fix(ci)!: retire catalogue-only .NET workflow by devantler · Pull Request #708 · devantler-tech/.github

devantler · 2026-10-22T07:22:28Z

Why

The shared .NET workflow has no remaining product callers, but is still published solely to run catalogue fixtures. Keeping that extra layer obscures ownership and contradicts the portfolio workflow convention.

What

Run those fixtures in the catalogue's own CI and share only their local setup steps. Preserve all three operating systems, credential restrictions, source-state checks and consumer-isolation coverage, and update the action guide and workflow catalogue accordingly.

Fixes #703

💥 Breaking change: the unused public .NET test workflow is removed; consumers use the maintained test action in their own CI jobs.

github-code-quality · 2026-10-22T07:23:23Z

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main ddb835f	codex/retire-dotnet-... 94ca14f	+/-
50%	50%	0%

C# / code-coverage/dotnet

main ddb835f	codex/retire-dotnet-... 94ca14f	+/-
100%	100%	0%

Go / code-coverage/go

main ddb835f	codex/retire-dotnet-... 94ca14f	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

_{Updated October 22, 2026 16:14 UTC}

…rapper-703-r39

devantler · 2026-10-22T07:55:43Z

Corrected head f4150b7d4c0e7c3ee825428598d509f4f7c32994 has complete green hosted CI, including the required executed shared admission. All six localized OS/authentication fixture jobs ran and passed. The earlier scope failure is fixed by placing the new boundary control in the unconditional contract job, with its placement pinned; no scope or security check was weakened. Local controls retain all 80 selectable jobs, 26 native-fixture refusals, 44 credential-graph regressions and the independent deployment-only coverage floor.

CodeRabbit's direct repository-scoped allowance evidence, freshly re-read, is still zero included reviews after the 07:08:25 UTC review under its one-per-hour plan. That limit remains applicable conservatively until 08:08:25 UTC. No redundant CodeRabbit request or paid overage is used. With no current-head review already delivered here, the ordered substantive review proceeds to Codex.

devantler · 2026-10-22T07:55:44Z

@codex review

chatgpt-codex-connector · 2026-10-22T07:55:59Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T16:26:09.741579Z	`94ca14f`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-22T07:59:04Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: f4150b7d4c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

devantler · 2026-10-22T10:28:36Z

Superseded by the current blocker record #708 (comment) (the head moved to daf5bad and this record no longer applies). The record marker was removed so the PR carries exactly one record.

Earlier record

Blocker: #271 | upstream | last-verified 2026-10-22: At unchanged head f4150b7, three self-repository scanner threads remain unresolved. GitHub supports the recommended syntax, but the mandatory catalogue credential-source guard cannot classify it yet. A disposable complete-source probe passes unchanged, then exits 2 with UNKNOWN unresolved or mutable source when only the two native fixture references use the recommended syntax. No PR source or guard was changed. Resume after #271 delivers source classification and its local, composite and cross-repository resolution proof; then adapt the fixture and preserve consumer-root isolation, token/source-state controls, all native OS jobs, complete CI and current-head review. Existing green CI and review do not clear the three scanner findings; no dismissal, waiver or promotion.

devantler · 2026-10-22T14:14:20Z

The three self-repository findings are now fixed at signed head daf5badd017ab3de7bf7698bee85d2f217ee4425, rather than waived. This supersedes the earlier refutation: GitHub's documented native reference supports the same-commit binding needed here, including nested composite actions.

The credential auditor now traverses native references using the defining file's immutable revision, independently of workspace checkouts. Regression tests reject mutable/path aliases, follow nested credentials and prove an older pinned composite cannot substitute a newer caller's leaf. The native fixtures use that binding without checking catalogue source into the consumer workspace. The isolation test uses complete external action source and reproduces the original failure with an in-workspace copy.

Local validation passed: all fourteen deployment baseline checks, race-enabled auditor tests and vet, 44 credential regressions, 26 native-fixture refusals, the real isolation negative control, scope/required-aggregate controls, 20 instruction controls and 40 README cases. The scanner reports zero self-repository findings on these three new references; the separate catalogue-wide migration remains tracked in #271. Both new commits are GitHub-verified signed. Fresh complete hosted CI and current-head review remain required before promotion.

devantler · 2026-10-22T14:45:16Z

Blocker: #655 | upstream | last-verified 2026-10-22: GitHub's Actions Results incident (githubstatus: investigating, re-checked 15:20Z) still delays completed job results. At unchanged signed head daf5bad, CI 39793830610 failed only the native cache observer and its dependent aggregate; a later complete read showed all nine fixture jobs successful, so this is not a demonstrated cache-policy violation. The earlier #271 source-classification blocker is superseded. Resume after GitHub reports recovery (and #719 for #655 lands): run complete CI again at the then-current head (not failed-jobs-only), obtain a fresh substantive review, and revalidate findings before promotion.

devantler · 2026-10-22T16:20:59Z

@coderabbitai full review

coderabbitai · 2026-10-22T16:21:08Z

⚠️ Action not completed

Review rate limited.

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 51 minutes.

coderabbitai · 2026-10-22T16:21:17Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 51 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Source mode: Auto
Repository: devantler-tech/.github
Branch: codex/retire-dotnet-wrapper-703-r39
File: .coderabbit.yaml
Commit: 94ca14f
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 61d21a2d-61c6-4247-a594-57e0c1ce37ce

📥 Commits

Reviewing files that changed from the base of the PR and between ddb835f and 94ca14f.

