-lint.yml) --- .github/workflows/archpilot-lint.yml | 33 +++++++++++++++++++++++++++ .gitignore | 16 +++++++++++++ rules/29-agentic-ai-governance.md | 16 ++++++------- tools/generate_diagrams.py | 2 +- workflows/archpilot-review.yml | 34 ---------------------------- 5 files changed, 58 insertions(+), 43 deletions(-) create mode 100644 .github/workflows/archpilot-lint.yml create mode 100644 .gitignore delete mode 100644 workflows/archpilot-review.yml diff --git a/.github/workflows/archpilot-lint.yml b/.github/workflows/archpilot-lint.yml new file mode 100644 index 0000000..1bb7462 --- /dev/null +++ b/.github/workflows/archpilot-lint.yml @@ -0,0 +1,33 @@ +name: Archpilot Lint + +on: + pull_request: + paths: + - '.specs/**' + - 'rules/**' + - 'templates/**' + push: + branches: [main] + paths: + - '.specs/**' + +jobs: + lint: + name: Lint architecture specs (Tier 2) + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + cache: 'pip' + + - name: Install dependencies + run: pip install -r requirements.txt + + - name: Run Archpilot linter + run: python archpilot.py lint --dir . --tier 2 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b3fc8c4 --- /dev/null +++ b/.gitignore @@ -0,0 +1,16 @@ +# Archpilot generated artifacts — commit intentionally, not by default +.specs/ + +# Python +__pycache__/ +*.py[cod] +*.egg-info/ +dist/ +build/ +.venv/ +venv/ +.env + +# OS +.DS_Store +Thumbs.db diff --git a/rules/29-agentic-ai-governance.md b/rules/29-agentic-ai-governance.md index 5c815e2..fc24049 100644 --- a/rules/29-agentic-ai-governance.md +++ b/rules/29-agentic-ai-governance.md @@ -11,10 +11,10 @@ | Standard | Relationship | |----------|-------------| -| [27 — Spec-Driven Development](./27-spec-driven-development.md) | Specs constrain agent behavior | -| [28 — Context Engineering](./28-context-engineering.md) | Context design for agent isolation | -| [07 — Security Architecture](./07-security-architecture.md) | Security controls for agents | -| [18 — Architecture Governance](./18-architecture-governance.md) | Broader governance framework | +| [27 - Spec-Driven Development](./27-spec-driven-development.md) | Specs constrain agent behavior | +| [28 - Context Engineering](./28-context-engineering.md) | Context design for agent isolation | +| [07 - Security Architecture](./07-security-architecture.md) | Security controls for agents | +| [18 - Architecture Governance](./18-architecture-governance.md) | Broader governance framework | --- @@ -63,7 +63,7 @@ Every agent deployment MUST enforce: - [ ] **Scope boundary:** Agent can ONLY access files/APIs listed in its task context - [ ] **No-write zones:** Define protected paths/resources agents cannot modify (e.g., `/.env`, migration files, production configs) -- [ ] **Command allowlist:** Shell/CLI commands available to agents are explicitly allowlisted — deny by default +- [ ] **Command allowlist:** Shell/CLI commands available to agents are explicitly allowlisted � deny by default - [ ] **External network isolation:** Agents in dev/test MUST NOT call production APIs - [ ] **Secret protection:** Agents MUST NOT log, print, or include secrets in any artifact - [ ] **Cost guardrails:** Max spend per agent run defined and enforced via budget alerts @@ -84,7 +84,7 @@ Define checkpoints where human review is mandatory: ### 3.3 Blast Radius Minimization -- Agents MUST operate on feature branches — never directly on `main` or `release` +- Agents MUST operate on feature branches � never directly on `main` or `release` - Each agent task MUST be scoped to the minimum set of files required - Destructive operations (deletes, truncates, revokes) MUST require explicit human confirmation - Agent changes MUST be reversible: no irreversible action without a documented rollback @@ -147,7 +147,7 @@ Human (highest trust) ``` **Rule:** Sub-agents cannot elevate their own trust level. -**Rule:** Sub-agents cannot directly communicate with each other — all routing goes through orchestrator. +**Rule:** Sub-agents cannot directly communicate with each other � all routing goes through orchestrator. **Rule:** Orchestrator cannot execute code directly; it delegates to specialist agents. ### 5.3 Agent Failure Handling @@ -204,5 +204,5 @@ Before merging any agent-generated artifact: --- -*Archpilot — Enterprise Architecture Standards Library* +*Archpilot � Enterprise Architecture Standards Library* *Created by Gaurav Sharma* diff --git a/tools/generate_diagrams.py b/tools/generate_diagrams.py index bcec299..fb71c6c 100644 --- a/tools/generate_diagrams.py +++ b/tools/generate_diagrams.py @@ -254,7 +254,7 @@ } def main(): - target_dir = r"d:\_elfor\code\ag-wks\archpilot\diagrams" + target_dir = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "diagrams") if not os.path.exists(target_dir): os.makedirs(target_dir) diff --git a/workflows/archpilot-review.yml b/workflows/archpilot-review.yml deleted file mode 100644 index cbd69c8..0000000 --- a/workflows/archpilot-review.yml +++ /dev/null @@ -1,34 +0,0 @@ -# .github/workflows/archpilot-review.yml -name: Archpilot AI Architecture Review - -on: - pull_request: - paths: - - 'docs/**' # Trigger only when files in the docs folder change - - 'architecture/**' - -jobs: - archpilot-review: - runs-on: ubuntu-latest - steps: - - name: Checkout Repository - uses: actions/checkout@v4 - - - name: Archpilot AI Reviewer - uses: gauravs19/archpilot-reviewer@v1 - with: - # Required: GitHub token for posting comments - github_token: ${{ secrets.GITHUB_TOKEN }} - - # Required: OpenAI API Key (or other supported providers) - # Make sure to add this to your Repo Secrets! - openai_api_key: ${{ secrets.OPENAI_API_KEY }} - - # Optional: Central rules repo (Default is current repo) - rules_repo: 'gauravs19/archpilot' - - # Optional: Path to rules within the rules_repo - rules_path: 'rules' - - # Optional: Path to architecture docs in THIS repo - docs_path: './docs'