Repository navigation
ci: bump nyuchi/.github/.github/workflows/reusable-vite-plus.yml from 0.5.0 to 0.7.0 - #34
Closed
dependabot[bot] wants to merge 36 commits into
Conversation
Until now this repo held a one-line README, so the eight other repos in
the org inherited nothing: no CODEOWNERS, no issue or PR templates, no
security policy, and no shared CI. Only `mzizi-registry` had any of those,
and it has them locally, which means they cover one repo out of nine.
Everything here was read off the GitHub API before it was written down.
ORG_STANDARDS.md describes the CI that actually runs in each repo today
and lists twelve things that do not exist, rather than describing the
intended state as if it were the current one.
Three reusable workflows, chosen for what this org actually is — Rust
first, not npm first:
- reusable-rust-ci.yml takes a `target` input and a separate
`clippy-on-target` boolean. Two of the three Rust repos ship as WASM
(mzizi-console in a browser, mzizi-api-gateway on workerd) and code
can pass every native check and still fail to compile for the target
that ships. The two repos need different answers — mzizi-console
lints on the host and checks wasm32, mzizi-api-gateway must lint
against wasm32 because the `worker` crate's API is cfg'd for it — so
one knob would have forced them onto the same wrong answer.
- reusable-gitleaks.yml runs the MIT binary directly. The
gitleaks/gitleaks-action wrapper needs a paid licence for org repos.
- reusable-pr-title-lint.yml enforces Conventional Commits on the PR
title.
Third-party actions are pinned by commit SHA, not tag; a tag can be moved
to point at different code. The resolved versions are recorded in
ORG_STANDARDS.md so a future reader can tell a pin from a guess.
No repo calls these yet. Publishing and adopting in one change would move
nine repos with no baseline to compare against; adoption is a small PR per
repo, and this repo's own ci.yml dogfoods two of the three by local path
so a change to a reusable is tested by the PR that makes it.
github-rulesets/*.json are proposals and are NOT applied. Note that the
org-wide one deliberately omits `required_linear_history`: that rule
blocks merge commits, and a merge commit is the only merge this org
permits. mzizi-registry's existing ruleset has exactly that combination
today, which is gap 4.
The docs reflect the merge-only convention throughout, per MIGRATION.md
§1.1 — "Squash discards the per-commit reasoning this project depends on".
One correction to the brief this was written against: the org has two
members, @bryanfawcett (admin) and @michellellawson (member), not one.
There are no teams, which is why CODEOWNERS names users.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
"is the second workflow" told a reader nothing. It dispatches to a held-out runner named by a repo variable, and it is fork-guarded — both worth knowing, because the held-out task set is withheld on purpose (MIGRATION.md §5: "withheld so the benchmark measures the language rather than memorisation") and a reader who does not know that might reasonably try to make the dispatch target public. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
actionlint's shellcheck pass failed on `cargo test $EXTRA` with SC2086. The word splitting was intentional — test-args is an argument list — but the unquoted form also glob-expands, which was not intentional, so the warning was correct and the original comment defending the line was wrong. `read -ra` splits and does not glob. An empty input yields an empty array, which is safe under `set -u` from bash 4.4 onward; ubuntu-latest ships bash 5. Worth recording how this got through: actionlint was run locally before pushing and reported clean, because shellcheck is not installed on this machine and actionlint silently skips the shellcheck rules when the binary is missing. A clean local actionlint is therefore weaker evidence than it looks. The CI job, which runs on a runner that has shellcheck, is the one that counts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The settings sweep behind those two rows iterated eight repos and missed mzizi-site, so the counts were taken over a sample that did not include it. mzizi-site has has_wiki false and an Apache-2.0 licence, which moves wikis to four-off/five-on and licences to seven-of-nine. Small numbers, but this page's whole claim is that it reports what is there rather than what is expected, so an off-by-one from an incomplete sweep is exactly the defect it should not have. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This repo pins third-party actions by SHA, but GitHub has an org setting that enforces it (`sha_pinning_required`) and it is false. A convention that only lives in review comments is weaker than one the platform checks, so the setting belongs in the gap list next to the convention. Noting honestly that it cannot simply be switched on: every existing workflow in the org uses floating tags, so enabling it would break them all until they are pinned. The same endpoint shows `default_workflow_permissions: write`, which gives every workflow a read-write token by default. Recorded alongside it because it is the same one-line admin decision and the same argument. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
feat: populate the org defaults for mzizi-dev
The previous PR shipped `.github/CODEOWNERS` described as the org-wide
default for every repo without its own. That is wrong, and it was wrong
in the brief this work was written against, so it went in unchallenged.
