fix: repoint the six org required-workflow rulesets off reusable-workflows (blocks its archival)

[devantler]

🤖 Generated by the Daily AI Engineer

Problem

All six org "Require workflows to pass" rulesets still source their required workflow from the legacy reusable-workflows repo (repository_id: 1022337231) — an org-level consumer class the actions#425 migration verifications missed (they only checked uses: pins in consumer workflow files). This means reusable-workflows is still load-bearing for every gated PR in the org, and archiving it (actions#425 AC3) is blocked until these repoint to actions (repository_id: 948529001).

Live state (verified 2026-07-10):

Ruleset	id	Required workflow	Targeting	Equivalent on actions@main
… - EnableAutoMerge	3716878	enable-auto-merge.yaml	custom prop EnableAutoMerge=true	✅ exists
… - DependencyReview	17213449	dependency-review.yaml	(no property filter)	✅ exists
… - ScanGitHubActions	14426226	scan-for-workflow-vulnerabilities.yaml	custom prop ScanGitHubActions=true	✅ exists
… for .NET	3716863	run-dotnet-tests.yaml	system prop language=C#	✅ exists
… for Go	10320335	validate-go-project.yaml	system prop language=Go	✅ exists
… - LintDocumentation	10320296	lint-documentation.yaml	empty include → targets no repos	❌ missing in both repos

LintDocumentation is doubly inert: the workflow file exists in neither reusable-workflows nor actions, and its repository_property.include is empty, so it matches no repos — pure config debt.

Proposed direction

These rulesets are Observe-only imports in deploy/organization-rulesets/ (per that dir's README, promoting an import past Observe risks wiping live rules via the provider's lossy round-trip), so the sanctioned write path is the same one that created them: the org admin's UI/API. Hence maintainer one-clicks (each fetches the live ruleset fresh, swaps only the repository_id, and PUTs the full object back — same-path workflows all exist on actions@main):

for id in 3716878 17213449 14426226 3716863 10320335; do
  gh api "orgs/devantler-tech/rulesets/$id" \
    | jq '.rules[0].parameters.workflows[0].repository_id = 948529001
          | {name,target,enforcement,conditions,bypass_actors,rules}' \
    | gh api -X PUT "orgs/devantler-tech/rulesets/$id" --input -
done

And delete the inert LintDocumentation ruleset:

gh api -X DELETE orgs/devantler-tech/rulesets/10320296

Verify afterwards (should print 948529001 five times and 404 for 10320296):

for id in 3716878 17213449 14426226 3716863 10320335; do
  gh api "orgs/devantler-tech/rulesets/$id" --jq '.rules[0].parameters.workflows[0].repository_id'
done

Risk is low: the five workflows have identical paths on actions@main and have been the live implementations since the actions v7–v9 merge; the swap changes only which repo the required run is sourced from. If any repo's PR checks wedge after the swap, the same PUT with 1022337231 reverts it.

Rough size

S — five idempotent PUTs + one DELETE, org-admin-only (agent cannot and should not write org rulesets imperatively). Merge-order gate: this must land before reusable-workflows is archived; the archival PR will reference this issue.

Part of actions#425; unblocks monorepo#1964 downstream.

[coderabbitai]

🔗 Related PRs

#74 - feat(rulesets): require the CodeRabbit review status check org-wide [merged]
#75 - revert(rulesets): drop the provider-uncreatable CodeRabbit required-check ruleset [merged]
#76 - fix(ci): release revert commits so reverts reach the cluster [merged]
#79 - feat(labels): bring devantler-tech/monorepo under declarative IssueLabels management [merged]
#80 - ci: repoint reusable workflows to devantler-tech/actions v8.0.0 [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Daily AI Engineer

Status update — urgency downgraded from blocking to cleanup debt, with live evidence. #90 merged (16:18Z) and Crossplane archived reusable-workflows before these one-clicks ran; I probed the failure mode empirically: dependency-review (a ruleset-required workflow sourced from the now-archived repo) executed and passed on wedding-app#174 at 16:23:33Z — required workflows from an archived repo still resolve and run, so no gated PR is broken.

What remains true: the five rulesets now reference workflow files that are frozen forever (read-only repo) — any future change to those required workflows is impossible until the rulesets repoint to actions, and the inert LintDocumentation ruleset (10320296) is still pure config debt. The one-click PUTs + DELETE in this issue's body remain the fix, now at cleanup priority.

[devantler]

🤖 Generated by the Daily AI Engineer

Status: #90 merged and Crossplane has reconciled — devantler-tech/reusable-workflows is now archived (isArchived: true, verified live). Referencing workflows from an archived repo keeps working (archival only disables triggers inside the repo; consumers fetch the file read-only — zizmor even has a dedicated lint for exactly this pattern because it works), so nothing is broken while the six rulesets still point at the archived source.

The one-click PUTs in this issue remain wanted as cleanup: the archived source is frozen, so any future patch to those six required workflows is only possible after the repoint to devantler-tech/actions.

[devantler]

🤖 Generated by the Daily AI Engineer

Live update — this is now a merge-safety blocker, not cleanup-only debt.

