Fix PR lens review: inline comments + split confidence thresholds #101

Workflow file for this run

.github/workflows/codex-rails-check.yml at 65e21d9

	name: codex-rails-check

	on:
	pull_request:
	paths:
	- "AGENTS.md"
	- "**/AGENTS.md"
	- "labels.yml"
	- "README.md"
	- ".github/CODEOWNERS"
	- ".agents/skills/**"
	- ".github/agent-mcp/**"
	- ".github/actionlint.yaml"
	- ".github/codex/hooks/**"
	- ".github/codex/schemas/**"
	- ".github/contracts/**"
	- ".github/scripts/**"
	- ".github/ISSUE_TEMPLATE/**"
	- ".github/pull_request_template.md"
	- ".github/workflows/**"
	- ".github/workflow-templates/**"
	- "profile/**"
	- "services.yaml"
	- "test/**"
	workflow_call:
	inputs:
	require_agents:
	description: "Fail when the repository does not have AGENTS.md"
	required: false
	type: boolean
	default: false
	runner_label:
	description: "Runner label used for the validation job"
	required: false
	type: string
	default: ubuntu-latest

	permissions:
	contents: read

	jobs:
	validate:
	runs-on: ${{ inputs.runner_label \|\| 'ubuntu-latest' }}
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

	- name: Validate issue template YAML
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s globstar nullglob
	files=(.github/ISSUE_TEMPLATE/.yml .github/ISSUE_TEMPLATE/.yaml)
	if [ "${#files[@]}" -eq 0 ]; then
	echo "No issue template YAML files found."
	exit 0
	fi
	ruby -e 'require "yaml"; ARGV.each { \|f\| YAML.load_file(f); puts "ok #{f}" }' "${files[@]}"

	- name: Validate workflow YAML
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s nullglob
	files=(.github/workflows/.yml .github/workflows/.yaml .github/workflow-templates/.yml .github/workflow-templates/.yaml)
	if [ "${#files[@]}" -eq 0 ]; then
	echo "No workflow YAML files found."
	exit 0
	fi
	ruby -e 'require "yaml"; ARGV.each { \|f\| YAML.load_file(f); puts "ok #{f}" }' "${files[@]}"

	- name: Lint workflow semantics
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s nullglob
	files=(.github/workflows/.yml .github/workflows/.yaml .github/workflow-templates/.yml .github/workflow-templates/.yaml)
	if [ "${#files[@]}" -eq 0 ]; then
	echo "No workflow YAML files found."
	exit 0
	fi
	if command -v actionlint >/dev/null 2>&1; then
	actionlint -shellcheck= -pyflakes= "${files[@]}"
	else
	go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -shellcheck= -pyflakes= "${files[@]}"
	fi

	- name: Reject prohibited code scanning actions
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s nullglob
	files=(.github/workflows/.yml .github/workflows/.yaml .github/workflow-templates/.yml .github/workflow-templates/.yaml)
	if [ "${#files[@]}" -eq 0 ]; then
	echo "No workflow YAML files found."
	exit 0
	fi
	blocked_owner="github"
	blocked_prefix="code"
	blocked_suffix="ql-action"
	blocked="${blocked_owner}/${blocked_prefix}${blocked_suffix}"
	if grep -RInE "^[[:space:]](-[[:space:]])?uses:[[:space:]]*${blocked}([/@[:space:]]\|$)" "${files[@]}"; then
	echo "::error::EvalOps does not use GitHub default code scanning. Remove this workflow action and use bounded repo-owned checks instead."
	exit 1
	fi
	echo "ok: no prohibited GitHub default code-scanning action references"

	- name: Validate workflow template metadata
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s nullglob
	files=(.github/workflow-templates/*.properties.json)
	if [ "${#files[@]}" -eq 0 ]; then
	echo "No workflow template metadata files found."
	exit 0
	fi
	ruby -e '
	require "json"
	ARGV.each do \|f\|
	data = JSON.parse(File.read(f))
	icon = data["iconName"].to_s
	if !icon.empty? && !icon.match?(/\Aocticon [a-z0-9-]+\z/) && !File.exist?(".github/workflow-templates/#{icon}.svg")
	warn "#{f}: iconName must be an octicon reference like \"octicon tag\" or a local SVG basename"
	exit 1
	end
	puts "ok #{f}"
	end
	' "${files[@]}"

