mirror of
https://github.com/garrytan/gbrain.git
synced 2026-08-14 00:48:18 +00:00
v0.42.73.1 revert(ci): remove the PR gate and withdraw the v0.42.72.1 contribution requirements (#3805)
* v0.42.73.1 revert(ci): remove the PR gate — it cannot function on this repository
The gate needs an ANTHROPIC_API_KEY Actions secret for its verdict and
read-write workflow permissions to post a comment or set a label. This
repository grants neither, and both are admin-only, so it can only ever skip.
It also caused a real incident before that was understood: a read-only token
turned every API call into a 403, the code treated that as a crash, and the
check went red on an outside contributor's PR four times with no comment
explaining why. v0.42.73.0 fixed the crash, but a check that runs on every PR
and can never reach a verdict does not earn a place in the repo.
Removes the workflow, the script, its type surface, and its test file. The code
is preserved in git history at v0.42.73.0. If it is ever restored, the
mechanical half (intent/screenshot policy, title rule, red flags) should render
to the Actions job summary rather than a comment — that needs no token
permission and no API key.
CONTRIBUTING.md's intent-paragraph and screenshot requirement is unchanged and
stands as written; it is enforced by maintainers reading PRs, as before.
typecheck clean, verify 34/34, llms bundles regenerated.
* v0.42.73.1 revert(docs): withdraw the human-intent-paragraph + screenshot contribution requirement
This reverts commit 6d1232d5a6 (v0.42.72.1).
CONTRIBUTING.md, both issue templates, and the pull-request template return
to their pre-2026-08-02 state. VERSION/package.json/CHANGELOG keep moving
forward (0.42.73.1); the v0.42.72.1 CHANGELOG entry stays as historical
record, and the 0.42.73.1 entry now describes the withdrawal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Garry Tan <garrytan@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sina Matian
co-authored by
Claude Fable 5
Garry Tan
Claude Fable 5
Garry Tan
parent
e5dee4fb78
commit
aecb33e795
@@ -4,19 +4,6 @@ about: Something isn't working
|
||||
labels: bug
|
||||
---
|
||||
|
||||
**Why are you opening this? (human-written, required)**
|
||||
|
||||
<!-- Write this yourself. Not AI-generated, not AI-polished. What were you
|
||||
doing, what happened, why does it matter to you? Rough is fine.
|
||||
Issues/PRs without this are closed unreviewed. -->
|
||||
|
||||
|
||||
**Screenshot of gbrain in use (required)**
|
||||
|
||||
<!-- Your terminal / agent session / logs showing the real situation.
|
||||
Redact private names, keys, and brain contents first. -->
|
||||
|
||||
|
||||
**What happened?**
|
||||
|
||||
|
||||
|
||||
@@ -4,19 +4,6 @@ about: Suggest an improvement
|
||||
labels: enhancement
|
||||
---
|
||||
|
||||
**Why are you opening this? (human-written, required)**
|
||||
|
||||
<!-- Write this yourself. Not AI-generated, not AI-polished. What were you
|
||||
doing, what happened, why does it matter to you? Rough is fine.
|
||||
Issues/PRs without this are closed unreviewed. -->
|
||||
|
||||
|
||||
**Screenshot of gbrain in use (required)**
|
||||
|
||||
<!-- Your terminal / agent session / logs showing the real situation.
|
||||
Redact private names, keys, and brain contents first. -->
|
||||
|
||||
|
||||
**What problem does this solve?**
|
||||
|
||||
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
**Why are you opening this? (human-written, required)**
|
||||
|
||||
<!-- Write this yourself. Not AI-generated, not AI-polished. What were you
|
||||
doing, what went wrong or what you needed, why it matters to you.
|
||||
Rough grammar is fine. PRs without this are closed unreviewed. -->
|
||||
|
||||
|
||||
**Screenshot of gbrain in use (required)**
|
||||
|
||||
<!-- Your terminal / agent session / logs showing the real need this fixes.
