From 41e930d3844edc83fb9d6c0aa04a7d66ade00385 Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Sun, 23 Aug 2026 03:45:03 +0200 Subject: [PATCH 1/2] Call the shared hygiene check beside this board's own gate (#178) One workflow file, which calls iderex/wache/.github/workflows/pr-hygiene.yml with the subject rule off. .github/pr-hygiene/hygiene.sh is untouched and keeps every rule it has, including the two the shared check has no equivalent for: the scope comparison against the Scope: line a named issue declares, and the qualifier aware reading that leaves another repository's issue number alone. This does not merge as it stands and the file says why. The called workflow declares pr-hygiene- as its concurrency group and this board's own gate declares the same string, so the run created second cancels the other. The local gate is the one that dies, one second after creation, with no steps and no verdict. A group declared here does not help, at workflow level or on the calling job: the called workflow claims the group independently of the caller. Three attempts are on the pull request. The reference is pinned by commit hash with the version beside it, because a moving reference would let the called repository change what executes here without anybody reviewing it. Closes #178 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- .github/workflows/shared-hygiene.yml | 48 ++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .github/workflows/shared-hygiene.yml diff --git a/.github/workflows/shared-hygiene.yml b/.github/workflows/shared-hygiene.yml new file mode 100644 index 0000000..c64b024 --- /dev/null +++ b/.github/workflows/shared-hygiene.yml @@ -0,0 +1,48 @@ +# The shared half of the hygiene rules, called rather than copied (#178). +# +# WHY THIS SITS BESIDE .github/pr-hygiene/hygiene.sh AND DOES NOT REPLACE IT. +# What the two have in common is that a pull request body has to say something +# and name the issue it belongs to; what this board has on top is its own. The +# scope comparison has no equivalent in the shared check at all: the issues a +# body names are read, the `Scope:` line each one declares at column zero is +# taken as a set of path prefixes, and the changed paths are compared against +# their union by whole path segment. Neither has the shared check the qualifier +# aware reading that lets a body paste evidence quoting another repository +# without turning it into a question about this one. Removing either would be +# standardising by losing coverage, so the local gate loses a rule only once the +# shared one is shown to cover it, one rule at a time. +# +# THE SUBJECT RULE IS OFF. This board writes the issue number in the body rather +# than in the subject, which is what its own gate reads: of the last fifty-two +# authored subjects here not one is in the square brackets the fleet rule wants, +# and the twelve most recent carry no reference at all. Switching that one rule +# off says the board does not meet it yet. Not calling the check at all would +# say nothing. +# +# PINNED BY HASH, NOT BY BRANCH. A moving reference would let the called +# repository change what executes here without anybody reviewing it, and the +# boards' own action-pin guards refuse it for that reason. +# +# THIS FILE IS NOT MERGEABLE AS IT STANDS, AND THE REASON IS NOT IN IT. The +# called workflow declares `pr-hygiene-` as its concurrency +# group; .github/workflows/pr-hygiene.yml on this board declares that same +# string. Both cancel in progress, so whichever run is created second cancels +# the other, and the board's own gate is the one that dies: cancelled one second +# after creation, no steps, no verdict. Declaring a group of my own here does +# not help, at workflow level or on the calling job, because the called +# workflow's claim on the group is made independently of the caller. The fix +# belongs in iderex/wache, where the group has to be namespaced, and it cannot +# be made from this file. +name: Shared hygiene + +on: + pull_request: + +permissions: + contents: read + +jobs: + hygiene: + uses: iderex/wache/.github/workflows/pr-hygiene.yml@9b311243c2d0d0ced7feb957a20bc178acce6a5d # v1.0.0 + with: + subject_names_issue: false From 5749d447156ff21cbe3fe6f2a7aa777d638fed76 Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Mon, 24 Aug 2026 20:27:23 +0200 Subject: [PATCH 2/2] Move the shared hygiene pin past the group that cancelled this gate At v1.0.0 the called