	- name: Validate Codex JSON schemas
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s nullglob
	files=(.github/codex/schemas/*.json)
	if [ "${#files[@]}" -eq 0 ]; then
	echo "No Codex JSON schemas found."
	exit 0
	fi
	ruby -e 'require "json"; ARGV.each { \|f\| JSON.parse(File.read(f)); puts "ok #{f}" }' "${files[@]}"

	- name: Validate org control plane contract
	shell: bash
	run: \|
	set -euo pipefail
	if [ ! -f .github/contracts/org-control-plane.yml ]; then
	echo "No org control plane contract found."
	exit 0
	fi

	ruby .github/scripts/verify-org-control-plane-contract.rb \
	--json-output org-control-plane-contract-report.json \
	--markdown-output org-control-plane-contract-report.md
	cat org-control-plane-contract-report.md >> "${GITHUB_STEP_SUMMARY}"

	- name: Validate engineering practices contract
	shell: bash
	run: \|
	set -euo pipefail
	if [ ! -f .github/contracts/engineering-practices.yml ]; then
	echo "No engineering practices contract found."
	exit 0
	fi

	ruby .github/scripts/audit-engineering-practices.rb \
	--contract-only \
	--json-output engineering-practices-contract-report.json \
	--markdown-output engineering-practices-contract-report.md
	cat engineering-practices-contract-report.md >> "${GITHUB_STEP_SUMMARY}"

	- name: Validate canonical labels
	shell: bash
	run: \|
	set -euo pipefail
	if [ ! -f labels.yml ]; then
	echo "No labels.yml found."
	exit 0
	fi

	ruby .github/scripts/sync-labels.rb --validate-only --labels labels.yml

	- name: Check AGENTS.md files
	shell: bash
	env:
	REQUIRE_AGENTS: ${{ inputs.require_agents \|\| false }}
	run: \|
	set -euo pipefail
	shopt -s globstar nullglob
	if [ "${REQUIRE_AGENTS}" = "true" ] && [ ! -f AGENTS.md ]; then
	echo "::error::AGENTS.md is required for this repository."
	exit 1
	fi

	agents=(**/AGENTS.md)
	if [ "${#agents[@]}" -eq 0 ]; then
	echo "No AGENTS.md files found."
	exit 0
	fi

	for agent in "${agents[@]}"; do
	test -s "${agent}" \|\| { echo "::error::${agent} is empty"; exit 1; }
	echo "ok ${agent}"
	done

	- name: Validate skill frontmatter
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s globstar nullglob
	skills=(.agents/skills/**/SKILL.md)
	if [ "${#skills[@]}" -eq 0 ]; then
	echo "No repo skills found."
	exit 0
	fi

	for skill in "${skills[@]}"; do
	echo "checking ${skill}"
	ruby -e '
	path = ARGV.fetch(0)
	text = File.read(path)
	unless text.start_with?("---\n")
	warn "#{path}: missing YAML frontmatter"
	exit 1
	end
	_, yaml, = text.split(/^---\s*$/, 3)
	require "yaml"
	data = YAML.safe_load(yaml)
	unless data.is_a?(Hash) && data["name"].to_s.match?(/\A[a-z0-9][a-z0-9_-]*\z/)
	warn "#{path}: frontmatter must include kebab/snake-safe name"
	exit 1
	end
	unless data["description"].to_s.strip.length >= 20
	warn "#{path}: frontmatter must include a useful description"
	exit 1
	end
	' "${skill}"
	done

	- name: Validate service catalog
	shell: bash
	run: \|
	set -euo pipefail
	if [ ! -f services.yaml ]; then
	echo "No services.yaml found."
	exit 0
	fi

	if [ ! -f .github/scripts/validate-services-catalog.rb ]; then
	echo "::error::.github/scripts/validate-services-catalog.rb is required when services.yaml exists."
	exit 1
	fi

	ruby .github/scripts/validate-services-catalog.rb services.yaml

	- name: Run repo Ruby tests
	shell: bash
	run: \|
	set -euo pipefail
	shopt -s globstar nullglob
	tests=(test/*/_test.rb)
	if [ "${#tests[@]}" -eq 0 ]; then
	echo "No Ruby tests found."
	exit 0
	fi

	ruby -Itest -e 'ARGV.each { \|path\| require "./#{path}" }' "${tests[@]}"

Navigation Menu

Uh oh!

Fix PR lens review: inline comments + split confidence thresholds #101

Workflow file

Fix PR lens review: inline comments + split confidence thresholds #101

Uh oh!

Workflow file for this run