fix(rulesets): compare complete owned check identity and strict policy - #74
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ruleset planner previously treated desired check names as a subset of observed names. It could report synchronized while retired required checks still blocked delivery, or while the producing integration/strict policy differed.
Compare the complete owned required-check multiset (context + integration ID) and strict policy. Preserve order independence, declared external-context carry-through, unowned rule types and external parameters. No live settings are changed by this patch.
Validation: targeted planner/declaration tests; full
go test -race ./core/app ./core/providers/github;go vetfor both packages; gofmt and diff checks, all passed on Go 1.26.7. Table regressions cover equal/reordered lists, retired/missing/duplicate contexts, wrong/unbound integrations and strict-policy drift.Closes #73. This is a correctness prerequisite for policy reconciliation, not the full continuous-development profile or an applied ruleset migration.
The first full CI run exposed stale public-engine projection provenance and automatically produced feedback issue #75. Regenerated the canonical repository projections through the normal plan/apply/verify path (no hand-edited digests); only bundle.lock and generated workflow metadata changed. Repeated generation produced identical candidate digests. Stable final-tree
go test ./core/cli ./core/context ./core/projections -count=1passed, including the unregistered public-engine context checks.Also fixes #75. No live GitHub settings or installed runtime were modified by the projection refresh.