fix(ci): disarm the Inbox Steward notification amplifier - #451
Merged
Conversation
check_suite:[completed] and workflow_run:[completed] made this workflow fire once per CI completion on every watched workflow -- a multiplier on every unit of estate CI activity, and the mechanism behind the notification burst of 2026-07-20/21 (measured: 3,041 CheckSuite notifications inside a ~19-hour window, and none since). The workflow is currently disabled_manually, which is why the burst stopped. That makes the risk latent rather than resolved: these triggers plus contents:write / pull-requests:write mean re-enabling it would restart the multiplier. Removing them so re-enabling is safe. pull_request, pull_request_review and workflow_dispatch are retained -- the monitoring path the workflow was neutered down to in 2026-06 is untouched. Verified: YAML parses and the trigger map is now exactly pull_request, pull_request_review, workflow_dispatch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedRemoves recursive
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
…em repos dogfood-gate.yml pinned hyperpolymath/a2ml-validate-action and hyperpolymath/k9-validate-action. Both repositories are DELETED (verified 404). An unresolvable uses: ref produces NO check run at all -- not a red one -- so 'Validate A2ML manifests' and 'Validate K9 contracts' could never report, and any ruleset requiring them was unsatisfiable. That is what blocked this very PR. The actions were not lost, they MOVED: hyperpolymath/a2ml-ecosystem/validate-action (action.yml verified at the pin) hyperpolymath/k9-ecosystem/validate-action (action.yml verified at the pin) Repointed rather than vendored. The estate handover proposed vendoring the scripts into ~272 consumer repos; that would create 272 copies to drift, which the same document names as this estate's most recurring failure mode. Repointing is one line per file and keeps a single source. SHAs are the ones already proven green in the-nash-equilibrium#83; both verified to resolve (2026-07-25) and to contain validate-action/action.yml at that exact ref. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…dable/6a2/ Hypatia SD004, severity critical, 6 occurrences: '6a2ml file outside canonical location -- must be in .machine_readable/6a2/'. Verified as a REAL finding rather than taken on trust: both standards and hypatia keep exactly these six files -- AGENTIC, ECOSYSTEM, META, NEUROSYM, PLAYBOOK, STATE -- under .machine_readable/6a2/. gitbot-fleet was the outlier. The other .a2ml files at that level (ANCHOR, CICD-PATTERNS, CLADE, SESSION-*) are NOT flagged and are correctly left where they are. Moving them breaks a consumer: scripts/enroll-hypatia-fleet.sh probed the flat paths for META/STATE. It now accepts either location. Deliberately BOTH, not just the canonical one -- that script scans other repos, most of which have not migrated, and narrowing it would silently report them as lacking a manifest they actually have. Verified: bash -n passes, shellcheck -S error clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Hypatia expect_in_hot_path. Regex::new(<literal>).expect(..) was being called inside function bodies, so the regex recompiled on every invocation of an analyzer that runs per file. Hoisted to module-level LazyLock statics: compiled once, on first use. Touched 6 files across 3 crates: accessibilitybot contrast.rs (6), css.rs (4->3), keyboard.rs (2) finishingbot claims.rs (2), license.rs (1) glambot accessibility.rs (3) glambot additionally needed use regex::Regex; at module scope -- it was function-scoped, which no longer reaches the hoisted statics. The now-redundant function-local imports were removed. Deliberately NOT touched: the 11 files whose expect() already sits inside a LazyLock/OnceLock initialiser (they compile once already -- the rule is wrong about those), and the expect() calls that are panic-on-error rather than per-call compilation (a semaphore acquire, a post-insert lookup, benchmark setup). Those need error handling or a rule fix, not caching. Verified: cargo check exit 0 on all three crates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Hypatia workflow_audit missing_timeout_minutes, 2 occurrences. Both verified as REAL by parsing the YAML per job rather than grepping the file: inbox-steward.yml 4 of 5 jobs had one; 'summary' did not -> 5 push-email-notify.yml its single 'notify' job had none -> 10 A file-level grep would have cleared inbox-steward.yml, which contains four timeout-minutes lines already. The gap was one job. Verified: both files still parse; every job now declares a timeout. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
check_suite:[completed]andworkflow_run:[completed]made this fire once per CI completion on every watched workflow — the mechanism behind the 2026-07-20/21 notification burst (3,041 CheckSuite notifications in a ~19-hour window, none since).The workflow is
disabled_manuallytoday, which is why it stopped. That makes the risk latent, not resolved — these triggers pluscontents: write/pull-requests: writemean re-enabling restarts the multiplier.Removed so that re-enabling is safe.
pull_request,pull_request_reviewandworkflow_dispatchretained.Verified: YAML parses; trigger map is now exactly
pull_request, pull_request_review, workflow_dispatch.🤖 Generated with Claude Code