|
||||
Redact private names, keys, and brain contents first. -->
|
||||
|
||||
|
||||
**What changed**
|
||||
|
||||
|
||||
**How it was tested**
|
||||
@@ -1,110 +0,0 @@
|
||||
name: PR Gate
|
||||
|
||||
# Strict PR usefulness gate (#3698): classifies every PR to master into
|
||||
# merge-lane / close-lane / needs-maintainer BEFORE any human review effort.
|
||||
# Verdict + reviewer checklist land in one sticky comment; exactly one
|
||||
# gate:* label is applied; close-lane exits 1 (red X = strong signal).
|
||||
#
|
||||
# SECURITY MODEL (pull_request_target on a 30k-star public repo):
|
||||
# - PR code is NEVER checked out or executed. Metadata + diff come from the
|
||||
# GitHub API only; the diff is capped at 120KB.
|
||||
# - The checkout below is the BASE repo (master) — rubric/script only.
|
||||
# NEVER add a `ref:` pointing at the PR head.
|
||||
# - Attacker-controlled values (title/body/diff) never touch the shell:
|
||||
# every ${{ }} is env-bound; run: scripts use plain env vars.
|
||||
# - Only the issues API is used (comments + labels), so issues:write is the
|
||||
# single write grant; the checkout drops its credentials.
|
||||
# - The mechanical CONTRIBUTING.md #3745 check (intent paragraph + screenshot)
|
||||
# runs BEFORE any API dependency, so a PR missing either still lands in
|
||||
# close-lane during an Anthropic outage — an outage is not a way through.
|
||||
# - If ANTHROPIC_API_KEY is missing or the API is unreachable on an otherwise
|
||||
# compliant PR, the script NEUTRAL-skips loudly (sticky comment + warning
|
||||
# annotation, exit 0) and CLEARS any stale gate:* label — never a silent
|
||||
# green, never a red X for a missing secret, never a stale verdict. A model
|
||||
# REFUSAL is not a skip: it routes to needs-maintainer so refusing is not a
|
||||
# way to dodge the gate.
|
||||
#
|
||||
# #3745 EXEMPTION (deliberate — mirrors policyExemption() in
|
||||
# scripts/pr-gate.mjs): the intent-paragraph + screenshot requirement filters
|
||||
# INCOMING OUTSIDE CONTRIBUTIONS. It is waived for repo owners / members /
|
||||
# collaborators, bot authors, and drafts.
|
||||
# Release automation cannot take a screenshot of itself, and without the
|
||||
# exemption every /ship release PR lands in close-lane
|
||||
# (measured: 40 of the last 40 merged PRs) — a check that is red
|
||||
# on every release gets switched off within a week, and then it filters
|
||||
# nothing. Exempt PRs still get the FULL usefulness verdict, the title rule and
|
||||
# every mechanical red flag; only the description requirement is skipped, and
|
||||
# the sticky comment says so on its own line.
|
||||
# author_association / draft / user.type are read from the pr.json fetched
|
||||
# below — GitHub-computed, not author-settable (except `draft`), and already
|
||||
# on disk, so nothing new is fetched and there is one source of truth.
|
||||
# `ready_for_review` is in the trigger list precisely because `draft` IS
|
||||
# author-settable: leaving draft re-runs the gate with the exemption gone, and
|
||||
# the exemption is folded into the spend-guard hash so the draft-era verdict
|
||||
# cannot be reused.
|
||||
# Pinned by test/pr-gate-workflow.test.ts.
|
||||
|
||||
on:
|
||||
pull_request_target:
|
||||
types: [opened, edited, synchronize, reopened, ready_for_review]
|
||||
branches: [master]
|
||||
|
||||
# issues:write is the ONLY write grant. Everything the script calls is the
|
||||
# issues API (comments, label create, label add/remove on the PR's issue), so
|
||||
# pull-requests:write would be a redundant second grant on the same objects.
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
|
||||
concurrency:
|
||||
group: pr-gate-${{ github.event.pull_request.number }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
gate:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
# Base repo (master) only — provides scripts/pr-gate.mjs.
|
||||
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
||||
with:
|
||||
# Nothing here needs git auth after the clone; don't leave a token
|
||||
# in .git/config for the rest of the job.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Fetch PR metadata + diff (API only — PR code is never checked out)
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
REPO: ${{ github.repository }}
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
mkdir -p "$RUNNER_TEMP/pr-gate"
|
||||
gh api "repos/${REPO}/pulls/${PR_NUMBER}" > "$RUNNER_TEMP/pr-gate/pr.json"
|
||||
# First 100 files is enough: red flags key off pr.json's changed_files
|
||||
# count, and >40 files already flags.
|
||||
gh api "repos/${REPO}/pulls/${PR_NUMBER}/files?per_page=100" \
|
||||
> "$RUNNER_TEMP/pr-gate/files.json"
|
||||
# Diff via the .diff media type; GitHub can 406 on huge diffs —
|
||||
# degrade to a marker instead of failing the gate.
|
||||
gh api "repos/${REPO}/pulls/${PR_NUMBER}" \
|
||||
-H "Accept: application/vnd.github.diff" \
|
||||
> "$RUNNER_TEMP/pr-gate/pr.diff.full" \
|
||||
|| printf '[diff unavailable from the GitHub API — too large or unfetchable]\n' \
|
||||
> "$RUNNER_TEMP/pr-gate/pr.diff.full"
|
||||
MAX=122880 # 120KB cap
|
||||
if [ "$(wc -c < "$RUNNER_TEMP/pr-gate/pr.diff.full")" -gt "$MAX" ]; then
|
||||
head -c "$MAX" "$RUNNER_TEMP/pr-gate/pr.diff.full" > "$RUNNER_TEMP/pr-gate/pr.diff"
|
||||
printf '\n\n[TRUNCATED: diff capped at 120KB]\n' >> "$RUNNER_TEMP/pr-gate/pr.diff"
|
||||
else
|
||||
mv "$RUNNER_TEMP/pr-gate/pr.diff.full" "$RUNNER_TEMP/pr-gate/pr.diff"
|
||||
fi
|
||||
rm -f "$RUNNER_TEMP/pr-gate/pr.diff.full"
|
||||
|
||||
- name: Gate verdict (sticky comment + label; exit 1 only on close-lane)
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ github.token }}
|
||||
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
GITHUB_REPOSITORY: ${{ github.repository }}
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
run: node scripts/pr-gate.mjs "$RUNNER_TEMP/pr-gate"
|
||||
Reference in New Issue
Block a user