GitHub's list of community health files an organisation's `.github` repo
can supply as defaults is CODE_OF_CONDUCT.md, CONTRIBUTING.md, discussion
category forms, FUNDING.yml, issue and PR templates, SECURITY.md and
SUPPORT.md. CODEOWNERS is absent from it, and the CODEOWNERS docs read
the file from `.github/`, the root, or `docs/` "of the repository". The
community profile API agrees: mzizi-console resolves its PR template to
mzizi-dev/.github and reports codeowners as null.
So the file shipped last PR governs one repo — this one — and the claim
that it gave the org review routing was exactly the kind of aspiration
described as running that ORG_STANDARDS.md says it does not contain.
What changes:
- `.github/CODEOWNERS` says plainly that it covers this repo only, and
its rules are narrowed to paths that exist here. It no longer lists
/compiler/ and /wrangler.jsonc, which are in other repos and were
never going to match anything from here.
- `CODEOWNERS.example` at the root is the thing to copy per repo,
following the pattern already set by dependabot.example.yml — the
other file with no org-wide fallback.
- ORG_STANDARDS.md moves CODEOWNERS out of the inherited list and into
a new gap 14: no repo in the org has working review routing, and this
repo cannot fix that centrally. Eight small PRs can.
Also fixes the gap ordering, which read 11, 13, 12 after the SHA-pinning
entry was inserted at the wrong anchor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The comment explaining why Dependabot needs a per-repo file drew the contrast against "CODEOWNERS, issue templates and SECURITY.md" — which asserts the very thing the rest of this PR corrects. Caught by grepping every inheritance claim in the repo rather than only the ones in Markdown. It now names both exceptions, since they are the same instruction: copy the example file into each repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Found the hard way: this PR's original title was "fix: CODEOWNERS is not inheritable, so stop claiming it is", and the title lint rejected it. The rule is right and the title was wrong, but the failure reads as a style nit when it is really "your subject happens to start with a filename that is spelled in capitals". That will happen to anyone writing about CODEOWNERS, SECURITY.md, an API or a CI job, which in an org-standards repo is often. Documenting the reword is cheaper than answering it repeatedly, and much cheaper than the alternative someone will eventually propose: relaxing the pattern to allow leading capitals, which would stop it catching the actual mistake it exists for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix: stop claiming CODEOWNERS is inheritable org-wide
Adds the identical caller every repo in the seven orgs now uses, and the canonical .prettierrc, .prettierignore, .markdownlint.jsonc, .yamllint.yaml and .editorconfig from nyuchi/.github. No copy of the lint policy is added here. This org's .github repo keeps its own reusables (gitleaks, rust-ci, pr-title-lint) but the LINT policy stays in exactly one place: nyuchi/.github is public, and a public reusable workflow is callable from any org, so all seven orgs call the one file. Five divergent copies is the failure this is undoing. Fixes one real markdown bug found by the gate: in ORG_STANDARDS.md a line wrapped so that "# 265" began a line, which every markdown renderer reads as an H1. It is now an inline code span on the previous line. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…and the README ORG_STANDARDS.md said "Squash merging and rebase merging are disabled on all nine repos. allow_merge_commit is true everywhere", and said it with a "verified on each repo individually" note attached, which is exactly what makes it dangerous. Re-read off the API on 2026-09-12, all nine repos report: allow_rebase_merge true (was false) allow_merge_commit false (was true) allow_squash_merge false (unchanged) allow_auto_merge true (was true on three of nine) The same holds on all 75 repositories in the Bundu Foundation enterprise, so this is an estate-wide change rather than something done to this org. The document's merge instruction, `gh pr merge <n> --merge`, is now the command the settings reject. Corrected, each marked with the date: * "The merge-only convention" is rewritten as "The merge convention". The MIGRATION.md §1.1 argument is kept and re-read honestly: it argued against squash, squash is still off, and rebase preserves per-commit reasoning. What is lost is the merge commit, so merge_commit_title/message are now vestigial and a PR-title lint guards nothing in the history. * Gap 4 — "mzizi-registry's ruleset contradicts the merge-only convention" — is resolved by the org moving rather than by anyone fixing it. required_linear_ history and rebase merges agree. The fix the gap proposed, allowed_merge_ methods: ["merge"], would now be the wrong change, and github-rulesets/org-wide-main-protection.json still contains it. * "Branch protection and rulesets" said GET /orgs/mzizi-dev/rulesets returns []. It returns two: org-status-checks (active, requires the five `lint / *` contexts on every default branch, strict policy) and enterprise-main- protection (evaluate). Gap 8 is overtaken by the first of those. * The repo table called mzizi-site "completely empty — no commits at all" and mzizi-docs and mzizi-roadmap README-only. All three now carry content and CI, and mzizi-site serves the mzizi.dev apex — which the table also recorded as mzizi-registry's, and which is now false. A dated note records the cutover, the surfaces it took offline, and the three pull requests that should have preceded it. * Gap 11: mzizi-roadmap's README calls itself archived; the API reports archived: false. The gap now names the one call that would make the README true. * Gaps 10 and 12 and the settings table re-read against the API. Added, per the brief: * README.md and ORG_STANDARDS.md both point at the estate-wide README standard at nyuchi/.github#62, noting it is open and unmerged so the blob link would 404, and summarising the branding facts it carries — 21 colour families not five or seven, the DNA double helix with axis/axes/layer retired, no database behind the registry, and docs.mzizi.dev not resolving. * README.md gains the standard shape: blockquote purpose, CI and lint badges (both curled), an at-a-glance line and a licence section stating honestly that this repo carries no licence file. Gaps 3 and 5 were re-checked and are unchanged: private vulnerability reporting is still enabled only on mzizi and mzizi-registry, and secret scanning only on mzizi-registry and mzizi-api-gateway. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Config-only. Brings this repo's caller and lint configs byte-identical to
nyuchi/.github, closing drift that accumulated while canon was fixed
underneath the rollout.
