feat(l9-ci-pack): full v2 instantiation pack + legacy-mark @v1 starters + tag-v1.sh fix#8
Open
cryptoxdog wants to merge 41 commits into
Open
feat(l9-ci-pack): full v2 instantiation pack + legacy-mark @v1 starters + tag-v1.sh fix#8cryptoxdog wants to merge 41 commits into
cryptoxdog wants to merge 41 commits into
Conversation
…core docs/templates
…ci-core docs/templates
…re docs/templates
…core docs/templates
… kernels frozen/historical
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
3 tasks
cryptoxdog
added a commit
that referenced
this pull request
Jul 20, 2026
- actionlint.yml: download the actionlint install script to a file and verify its sha256 before executing (was curl|bash with no verification — BLOCKER githubactions:S8482). - properties-json-schema.yml: pin jsonschema==4.26.0 and add --only-binary :all: to the pip install (MAJOR githubactions:S8541/S8544); wrapped in a run: | block since the bare "--only-binary :all:" plain scalar tripped actionlint's YAML parser (colon-space ambiguity). - ops/audit-sha-pins.sh: assign $1 to a local var in is_sha() before use, and use [[ instead of [ for the two remaining conditionals (MAJOR shelldre:S7679/S7688 x2). Re-verified with shellcheck (clean) and the existing positive/negative test suite (unchanged: 20/39 refs clean depending on pre/post PR #8 merge, injected violations still caught). Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Delivers the full l9-ci-core v2 instantiation surface into this repo per
the Core v2 org delivery plan, so
any consumer/agent can instantiate Core from
.githubalone.Pinned Core ref throughout this PR:
f88116503430aa18992b70d8d31063e34ff97ef1(pre-release candidate on
l9-ci-core@main, post#33merge — includes thed2c2cd7/98f012fprovisioning fixes). Will become@v2.0.0/@v2in afollow-up single pin-flip PR once
l9-ci-corev2.0.0 is tagged (human-runrelease step — not done in this PR).
Changes
l9-ci-pack/(new) — full v2 CI instantiation kit:README.md(agent-first, copy-paste steps for Python + Node),
governance/*.yaml(6files),
workflows/{l9-analysis,l9-lint-test,l9-lint-test-node}.yml—synced from
l9-ci-core/docs/templates/at the candidate SHA above.workflow-templates/l9-v2-{analysis,lint-test,lint-test-node}.{yml,properties.json}(new) — org starters aligned to
l9-ci-pack/workflows/, so "Set up thisworkflow" in the Actions tab offers the v2 path.
@v1starters (l9-governance,l9-nightly,l9-node-ts-monorepo,l9-pr-pipeline,l9-pre-commit,l9-release,l9-sbom,l9-scorecard,l9-security) — marked Legacy (frozen@v1)in both the
.ymlbanner comment and.properties.jsondescription.Content/behavior unchanged — still resolve against the frozen historical
kernel commit.
ops/tag-v1.sh(fix) — no longer assertsorigin/main == EXPECTED_SHA(main has since moved to the v2 rewrite and will never equal that historical
SHA again). Now fetches and tags the pinned historical commit directly,
independent of where
mainis.ops/sync-v2-starters.sh(new) — syncsl9-ci-pack/froml9-ci-core/docs/templates/at a given ref and re-pins every Coreuses:in the pack +
workflow-templates/l9-v2-*.ymlto that ref in one pass.ops/validate-starters.sh(hardened) — now also asserts thel9-ci-pack/required file set is present (6 governance + 3 workflowtemplates + README) and free of
@mainrefs. Issue/PR templates areintentionally not required in the pack (owned solely by this repo's own
community-health files).
.github/workflows/validate-starters.yml(new) — runsops/validate-starters.shon every PR to this repo.workflow-interface-registry.yml— added av2:block (currentcandidate SHA, pack paths, reusable-workflow/consumer-template split,
explicit
no_v2_equivalentlist); existingkernels:list annotated as thefrozen
@v1set.CONTRIBUTING.md,profile/README.md— point new-repo CIinstantiation at
l9-ci-pack/README.md; existing@v1kernel table keptbut marked legacy.
Explicitly out of scope for this PR
ops/tag-v1.sh(cutsv1.0.0/v1tags) — human-run per repopolicy.
l9-ci-corev2.0.0or flipping any pin from the candidate SHA to@v2.0.0— gated on Core's own verify-then-release flow.reusable workflows — SDK doesn't implement those providers yet (see
no_v2_equivalentin the registry andl9-ci-core/AGENTS.md§7 for thedormant-SDK-CLI triage).
Test plan
ops/validate-starters.shrun locally against this branch's content —22 passed, 0 failed.f88116503430aa18992b70d8d31063e34ff97ef1), no@mainanywhere.validate-starters.yml, newly added) green.l9-ci-pack/README.mdonly (Python + Node paths) — tracked as the Phase D verify step in the Core plan, not blocking this PR.Made with Cursor