📒 Files selected for processing: 17

.github/actions/test-dotnet-fixture/action.yaml
.github/agent-guides/catalogue.md
.github/scripts/ci-selection/dotnet_workflow_test.go
.github/scripts/ci-selection/inventory.json
.github/scripts/ci-selection/main.go
.github/tests/catalogue-credentials/main.go
.github/tests/catalogue-credentials/self_repository_test.go
.github/tests/test-catalogue-credentials-controls.sh
.github/tests/test-ci-catalogue-scope.sh
.github/tests/test-ci-selection.sh
.github/tests/test-dotnet-helper-checkout.sh
.github/tests/test-dotnet-native-fixtures.sh
.github/workflows/ci.yaml
.github/workflows/run-dotnet-tests.yaml
AGENTS.md
README.md
actions/run-dotnet-tests/README.md

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-10-22T16:22:50Z

@codex review

chatgpt-codex-connector · 2026-10-22T16:26:06Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 94ca14fde7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

devantler · 2026-10-22T16:28:12Z

Ready at signed head 94ca14fde739f9d563d311aa20fc3c97dc018a6d on reviewed base ddb835f95230f42315cce449f7ceff7777cc31a0.

All 273 head checks are terminal green; full CI 39811683458 includes real native .NET execution, authenticated-package and Microsoft.Testing.Platform fixtures on Ubuntu, macOS and Windows. The native cache observer also passed. I inspected those actual outcomes, not just configuration or offline doubles.
Codex reviewed this exact head clean. CodeRabbit explicitly refused the included request until its quota reset; no paid fallback was used.
Complete review/thread/comment reads show no unresolved thread, non-thread finding or unaddressed maintainer requirement, and the PR is conflict-free. The previous incident blocker is superseded by these fresh successful results.
Consumer-root isolation, complete credential-source controls and README/native-fixture/selection contracts pass locally. The installed actionlint release does not recognize several current GitHub features; comparison against both reviewed parents shows no newly introduced diagnostic, and the real hosted workflow executed successfully.

The zero-product .NET wrapper can now be retired while retaining the private native fixtures and the template's repository-level enforcement. Protected merge and the major release/publication checks remain the final delivery steps.

devantler · 2026-10-22T17:36:07Z

The .NET-wrapper retirement is delivered and verified:

Protected merge 8723698de8a2265c7b77db7df030f30aa33a958a retains the reviewed tree. v11.0.0 points directly to that commit.
The exact-source release and CD workflows succeeded.
The complete post-merge CI rerun, attempt 2, succeeded. The first attempt's cache observer exhausted its bounded wait while two real fixture jobs still appeared unfinished in GitHub's API; all nine later settled successfully. This was a full rerun, preserving the attempt-bound native observer rather than replaying only its failure.
The native .NET repository ruleset remains active with all three OS checks. The obsolete public wrapper is removed; ordinary, authenticated-package and MTP catalogue fixtures remain native and green.

#703 is complete. This does not claim that the separate World runtime/migration gate or KHoist publication migration is complete.

fix(ci)!: retire catalogue-only .NET workflow

5d75e91

github-advanced-security Bot found potential problems Oct 22, 2026

View reviewed changes

Comment thread .github/actions/test-dotnet-fixture/action.yaml Fixed

Comment thread .github/workflows/ci.yaml Fixed

Comment thread .github/workflows/ci.yaml Fixed

devantler added 2 commits October 22, 2026 09:34

Merge remote-tracking branch 'origin/main' into codex/retire-dotnet-w…

a06e13e

…rapper-703-r39

fix(ci): keep native fixture contracts outside smoke selection

f4150b7

This was referenced Oct 22, 2026

fix(ci): exercise immutable deploy admission refusal #709

Closed

Share trusted admission plumbing while keeping each product's validator local #693

Open

This was referenced Oct 22, 2026

Retire the unused .NET workflow export and dormant org gates #703

Closed

fix(catalogue)!: retire unused .NET workflow #707

Closed

devantler added a commit that referenced this pull request Oct 22, 2026

chore: agent-claim #708 nonce=f020c36b1b8debcbc3149263069b2731

b52f3f2

devantler added the blocked label Oct 22, 2026

devantler added 2 commits October 22, 2026 16:10

fix(ci): bind native fixtures to immutable action sources

714021b

chore: merge current catalogue base for native fixture validation

daf5bad

devantler mentioned this pull request Oct 22, 2026

Repoint the remaining consumers from actions to .github #239

Closed

3 tasks done

chore: integrate reviewed release recovery workflow

94ca14f

devantler marked this pull request as ready for review October 22, 2026 16:27

devantler removed the blocked label Oct 22, 2026

devantler merged commit 8723698 into main Oct 22, 2026
274 checks passed

devantler deleted the codex/retire-dotnet-wrapper-703-r39 branch October 22, 2026 16:33

Conversation

devantler commented Oct 22, 2026

Why

What

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-code-quality Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code coverage overview

Go / code-coverage/test

C# / code-coverage/dotnet

Go / code-coverage/go

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

devantler commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

devantler commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

coderabbitai Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 22, 2026

Review limit reached

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

Uh oh!

devantler commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-code-quality Bot commented Oct 22, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading

devantler commented Oct 22, 2026 •

edited

Loading

devantler commented Oct 22, 2026 •

edited

Loading

coderabbitai Bot commented Oct 22, 2026 •

edited

Loading