Repository navigation
fix: require repository-owned .NET matrix checks - #688
Conversation
This continues dotnet-template#534 after its repository-owned pipeline merged in #535. It requires each of the three native platform checks through a repository-scoped rule, using the observed GitHub Actions producer rather than introducing another App. At The original organization rule deliberately remains active. Neither this rendered declaration nor a passing configuration test proves native enforcement. After protected merge, publication and reconciliation, completion still requires a live repository-ruleset readback, all three jobs from the repository-owned workflow on an ordinary consumer PR, and native enforcement controls before removing the old organization rule. Native required status checks do not assert the immutable workflow-source identity provided by an organization-required workflow. Hosted CI and a current-head review remain required before promotion. This is the overlap stage, not the completed cutover. |
Code coverage overviewLanguages: Go, C# Go / code-coverage/test
C# / code-coverage/dotnet
Go / code-coverage/go
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
@coderabbitai full review |
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 10 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Native overlap readback found the local and injected .NET jobs both publish test () from the same GitHub Actions App. A producer binding alone therefore cannot distinguish them. I am correcting the native names to .NET template tests () and rebinding this policy to those distinct contexts before merge. The old organization rule remains active throughout. The correction will land in dotnet-template before this enforcement declaration. The prior review/head cannot authorize the updated policy. |
Updated head 4c3d90a binds the distinct native .NET template tests contexts. Native dotnet-template PR542 run 39669738137 now reports all three exact platform names successfully from GitHub Actions App 15368. Its branch is f8c54248516b8ebf93aff0a57343973ece268fdc, verified signed. The local rendered-policy regression passes; the old organization gate remains active. Merge PR542 first, then this policy only after its own new-head CI and review. |
At 4c3d90a, all 275 hosted checks are green. The repository ruleset now requires the distinct native matrix contexts delivered by dotnet-template#542, which has merged. The authenticated CodeRabbit quota reported on .github#690 at 20:44:16Z remains repository-scoped; moving to the next provider at this new exact head. @codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
At b6b6e3a, the reviewed Go ruleset is retained alongside this .NET ruleset after resolving the base conflict. All 275 hosted checks have completed successfully or as intended eligibility skips; the current head is signed, native CLEAN, and has zero unresolved threads. The previous review was for 4c3d90a and is not reused. The repository-scoped CodeRabbit quota observed at 20:44:16Z remains in its current hourly window, so requesting the ordered fallback at this exact head. @codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Merged head b6b6e3a as 8ff0e5b after clean exact-head Codex receipt 6327193626, 275 green/intended-skip checks, zero unresolved findings and normal head-pinned protected squash. Release v8.0.2 and CD run 39681181471 have completed. Native repository ruleset 25594865 is active with no bypass actors and all three distinct .NET template tests matrix contexts bound to GitHub Actions app 15368. The old organization gate remains active during the ordinary positive/refusal controls tracked by dotnet-template#534; rollout is not yet retired. |
Why
The .NET template now owns its validation, but its platform checks are still required through a temporary organization rule. Repository-specific enforcement is needed before that central dependency can be retired safely.
What
Require all three distinctly named local platform results through a repository ruleset, bound to GitHub Actions. Keep the old protection during deployment and consumer verification, continuing the template ownership migration.
Part of #56