Repository navigation
Upstream vendored-source filtering into the shared TODO scanner #279
Description
🤖 Generated by the Agentic Engineer
Evidence
Reviewing devantler-tech/ksail#6708 ("fix(ci): ignore vendored TODO comments"), the maintainer
commented:
Consider upstreaming filtering instead of this. That way we keep the integration pure.
That PR shipped a consumer-side ignore, and KSail's .github/workflows/todos.yaml still carries
it today:
uses: devantler-tech/actions/.github/workflows/scan-for-todo-comments.yaml@<pin> # v13.2.3
with:
ignore: "^third_party/"The reply on that PR deferred upstreaming because the then-current v13.2.1 exposed no ignore
input. That constraint no longer holds — the input exists as of the pin above — so the steer is
now actionable, and nothing tracks it.
Audience and problem
Every repository that vendors third-party sources consumes this shared scanner. Each one currently
has to know that vendored code produces false-positive TODO issues, and to write its own regex at
the call site. That is repo-specific knowledge living in the integration rather than in the shared
building block: the scanner files real GitHub issues, so a consumer that has not yet learned this
gets spurious issues filed against vendored code it does not own.
Hypothesis
If the shared scanner skips conventional vendored/third-party paths by default, consumers inherit
correct behaviour without configuring anything, and the call site reduces to uses: plus secrets —
the "pure integration" the steer asks for.
Success signal
- KSail's
todos.yamlno longer needs awith.ignoreblock for vendored sources, and its next
scanner run files no TODO issue for a path under a vendored directory. - No currently-consuming repository sees a change in which issues get filed, other than the
removal of vendored false positives.
Smallest useful change
Give the shared workflow a default ignore covering the conventional vendored roots, keeping the
existing ignore input as an override so present callers keep working unchanged.
Acceptance criteria
- The shared scanner excludes conventional vendored paths with no consumer configuration.
- An explicit
ignoreinput still overrides/extends the default — no silent behaviour change
for an existing caller that already passes one. - Contract coverage pins both states: a vendored path is skipped by default, and a
non-vendored path is still scanned (the negative control — a filter that skips everything
would otherwise pass a one-sided test). - KSail's call site drops its
with.ignorein a follow-up once this ships.
Size
Small. One workflow's input handling plus its tests, and a one-line follow-up in KSail.
Origin: maintainer steer on devantler-tech/ksail#6708.
Activity
chore: agent-claim #279 nonce=2ae026c053b320da694035509a79a534
devantler commentedon Oct 3, 2026
PR #396 is merged as
bf619b0ae132cf3ac7a032c91e41eefb706b41b4. This delivers the additive vendor filter with default false, custom-ignore precedence and root-only vendor/third_party matching. Current-head native CI passed 17 cases against the actual pinned scanner, including exact payloads for omitted/true/false/custom inputs, plus mutation controls.#394 remains the adoption and later retirement gate: review the released consumer pin, enable the option in a real caller, verify its native request behavior, and only then change the compatibility default or retire the input.
devantler commentedon Oct 3, 2026
The KSail follow-up requested here is delivered by PR #7469, merged at
96cb7bada4896099f25b963db7d6f05996cdf060: its consumer-owned ignore expression is removed and the canonical shared filter supplies the conventional-root behavior. Native consumer proof exercises the actual scanner and rejects a disabled filter, overbroad exclusion and corrupted expected payload; the first production scanner run on main succeeded.The feature is still an explicit opt-in. The no-configuration default promised by this parent is not declared delivered; #394 retains the caller census, default change and eventual input retirement, with explicit ignore compatibility.
devantler commentedon Oct 3, 2026
The fresh complete pinned public-portfolio metadata census finds eight direct scanner callers. KSail now binds the canonical scanner and explicitly opts into vendored filtering; go-template also binds the canonical scanner and omits that input. Six direct callers still bind the frozen scanner: data-product-controller, Platform, monorepo, dotnet-template, platform-template and homebrew-tap. The KSail actual-image replay and real main TODO run establish that adopter’s behavior, not the other seven callers.
The default flip and input retirement remain open. Remaining migration, pinned nested implementation resolution, compatibility behavior and each affected real consumer path must be evaluated before retiring the current opt-in contract. The static census examined all 252 public workflow/composite metadata files at fresh default-branch commits; it excludes private-source evidence and makes no claim about external consumers.
devantler commentedon Oct 4, 2026
Go-template now adopts the shared conventional vendor filter in devantler-tech/go-template#350, closing its consumer issue #349. It uses released canonical source 86bc632 with no consumer-owned ignore regex.
Native scaffold run 37223254323 executes the real pinned scanner with 13 expected requests, preserves owned-source scanning, and rejects disabled filtering, an overbroad ignore and corrupt issue payloads. The actual post-merge TODO workflow succeeded at e13188c9cab5e1329df9fca3f877523215534a4f: https://github.com/devantler-tech/go-template/actions/runs/37224599843.
The shared default is still opt-in. This issue stays open for the complete caller rollout and default behavior proof; #394 owns subsequent input retirement.
devantler commentedon Oct 29, 2026
Verified complete through PR #795, protected-merged as
d46f985f3397ecad9505f1161892ea686e1c9dccand published as v16.0.0. The tag independently resolves to that signed merge, and all 13 delivered files match the reviewed head.The post-merge CI run 40804443370 passed all 217 jobs (174 successful, 43 intentionally skipped). Its actual omitted-input production-step fixture selected the conventional vendor exclusion and passed verification. Custom-ignore precedence, owned-source scanning and disabled/overbroad-filter negative controls remain covered. All five default-branch publication, deployment and validation workflows succeeded.
A fresh complete census at 02:16 UTC checked all 26 active repositories and 213 workflows: the eight external consumers all use the shared vendor filter, with no consumer-owned ignore expression. Platform's final opt-in was independently verified in its ordinary main TODO run 40801355582. KSail's requested removal of its own ignore expression was already protected-merged in PR #7469 and remains present in the fresh source census.
All four original criteria are met. #394 remains open for removal of the temporary compatibility flag and the final immutable-pin rollout; that later lifecycle work is not claimed complete here.