Skip to content

feat(github-actions-conventions): admit claude-code-plugins' workflow names - #984

Merged
kyle-sexton merged 8 commits into
mainfrom
feat/naming-vocab-ccp-adoption
Nov 12, 2026
Merged

kyle-sexton merged 8 commits into
mainfrom
feat/naming-vocab-ccp-adoption

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Nov 11, 2026 •

Copy link
Copy Markdown
Member

Refs: melodic-software/claude-code-plugins#15394

Summary

Lets claude-code-plugins run naming-lint enforcing inside its required check (owner decision Q33: every org repository runs the lint). Today it has 20 blocking findings, all file or action-directory names.

Stacked on #983.

Fix

  • Fourteen findings are verb-first names whose words the vocabulary lacked. Adds function words (intake reenter; maintenance audit-lane-runs, check-upstream-drift, delete-stale-branches, file-dead-links, file-recurring-issues, monitor-signals, reconcile-lost-runs; post-merge select-mutation-range, test-mutation; pr rate-merge-risk) and verbs delete, log, monitor, open, rate, reenter, seal.
  • Six need renames (dependabot-fragments, eval-browser-dispatch, eval-hill-climb-pass, security-outside-actor, pr-feedback-dispatch, post-merge-demotion-alert), tracked in ci: rename six workflows the org naming lint rejects claude-code-plugins#15394. Each gets a repository-scoped workflow-filename exemption naming that issue; every other rule still applies to those files.
  • README "Exemptions" describes both kinds of entry (OIDC trust inputs, pending renames); it said the list held one entry.
  • The synced callers get Title Case job names: managed-files-guard (both variants) pr-check-managed-files is named PR Check Managed Files, now the check context on every target; no ruleset requires it, and the only reader found (claude-code-plugins reconcile.mjs) keys on the workflow path. lychee-online's claude-code-plugins caller check-links is named Check Links. Test and docs follow (managed-files-guard.test.sh: 167 pass).
  • The loader test that deletes an exemption's expectedName now picks a workflow-name exemption instead of index 0.

Verification

  • node --test components/github-actions-conventions/naming-lint.test.mjs: 21 pass, 0 fail.
  • Enforcing run over a claude-code-plugins origin/main snapshot: 334 finding(s), 0 blocking (all warnings: job-name, step-name, job-id).

Related

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe

kyle-sexton and others added 5 commits November 11, 2026 11:04
…ames

naming-lint gains three rules and tightens one:

- job-name: every job has a Title Case display name, separate from its
  id; expressions keep their place ("Drift (${{ matrix.skill }})"). The
  ci-status job is named exactly "CI Status", and the report-ci-status
  alias job keeps the required context "ci-status" until the github-iac
  ci-gate ruleset requires "CI Status" (jobNameExceptions).
- step-name: step names are sentence case, as GitHub's own steps are;
  a later capitalized word must be in the new properNouns list, an
  acronym or a mixed-case name.
- action-name: an action's name is its directory's Title Case form.
- workflow-name: accepts the Title Case form only (or a recorded
  exception); the bare stem no longer passes.

job-name and step-name report at the vocabulary's displayNameLevel,
warning for now: ci-workflows runs the analyzer from standards main,
so error would block it before its jobs are named. The README replaces
"never rename ci-status" with the three-step rename the alias supports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
… names

claude-code-plugins cannot run naming-lint enforcing today: 20 blocking
findings, every one a file or action-directory name. Fourteen are
verb-first names whose words the vocabulary lacked, so this adds the
function words (intake reenter; maintenance audit-lane-runs,
check-upstream-drift, delete-stale-branches, file-dead-links,
file-recurring-issues, monitor-signals, reconcile-lost-runs; post-merge
select-mutation-range, test-mutation; pr rate-merge-risk) and the verbs
delete, log, monitor, open, rate, reenter and seal.