KSail #6042 was a human-authored promoted PR. Its CodeRabbit pre-merge state remained not-posted and fresh current-head bot reviews had only been requested, but required-workflow run 29162215382 armed auto-merge at 17:46Z and app/ksail-bot merged it at 18:09Z.

Live ruleset inspection confirms Require workflows to pass before merging - EnableAutoMerge (3716878) still sources repository_id: 1022337231 from archived reusable-workflows. The archived and actions@main copies are currently identical: both run the privileged approval and gh pr merge --auto --squash path for every non-draft PR, including humans.

Therefore repointing alone is insufficient. The safe rollout order is:

1. land actions#545, restricting the privileged job to the explicit trusted-bot allowlist;
2. repoint the org required-workflow ruleset to actions using this issue's admin path;
3. verify a human-authored promoted PR stays unarmed and a trusted-bot PR remains eligible.

The automation remains fail-closed: it did not mutate the organization ruleset.

[devantler]

🤖 Generated by the Daily AI Assistant.

Rollout dependency recorded from devantler-tech/actions#545:

1. Land and release fix(auto-merge): restrict privileged workflow to trusted bots actions#546, which restricts the privileged auto-merge job to the explicit trusted-bot allowlist.
2. Repoint the organization required-workflow ruleset from the archived reusable-workflows source to the fixed actions workflow.
3. Verify a human-authored non-draft PR completes the required workflow with the privileged job skipped and is not auto-armed.
4. Verify an allowlisted trusted-bot PR remains eligible for approval and auto-merge.

Do not repoint before step 1; the current actions@main workflow still contains the same human-author bypass until #546 lands.

[devantler]

🤖 Generated by the Daily AI Engineer

Follow-up to the #6042 evidence: draft actions#546 correctly closes the human-author boundary, but it intentionally does not yet make trusted-bot timing safe. KSail bot PR #6058 was auto-armed at 18:10Z with zero reviews/pre-merge result and merged at 18:30Z when CodeQL finished.

That remaining state-machine defect is now actions#548. Repointing to actions after #546 lands is still an immediate improvement because human PRs will skip the privileged job and the archived source is eliminated. It is not the end state: #548 must also land before trusted-bot auto-merge satisfies the full current-head review/pre-merge contract.

[devantler]

🤖 Sent by Codex Daily AI Engineer.\n\nFresh rollout evidence: KSail PR #6089 was human-authored by devantler at head 8e93831f68042d341fbb9a41b17a0581c2fd8411, yet required-workflow run https://github.com/devantler-tech/ksail/actions/runs/29254464293 used the legacy path to approve it as app/ksail-bot and arm squash auto-merge at 13:37Z.\n\nThe PR then merged as devantler-tech/ksail@623c797 at 14:54:04Z, four seconds after CI - Required Checks turned green. At that exact head there was no current-head CodeRabbit approval or clean Codex result; the most recent green Codex result and CodeRabbit review were for stale head e41b526. The current-head CodeRabbit pre-merge result also appeared only after the merge.\n\nThis proves the org rollout is still safety-relevant, not cleanup-only: the deployed ruleset path contains neither the human-author deny gate from actions#546 nor the current-head evidence gate from actions#553. Complete the existing repoint/rollout here; do not treat actions#548 as regressed unless actions@main reproduces after the ruleset switches.

[devantler]

🤖 Sent by the Codex Daily AI Engineer instance.

Policy correction, superseding the earlier version of this comment: the maintainer clarified on ksail#6095 that trusted programmed bot release PRs—including KSail and Homebrew release bumps—do not require a separate review and are expected to auto-merge after their checks pass. Accordingly, ksail#6095 is closed unmerged and ksail#6094 is closed as not planned. The #6093 bot merge is intentional behavior for that path.

The remaining organization-level scope here is narrower and still required: retarget ruleset 3716878 from the archived reusable-workflows source to the current actions workflow so human-authored PRs cannot enter the trusted-bot auto-merge lane. Verification should prove both states: a promoted human-authored PR skips privileged auto-merge, while a trusted programmed release-bot PR auto-merges after its required checks without a review gate. Do not enable an optional full-pentad requirement for the trusted release-bot lane unless the maintainer changes this policy again.

[devantler]

🤖 Generated by the Daily AI Engineer

Fresh human-path rollout evidence from platform#2622: the PR is human-authored and promoted, but the privileged required workflow still queued it automatically.

• At head 01489622, GitHub rejected a valid review-fix push because the PR had already entered the merge queue; the automation had to dequeue it before pushing.
• After the push to 0da4575, required-workflow run 29279424118 passed and the PR entered the queue again even though the current-head CodeRabbit status was failing from rate limiting and the current-head Codex review had not yet landed. It was dequeued a second time.
• Those queue entries created merge-group runs 29278577317 and 29279572687. The latter was normally cancelled before any job started after dequeue.

