[cpitzi]

Closes #295

Summary

Rewrites the two required-checks hints at the end of fleet-apply.sh's read-only run. Both described the flow from before Terraform owned required checks.

• Missing mapped checks. The old hint said to run fleet-apply.sh --require-checks, the path fleet-ops/README.md now describes as racing the Terraform state. The new hint says terraform/ makes required-checks.json live, so the change goes through a PR. It should merge once this read-only preflight shows no ✗ req-checks never-seen-on-a-PR for it (the marker added in fleet-ops: run the required-context preflight in the read-only check #294). The apply on merge to main then requires it, and the PR's plan shows the ruleset diff.
• Live required checks not in the file. The old hint said "a --require-checks sweep would REMOVE them". The new hint says the next terraform apply on main removes them, and a terraform/ PR's plan shows it. The remedy line (add the context to required-checks.json, or confirm the removal is intentional) is unchanged.

That is the flow #291 just followed. Its change to fleet-ops/required-checks.json alone produced a one-resource plan on the PR, and the apply on merge made it live.

Testing

I ran a scratch copy against a scratch required-checks.json that adds a bogus Batz to epigaea and drops its live check-config, so both hints fire:

  • epigaea                     ⧗ req-checks missing=[Batz] ✗ req-checks never-seen-on-a-PR=[Batz] ⚠ req-checks live-not-in-file=[check-config]
required-checks — 1 repo(s) missing mapped checks. terraform/ makes required-checks.json live: merge the change through a PR once this read-only preflight shows no '✗ req-checks never-seen-on-a-PR' for it, and the terraform apply on merge to main requires it (the PR's plan shows the ruleset diff).
required-checks — 1 repo(s) have live required check(s) not in required-checks.json. The next terraform apply on main will REMOVE them from the ruleset (a terraform/ PR's plan shows it). Add the missing context(s) to required-checks.json, or confirm the removal is intentional.

Against the real config, neither hint fires (✓ epigaea settings ok). shellcheck is clean and python3 ci/validate.py passes.

Scope

Only these two echo hints change. The --require-checks path, its own completion message, and the rest of the summary are untouched.

🤖 Generated with Claude Code

[github-actions]

Review (haiku, claude-review.yml)

No significant problems found. The two hint strings in fleet-ops/fleet-apply.sh:397-404 match the behaviour they describe: the ✗ req-checks never-seen-on-a-PR marker exists at line 287, terraform/locals.tf:11 reads required-checks.json directly, and rulesets.tf replaces the ruleset from that file on apply. The PR links Closes #295, its title matches the change, and its summary covers what, why and constraints. No README or CHANGELOG changed, so the co-authorship rule does not apply.

[cpitzi]

Review triage

The review reported no findings, so there's nothing to triage. Arming auto-merge.