The other six need renames, tracked in
melodic-software/claude-code-plugins#15394; each gets a repository-scoped
workflow-filename exemption naming that issue, so every other rule still
applies to them. The README's exemptions section now describes both kinds
of entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
Review fixes for #983:

- step-name removed a multi-word proper noun before tokenizing, so the
  word after a leading "Claude Code" or "Pulumi Cloud" became the first
  word and escaped the capitalization check ("Claude Code Review"
  passed). Tokens now keep their positions; a multi-word noun exempts
  its words only where they appear together, so "Code" alone is no
  longer exempt either.
- The README's display-name rollout links its completion issue,
  standards#985, due 2026-12-11, as the enforcement rollout requires.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
The org job-name rule (#983) wants a Title Case display name on every
job, and these synced callers are the last two jobs in
claude-code-plugins without one:

- managed-files-guard and its fleet variant: job pr-check-managed-files
  is named "PR Check Managed Files", which becomes the check context on
  every target. No ruleset requires that context; the only reader found
  (claude-code-plugins reconcile.mjs) keys on the workflow path.
- lychee-online's claude-code-plugins caller: job check-links is named
  "Check Links".

The test and the docs that stated the context now name it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
Base automatically changed from feat/job-step-name-lint to main November 11, 2026 23:30
kyle-sexton and others added 2 commits November 11, 2026 18:30
…-adoption

# Conflicts:
#	components/github-actions-conventions/naming-lint.mjs
#	components/github-actions-conventions/naming-lint.test.mjs
…rule

The loader test assumed exemptions[0] waives workflow-name; the
workflow-filename exemptions this branch adds now sort first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
@kyle-sexton
kyle-sexton marked this pull request as ready for review November 11, 2026 23:54
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 11, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T23:56:17.059770Z 953436e Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

github-actions Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

claude-security-review needs no new review of 4516351cc1f2cce6977a8d77753e74dc3c12ca72: every file in scope matches docs-only-paths.

No security issues found in this pull request.

I read the full diff (10 files). It is naming and vocabulary work plus documentation:

  • Vocabulary: new verb and function entries in components/github-actions-conventions/vocabulary.json.
  • Exemptions: six new workflow-filename-only exemptions for melodic-software/claude-code-plugins. They exempt one lint rule on named paths, and the reason on each entry links its removal to ci: rename six workflows the org naming lint rejects claude-code-plugins#15394. They gate no trust decision.
  • Job name: the managed-files-guard callers change their job name: to PR Check Managed Files, which changes the check context from pr-check-managed-files. Neither the job id, the permissions: blocks, the triggers nor the action pin changes. The README describes this check as advisory, so I found no required-check or ruleset in the repo that depends on the old context string. A ruleset outside this repo that requires the old context would fail closed (merges blocked), not open, so I found no bypass.
  • Link-check target: components/lychee-online/targets/claude-code-plugins.yml only adds name: Check Links to a job. The reusable-workflow ref (@main), permissions: and uses: line are unchanged.
  • Test and docs: a test tweak in naming-lint.test.mjs and doc and comment updates.

Checked and absent from the diff:

  • No change to trusted-actor lists, token scopes, kill switches, merge holds, the signer, plugin manifests or instruction-surface rules.
  • No new secrets, injection surfaces or permission widening.

The protected-class register was not consulted, because no standing instruction is deleted or softened.

critical-findings: 0

@github-actions

github-actions Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

claude-review reviewed 4516351cc1f2cce6977a8d77753e74dc3c12ca72: 0 finding(s), 0 as inline comments.

Incremental review of components/github-actions-conventions/README.md (since 953436e). The only change adds a blank line after the "Pending renames" bullet, so the "GitHub's dynamic workflows..." sentence renders as its own paragraph instead of a lazy continuation of the bullet. No rule text changed, so there is nothing to reconcile in other files. No findings. The PR uses Refs:, so there is no closing issue to check criteria against. The PR context held no embedded directives. I did not run tests; the author's claimed verification (21 naming-lint tests pass, 167 managed-files-guard tests pass) is unverified by me.

@kyle-sexton
kyle-sexton enabled auto-merge (squash) November 11, 2026 23:56
Without a blank line the dynamic-workflows sentence rendered inside the
bullet as a lazy continuation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe
@kyle-sexton
kyle-sexton merged commit 382f91e into main Nov 12, 2026
22 checks passed
@kyle-sexton
kyle-sexton deleted the feat/naming-vocab-ccp-adoption branch November 12, 2026 00:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant