Repository navigation
Observe the existing organization Go workflow rule before migrating its CI source #643
Description
🤖 Generated by the Agentic Engineer
Delivered on: 2026-10-18
Objective
Make the existing organization-required Go workflow policy observable through the reviewed GitOps path, without changing enforcement. This unblocks the safe source migration in #237 and the maintained Go cache policy in #565.
Evidence and priority
KSail still receives the required Go workflow from the legacy actions repository (ruleset 10320335, source repository 948529001). The maintained catalogue already limits module-cache writes, but the legacy required invocation does not receive that policy. Repository-level reads show the applied workflow but do not prove the complete organization repository selectors. Administrative organization reads are unavailable; do not broaden credentials. The existing provider can observe organization rulesets with its current integration.
High priority because it removes a prerequisite for reducing repeated multi-gigabyte Go cache writes on KSail CI. Low end-to-end effort: one read-only import, required behavioral guards, review, publication and native observation readback. This is not itself a measured CI speedup.
Acceptance criteria
- Import only existing ruleset 10320335 with managementPolicies restricted to Observe and the current provider.
- Rendered-policy tests reject mutation authority, wrong identity, duplicate imports and weakened test wiring.
- Merge and publish the change, then confirm native reconciliation observes the original complete policy without changing live enforcement.
- Record the complete non-sensitive migration prerequisites on Repoint organization-required workflows from actions to .github #237; leave source repointing and consumer CI proof open there.
Part of #237.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Effort
Projects
- Status
Activity
devantler commentedon Oct 18, 2026
Delivered by #644: accepted head
ca95b72a2785473641df859175bc4148f5ce5db6, signed mergee038a2ea5f78d31ac2ba57304b6a5f899d7b6b81at 2026-10-18 11:02:08 UTC. The accepted and merged Git trees are identical (50106a40bbf070451a9505efbc5af957e1b92952). Release v7.16.1 points to that merge and CD 39121651933 succeeded.Native readback confirms the signed OCI revision
7.16.1@sha256:07eb9ff3bc61fd38a17390243b000be260b98455c3137c8296d0b4fa9f30f693is verified and applied. The new Go rule observation is Ready, Synced and LastAsyncOperation successful, with onlyObserveauthority and external identity10320335.The previously unavailable complete organization selector is now positively observed: system property
languageincludesGo; the ref selector includes~DEFAULT_BRANCH. Existing OrganizationAdmin/always bypass, active enforcement,doNotEnforceOnCreate: true, workflow path and legacy source repository948529001are preserved. A fresh repository-level read remains identical to the pre-import policy. No GitHub setting or cluster resource was imperatively changed.This completes the read-only adoption prerequisite. It does not repoint the required Go workflow, reduce CI runtime, fix the managed CodeQL writer or satisfy the sustained cache-budget outcome. #237 retains source migration and qualifying consumer CI; #565 retains both-path cache acceptance.