What moved, and why it moved:
- the caller gains `merge_group:`, which a repo whose ruleset uses a
merge queue needs - required checks must report on the
gh-readonly-queue/** ref and only merge_group produces that. Inert
where there is no queue.
- the caller's push trigger becomes [main, master, scaffold], every
default-branch name in the estate. Four repos do not default to
`main`, and there merging fired no workflow at all.
- .yamllint.yaml gains the generated-file exemptions: lockfiles, whose
registry deprecation strings no developer wrote and cannot rewrap,
and Rails test/fixtures/, which are ERB templates and only become
YAML after Rails renders them.
No behaviour change here beyond those. The point is that "identical in
every repo" is checkable rather than aspirational.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
SUPPORT.md, CONTRIBUTING.md and the ORG_STANDARDS repo table called Mzizi a Bundu Foundation project / Bundu Foundation IP; they now say Mzizi, matching mzizi/CHARTER.md on main. The README licence note said Mzizi was operated and developed by Nyuchi; it now says Mzizi owns and operates it and Nyuchi runs the revenue products (console, Fundi, paid plans, billing). Unchanged on purpose: the "Bundu Foundation enterprise" (the GitHub enterprise account's name), the bundu-labs org, "Bundu ecosystem" wording, and the history notes in lint.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7rjocqu7U77TqNbCNrUGk
The org ruleset will require this workflow on every repo's pull requests, so repos no longer need their own lint.yml (trial in mzizi-dev). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq
The mzizi-dev org ruleset now runs the shared lint on every pull request via mzizi-dev/.github/.github/workflows/org-lint.yml, so this repo's own lint.yml caller is redundant (it ran lint twice). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq
) Adds a vite-plus job calling nyuchi/.github's reusable-vite-plus.yml, publishing vite-plus / fmt, check, test and build in every repo. It runs with enforce: false: this workflow is required, so a failing job would block every PR before the repos have adopted the Vite+ contract. Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
GitHub shows profile/README.md on the organisation page, and this org had none. Written from the repositories' READMEs and descriptions and the owner's canonical documents, which it links. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com>
#13) Every mzizi-dev repo now passes vite-plus / fmt, check, test and build (adoption PRs merged; non-JS repos pass with notices), so the job runs enforced. vite-plus / fmt replaces lint / prettier and lint / JSON validity, which the lint job skips from here. The org ruleset requires the vite-plus contexts before the two lint contexts are removed. Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Every merge into staging is now released as the next patch, tagged on the merged commit by nyuchi/.github's reusable-staging-release.yml (pinned by SHA). The tag is pushed with GITHUB_TOKEN, so no tag-triggered workflow runs for a beta build. CI now also runs for pull requests into staging and pushes to it, as it does for the default branch. Refs nyuchi/.github#80, nyuchi/.github#84 Claude-Session: https://claude.ai/code/session_017T4NxM5wbhJ3LjHt7bnuwr Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Adds main-release.yml, the org's standard (copied from mukoko-dev/mukoko-circles): it tags each release to main as the next minor and creates its GitHub release with the run's GITHUB_TOKEN. Earlier releases merged untagged are tagged on their existing main commits: v0.1.0 (`febcf66`, #15), so the next release is v0.2.0. Claude-Session: https://claude.ai/code/session_01GHjaH1Vt2dVLWU68iz8tFq Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Required checks must report on a merge queue's gh-readonly-queue/** ref, or every queued PR stalls until the queue times it out. Add merge_group triggers where missing and skip PR-only jobs (title lint) on merge_group, where a skipped check counts as passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj
Org .github repos keep agent rules in AGENTS.md, with no CLAUDE.md and no .claude directory, so every agent reads the same file. Renames CLAUDE.md to AGENTS.md, points to the enterprise-wide rules in nyuchi/.github, and adds the branch-ownership and merge-queue rules. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj
The org moved every repository to squash merging through a GitHub merge queue on 2026-10-21 (owner-approved): squash on, rebase and merge commits off, squash message = PR title + commit details, a SQUASH merge queue on staging and main, strict up-to-date off, auto-merge on, merged branches deleted. README.md and AGENTS.md said rebase-only; CONTRIBUTING.md, the PR template, the issue-template contact link and reusable-pr-title-lint.yml's header comment still said merge-only. All now describe squash through the merge queue with `gh pr merge <n> --squash --auto`. ORG_STANDARDS.md gains a 2026-10-21 update box, a rewritten "The merge convention", the new merge rows in the settings table, and dated notes where the strict up-to-date rule and the ruleset JSON were described; the 2026-09-12 correction is kept as the record of the previous change. The workflow change is comment-only. Checked: prettier --check and markdownlint-cli2 on the Markdown files, yamllint on the two YAML files. ORG_STANDARDS.md already failed prettier --check before this change (prettier would rewrite CODE_OF_CONDUCT.md into emphasis), so that one line is left as it was. Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
Dependabot defaulted to the default branch, so its updates landed on main without passing through staging, and the next squash release (main replaced by staging's tree) erased them. Every update entry now sets target-branch: staging; updates reach main with the next release. Signed-off-by: Bryan Fawcett <bryan@nyuchi.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Dependabot waits 7 days after a version is published before proposing it, so a malicious or broken release has time to be pulled. Semgrep's dependabot-missing-cooldown rule blocks a config without one. Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
Moves every nyuchi/.github reusable-workflow and action reference to v0.5.0 (bb87d28), the release that carries the dependency audit and review changes of 2026-10-21/23 (nyuchi/.github#118, #119, #121). Refs that pointed at @main or an untagged commit are pinned too, so every org .github repo is on the same tagged commit. The new version only adds optional inputs to next-version and the staging release. Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
) ci(main-release): check out main's tip, not the workflow_run head_sha Same fix as nyuchi/.github#115. Semgrep's workflow-run-target-code-checkout flagged the checkout of github.event.workflow_run.head_sha in a job with contents: write. Measured with semgrep 1.181.0 on this file: 1 finding before, 0 after. The checkout now takes the default ref. A gate step compares HEAD with the head_sha the triggering workflow passed on and skips the tag when main has moved on, because that newer push triggers its own run. yamllint and actionlint are clean. Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
Adds a Mission section near the top of AGENTS.md, so every agent in the org reads the owner's mission brief of 2026-10-24 first: what we are building, the ecosystem, the four gateways, the six-point engineering bar (open standards, nothing crashes, everything ships, never close a conflicting PR, one canonical id, honesty), Mzizi as the rule, and the dependency-version policy decided the same day. Checked locally: prettier 3.9.4, markdownlint-cli2 and oxfmt 0.70.0 (the org vite-plus fmt job's formatter) are clean. Claude-Session: https://claude.ai/code/session_01LFZxixidq8jYs4VLDm8YFj Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
requested a review
from Bryan Fawcett (bryanfawcett)
as a code owner
October 30, 2026 23:04
#39) ci(org-lint): every PR names an issue, and none adds CLAUDE.md or .claude Same two jobs as nyuchi/.github (issue attached, no agent-local files). Claude-Session: https://claude.ai/code/session_0114U9k8dcSUU3wAMZxydfmb Co-authored-by: Bryan Fawcett <noreply@anthropic.com>
Bumps [nyuchi/.github/.github/workflows/reusable-vite-plus.yml](https://github.com/nyuchi/.github) from 0.5.0 to 0.7.0. - [Release notes](https://github.com/nyuchi/.github/releases) - [Commits](nyuchi/.github@bb87d28...c2e2506) --- updated-dependencies: - dependency-name: nyuchi/.github/.github/workflows/reusable-vite-plus.yml dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/staging/nyuchi/dot-github/dot-github/workflows/reusable-vite-plus.yml-0.6.0
branch
from
November 2, 2026 15:59
973c0a9 to
0486758
Compare
Bryan Fawcett (bryanfawcett)
force-pushed
the
dependabot/github_actions/staging/nyuchi/dot-github/dot-github/workflows/reusable-vite-plus.yml-0.6.0
branch
from
November 7, 2026 13:21
0486758 to
9470a7b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps nyuchi/.github/.github/workflows/reusable-vite-plus.yml from 0.5.0 to 0.7.0.
Release notes
Sourced from nyuchi/.github/.github/workflows/reusable-vite-plus.yml's releases.
Commits
c2e2506chore(release): staging to main, 2026-10-24 (mission brief) (#126)8822d18chore(release): staging to main, 2026-10-23 (pins) (#124)