feat(governance): require central Noema review - #613
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the org-wide governance contract around the “CWL Central required workflows” ruleset by making the existing fail-closed Noema review workflow a required check, tightening the audit to enforce an exact two-approval policy, and expanding the scheduled audit to cover all repositories visible to the audit credential (not public-only). This keeps the repo’s ruleset-audit code/tests/docs aligned with the live organization ruleset configuration.
Changes:
- Add
.github/workflows/noema-review.ymlto the central required workflow list and extend audit tests to detect drift for the Noema workflow. - Update ruleset audit expectations: enforce exactly two approving reviews; align repository exclusions and inherited-scope probes (including
IRT-bibliography-set, restoring Argos inheritance). - Expand the scheduled ruleset audit repository enumeration from
type=publictotype=alland update rollout documentation accordingly.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
tests/test_central_required_workflow_ruleset_audit.py |
Updates expected ruleset payload, exclusions, inherited-scope probes, and adds a targeted drift test for the Noema required workflow. |
scripts/ci/audit_central_required_workflows.py |
Aligns the live-audit contract with the updated ruleset: adds Noema workflow requirement, updates exclusions, and requires exactly two approvals. |
docs/org-required-workflow-rollout.md |
Documents Noema as an active required workflow, two-approval policy, all-repo scope, and current rollout evidence. |
.github/workflows/audit-central-ruleset.yml |
Updates scheduled audit to enumerate org-visible repositories (type=all) and adjusts messaging to “organization” scope. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.
Findings
1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
- Problem: GitHub reports mergeStateStatus
DIRTYfor this pull request. - Root cause: Branch
fix/central-noema-required-workflowcannot be merged cleanly intomain; the changed-file flow below shows which review/runtime path is blocked by the conflict. - Fix: Merge or rebase the latest
mainintofix/central-noema-required-workflow, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch. - Repair commands:
gh pr checkout 613 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-noema-required-workflow
# rebase path only: git push --force-with-lease origin HEAD:fix/central-noema-required-workflow- Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.
Merge Conflict Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
- Result: REQUEST_CHANGES
- Reason: mergeStateStatus is
DIRTY; mergeable isCONFLICTING. - Head SHA:
d5138ead01c23d06600298e3089d656dcddda6ae - Workflow run: 29962146730
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Contributor
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path. Findings1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch
gh pr checkout 613 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-noema-required-workflow
# rebase path only: git push --force-with-lease origin HEAD:fix/central-noema-required-workflow
Merge Conflict Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: audit-central-ruleset.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> Conflict["Merge conflict blocks this path"]
Conflict --> V1["actionlint plus required checks"]
Evidence --> S2["Docs: org-required-workflow-rollout.md"]
S2 --> I2["operator or user guidance"]
I2 --> Conflict["Merge conflict blocks this path"]
Conflict --> V2["docs review"]
Evidence --> S3["Changed file: requirements-strix-ci-hashes.txt"]
S3 --> I3["repository behavior"]
I3 --> Conflict["Merge conflict blocks this path"]
Conflict --> V3["required checks"]
Evidence --> S4["CI script: audit_central_required_workflows.py"]
S4 --> I4["review and security gate shell path"]
I4 --> Conflict["Merge conflict blocks this path"]
Conflict --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test: test_central_required_workflow_ruleset_audit.py"]
S5 --> I5["regression suite"]
I5 --> Conflict["Merge conflict blocks this path"]
Conflict --> V5["targeted test run"]
Merge Conflict Guidance
gh pr checkout 613 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:fix/central-noema-required-workflow
# rebase path only: git push --force-with-lease origin HEAD:fix/central-noema-required-workflow |
…uired-workflow # Conflicts: # requirements-strix-ci-hashes.txt
|
Warning Review limit reached
Next review available in: 26 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthrough중앙 required workflow 감사가 public 저장소 기준에서 조직 저장소 기준으로 확장되었습니다. Noema workflow와 정확히 두 개의 승인 리뷰가 필수 정책에 추가되었고, 감사 스크립트·CI 워크플로·테스트·롤아웃 문서가 새 기준에 맞게 갱신되었습니다. Changes중앙 required workflow 감사
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
seonghobae
enabled auto-merge
July 29, 2026 00:06
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
noema-review.ymlas the seventh organization required workflow.github,noema, andIRT-bibliography-setscopeLive evidence
18156473is active with exactly seven required workflows and exactly two approving reviews; stale-review dismissal, last-push approval, and thread resolution remain enforcedtype=allaudit covered 41 accessible repositories: only the three intended exclusions are not inherited, while all other 38 repositories inherit the rulesetContextualWisdomLab/argos#299now inherits the central ruleset; its already-open PR needs a new natural PR event before the newly required workflow is scheduledContextualWisdomLab/clearfolio#161has an exact-current-head Noema App approval on4512fb9e9b56ab95df3acd85ebec2e6b849335a7Validation
actionlintpython3 -m pytest -q— 635 passedSummary by CodeRabbit