workflow claimed `pr-hygiene-` as its concurrency group, which is the string .github/workflows/pr-hygiene.yml on this board already claims. Both cancel in progress, so the run created second cancelled the other and the local gate was the one that died: cancelled one second after creation, no steps, no verdict. This pull request has been open and red in that state since it was created on 2026-08-23. What was wrong was the pin rather than anything in this tree, and it was found by re-reading the blocker it was waiting on rather than by a new run here. iderex/wache#4 closed as completed and namespaced the group. At the commit pinned now the shared run sits in `wache-pr-hygiene-` while this board's gate keeps `pr-hygiene-`, so the two no longer meet: gh api repos/iderex/wache/git/ref/tags/v1.2.0 --jq '.object.sha' ea26725f1acaa2616c9810b955230c40ba548e98 gh api repos/iderex/wache/git/tags/ea26725f1acaa2616c9810b955230c40ba548e98 --jq '.object.sha' 113085b269d3437a3f96ff9e7060b64b0af88ab1 gh api "repos/iderex/wache/contents/.github/workflows/pr-hygiene.yml?ref=113085b269d3437a3f96ff9e7060b64b0af88ab1" \ --jq .content | base64 -d | grep -A2 '^concurrency:' concurrency: group: wache-pr-hygiene-${{ github.event.pull_request.number }} cancel-in-progress: true The failure this prevents is a gate that reads as present and judges nothing. A cancelled check blocks no merge here, because the ruleset on main requires no status check: gh api repos/Flowfin/core/rulesets/20572113 \ --jq '{enforcement, bypass: .bypass_actors, required: [.rules[].type]}' {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request"]} so this board's own rules stopped being judged while the tick beside them stayed green, which is worse than not calling the shared check at all. Nothing else changes. `.github/pr-hygiene/hygiene.sh` and `.github/workflows/pr-hygiene.yml` are untouched, and the subject rule stays off. Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- .github/workflows/shared-hygiene.yml | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/.github/workflows/shared-hygiene.yml b/.github/workflows/shared-hygiene.yml index c64b024..d8f0ad8 100644 --- a/.github/workflows/shared-hygiene.yml +++ b/.github/workflows/shared-hygiene.yml @@ -23,16 +23,20 @@ # repository change what executes here without anybody reviewing it, and the # boards' own action-pin guards refuse it for that reason. # -# THIS FILE IS NOT MERGEABLE AS IT STANDS, AND THE REASON IS NOT IN IT. The -# called workflow declares `pr-hygiene-` as its concurrency -# group; .github/workflows/pr-hygiene.yml on this board declares that same -# string. Both cancel in progress, so whichever run is created second cancels -# the other, and the board's own gate is the one that dies: cancelled one second -# after creation, no steps, no verdict. Declaring a group of my own here does -# not help, at workflow level or on the calling job, because the called -# workflow's claim on the group is made independently of the caller. The fix -# belongs in iderex/wache, where the group has to be namespaced, and it cannot -# be made from this file. +# THE PIN IS THE SECOND ONE, AND THE FIRST IS WHY THE COMMENT IS THIS LONG. At +# v1.0.0 the called workflow declared `pr-hygiene-` as its +# concurrency group and .github/workflows/pr-hygiene.yml on this board declares +# that same string. Both cancel in progress, so whichever run was created second +# cancelled the other, and the board's own gate was the one that died: cancelled +# one second after creation, no steps, no verdict. Declaring a group here did +# not help, at workflow level or on the calling job, because the called workflow +# claims its group independently of its caller. iderex/wache#4 namespaced it, so +# at the pin below the shared run sits in `wache-pr-hygiene-` while this +# board's own gate keeps `pr-hygiene-` and the two no longer meet. A +# later pin is checked against that name before it is moved: a shared group that +# went back to the bare pattern would cancel this board's gate again, and a +# cancelled gate blocks nothing here, because no status check is required on +# main yet (#26). name: Shared hygiene on: @@ -43,6 +47,6 @@ permissions: jobs: hygiene: - uses: iderex/wache/.github/workflows/pr-hygiene.yml@9b311243c2d0d0ced7feb957a20bc178acce6a5d # v1.0.0 + uses: iderex/wache/.github/workflows/pr-hygiene.yml@113085b269d3437a3f96ff9e7060b64b0af88ab1 # v1.2.0 with: subject_names_issue: false