This is the verification case the issue still needs to make impossible: a promoted human-authored PR must skip the privileged auto-merge path, while the narrow programmed release-bot exception remains intact. The current PAT cannot read org ruleset 3716878 (403), so this comment records direct observed behavior without claiming a currently verified source repository ID.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Fresh human-path rollout evidence from platform#2608: at exact head 71440342, the promoted human-authored PR had green required CI, zero unresolved threads, compact-green CodeRabbit pre-merge, and a current-head clean Codex review, but CodeRabbit's status context was explicitly failing with Review rate limit exceeded. app/botantler-1 nevertheless merged it at 2026-07-14T09:08:27Z as 0d06f905.

The code gates had been independently assessed and no current-head finding remained, so this is not a product regression. It is further proof that the legacy human path is still being merged by the privileged bot instead of remaining on the contract's bare human-trusted merge path. The existing ruleset repoint/human-author exclusion remains required; no org-level mutation was attempted.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Fresh auto-merge timing evidence from platform#2611 at exact head 458675a1fefc28a5b4fcb9d6604f36c798177de6:

• The PR entered the merge queue while its supported CodeRabbit pre-merge state was still not-posted. The first merge-group run, 29320671118, reached the production deploy before a normal dequeue/cancel.
• Its persistent auto-merge request then placed the same head back in the queue. That created replacement run 29321400669, which was cancelled with zero jobs before it could deploy.
• A second dequeue followed by disabling auto-merge stopped the loop. Live GraphQL verification now reports both mergeQueueEntry: null and autoMergeRequest: null at the exact head.
• The cancellation-safe heal job 87046816827 completed successfully at 09:46:31Z. Post-heal read-only proof shows 9/9 nodes, 6/6 OCIRepositories, 10/10 Kustomizations, and 45/45 HelmReleases Ready; apps and github-config are both Ready/Healthy.

This preserves the maintainer's narrow programmed-bot review waiver while proving that the separate supported pre-merge gate still needs fail-closed enforcement before queue entry. No organization ruleset or production object was mutated directly.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Fresh human-path timing evidence from .github#100: after the maintainer promoted the PR, CodeRabbit found one valid documentation issue at head bfae837d. I fixed and resolved it in signed head 7b1cc87f9c46c47d697b1bc68a1ecbfd2f4459f8.

The new head's CI became green, but app/botantler-1 approved it at 10:11:53Z, the privileged auto-merge workflow completed at 10:12:00Z, and the bot merged it at 10:12:35Z as 277651173ea220e5dd630df4f95df3559557a3da. The newest supported CodeRabbit pre-merge summary had last been updated at 10:07:55Z, before the review-fix head existed. CodeRabbit's current-head incremental review did not post until 10:12:36Z, one second after merge, and no current-head Codex result existed.

The review fix itself is validated and no product regression remains. This is another direct proof that a promoted human-authored PR can be auto-merged before exact-head reviewer/pre-merge evidence is available. The existing ruleset rollout/human-author exclusion remains required; no organization ruleset mutation was attempted.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Fresh human-path gate evidence from ksail#6122:

• The promoted PR's final head was 5128a720660262329ab0d08fc7eff5a6ee59ab17. Required CI finished with 63 passes, 3 skips, 0 failures, and all four historical review threads resolved. Exact-head Codex was green.
• The newest actual CodeRabbit review was stale on 6eb7103599b9eced107c29fc6da0ca8b8ceda5a2. The latest supported pre-merge summary, updated at 19:51:16Z, explicitly covered only through 7116034f964db3ad89ef3914ceb2fed2762d1e90 and remained failed:Docstring Coverage (20% vs 80%). No supported current-head CodeRabbit pre-merge artifact was posted.
• app/ksail-bot nevertheless merged the PR at 2026-07-14T21:15:19Z as 9f2943813fa8221dbd9e52ad4c78002a8cee25c4.

This is another current human-author path where the bot merge was not gated on a fresh supported pre-merge result for the exact head. Keep this rollout issue safety-relevant until the required-workflow rulesets enforce that evidence before arming or completing bot auto-merge.

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Fresh human-path timing evidence from kyverno-policies#3:

• The maintainer promoted the human-authored PR while head 6cdff5aaadfd860c2f2daee38104cf1baaece4bc had green CI, zero threads, and exact-head Codex green. CodeRabbit then failed Linked Issues against a superseded issue proposal and found one valid CI-workflow omission.
• I corrected the linked issue's acceptance criteria, added the missing git diff --check, passed the full local suite, replied/resolved the thread, and pushed signed head 1de88d9167298292d5cf5e3f5a5a1bf94fa326b6.
• The new head's required CI completed green, but no exact-head Codex result or supported current-head CodeRabbit pre-merge summary existed. The newest supported summary still covered the prior head and remained failed; automatic CodeRabbit review was disabled.
• app/botantler-1 armed squash auto-merge at 2026-07-15T11:16:37Z and merged the PR 19 seconds later as 8e1f1f5c75ffd66fe90cdfe57b6c09f7040f74fc.

The review fix is locally validated and no product regression is known. This is another direct proof that the promoted human-author path can merge immediately after CI without exact-head reviewer and supported pre-merge evidence. The existing ruleset repoint/human-author exclusion remains required; no organization ruleset mutation was attempted.