From 76b3d73796b3c2fc42dff603f9fc1ec862169253 Mon Sep 17 00:00:00 2001 From: Nick Fisher Date: Wed, 22 Jul 2026 21:45:55 -0600 Subject: [PATCH 1/2] docs: adopt risk-tiered PR validation --- .github/workflows/no-mistakes-required.yml | 50 ---------------------- AGENTS.md | 5 ++- CONTRIBUTING.md | 31 ++++++-------- 3 files changed, 18 insertions(+), 68 deletions(-) delete mode 100644 .github/workflows/no-mistakes-required.yml diff --git a/.github/workflows/no-mistakes-required.yml b/.github/workflows/no-mistakes-required.yml deleted file mode 100644 index ca417e9f..00000000 --- a/.github/workflows/no-mistakes-required.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: Require no-mistakes - -on: - pull_request: - types: [opened, edited, synchronize, reopened] - branches: - - main - -permissions: - contents: read - -concurrency: - group: no-mistakes-required-${{ github.event.pull_request.number }} - cancel-in-progress: true - -jobs: - check: - name: PR must be raised via no-mistakes - runs-on: ubuntu-latest - if: >- - github.event.pull_request.user.login != 'github-actions[bot]' && - github.event.pull_request.user.login != 'dependabot[bot]' && - github.event.pull_request.user.login != 'release-please[bot]' - steps: - - name: Verify no-mistakes signature in PR body - env: - PR_BODY: ${{ github.event.pull_request.body }} - PR_AUTHOR: ${{ github.event.pull_request.user.login }} - PR_NUMBER: ${{ github.event.pull_request.number }} - run: | - set -eu - marker='Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)' - if printf '%s' "${PR_BODY:-}" | grep -qF -- "$marker"; then - echo "Found no-mistakes signature in PR #${PR_NUMBER} body." - exit 0 - fi - { - echo "::error::This PR was not raised through no-mistakes." - echo - echo "Contributions to this repository must be submitted via 'git push no-mistakes'." - echo "That pipeline runs the required review/test/lint/CI steps and writes a" - echo "deterministic '## Pipeline' section into the PR body containing:" - echo - echo " $marker" - echo - echo "See CONTRIBUTING.md for setup and the full workflow." - echo - echo "PR author: ${PR_AUTHOR}" - } >&2 - exit 1 diff --git a/AGENTS.md b/AGENTS.md index bd70c61a..7b4e7178 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -28,7 +28,10 @@ The committed `skills/lavish/SKILL.md` is generated by `pnpm run build:skill`; ` - Run `pnpm run check` before pushing. - Treat repo-provided `.agents/` skill content as vendored; Prettier intentionally ignores it. - Do not hand-edit `CHANGELOG.md` or `.release-please-manifest.json` - release-please owns them. -- Human-authored PRs to `main` must go through [`no-mistakes`](https://github.com/kunchenguid/no-mistakes); CI enforces a deterministic signature in the PR body. See CONTRIBUTING.md. +- Direct pull requests validated by repository-native tests and CI are the default. + Use [`no-mistakes`](https://github.com/kunchenguid/no-mistakes) only when the captain explicitly requests it or when a change affects security, privacy, authentication or authorization, destructive data or schema behavior, billing, production deployment or infrastructure, or another broad/high-blast-radius subsystem. + Routine docs, tests, CI/configuration, narrow UI changes, and small bounded fixes must not invoke it solely because they are ship work. + The captain still approves merges. See CONTRIBUTING.md. ## Documentation ownership diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 835767b8..881e8c85 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,35 +1,32 @@ # Contributing Thanks for wanting to contribute. -One rule up front: -**Human-authored pull requests targeting `main` must be raised through [`no-mistakes`](https://github.com/kunchenguid/no-mistakes).** -We require this to reduce the maintainer's burden of reviewing and merging contributions. +Direct pull requests validated by repository-native tests and GitHub CI are the routine default. +The captain still decides when a pull request is approved to merge. -`no-mistakes` puts a local git proxy in front of your real remote. -Pushing through it runs an AI-driven review/test/lint pipeline in an isolated worktree, forwards the push upstream only after every check passes, and opens a clean PR automatically. +Use [`no-mistakes`](https://github.com/kunchenguid/no-mistakes) only when: -A GitHub Actions check (`Require no-mistakes`) runs on PRs targeting `main` and fails if the body is missing the deterministic signature that no-mistakes writes. -The release and dependency bots are exempt so their automation keeps working, but regular contributor PRs without the signature will not be reviewed or merged. +- the captain explicitly requests it; or +- the task changes security, privacy, authentication or authorization, destructive data or schema behavior, billing, production deployment or infrastructure, or another broad/high-blast-radius subsystem. -## Workflow +Routine docs, tests, CI/configuration, narrow UI changes, and small bounded fixes must not invoke `no-mistakes` solely because they are ship work. -Fork routing requires `no-mistakes` v1.30.1 or newer. +## Workflow -1. Fork the repo, then clone the parent repo or set your local `origin` back to the parent repo (`git@github.com:kunchenguid/lavish-axi.git`). +1. Fork and clone the repo. 2. Create a branch and make your changes. -3. Initialize or refresh the gate with your fork as the push target: `no-mistakes init --fork-url git@github.com:/lavish-axi.git`. -4. Commit your changes. -5. Push through the gate instead of pushing to `origin`: +3. Run the repository-native validation: ```sh - git push no-mistakes + pnpm run check ``` -6. Run `no-mistakes` to attach to the pipeline, watch findings, and auto-fix or review as needed. -7. Once the pipeline passes, it pushes the branch to your fork and opens the PR against this parent repo for you. +4. Commit your changes and push the branch to your fork. +5. Open a pull request targeting `main`. +6. Address GitHub CI failures and review feedback. The captain decides whether to merge. -See the [no-mistakes quick start](https://kunchenguid.github.io/no-mistakes/start-here/quick-start/) for the full first-run walkthrough. +When the risk policy above requires `no-mistakes`, follow its [quick start](https://kunchenguid.github.io/no-mistakes/start-here/quick-start/) instead of the direct-push steps. ## Repo Conventions From c87256fed054b70bf540c524a06df8f044361eb5 Mon Sep 17 00:00:00 2001 From: Nick Fisher Date: Wed, 22 Jul 2026 21:52:29 -0600 Subject: [PATCH 2/2] ci: run authoritative PR checks --- .github/workflows/ci.yml | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b6d7637d..e638b661 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,18 +1,21 @@ name: CI on: - push: - branches: [main] pull_request: + types: [opened, synchronize, reopened] branches: [main] +permissions: + contents: read + +concurrency: + group: ci-${{ github.event.pull_request.number }} + cancel-in-progress: true + jobs: - build-and-test: - runs-on: ${{ matrix.os }} - strategy: - fail-fast: false - matrix: - os: [ubuntu-latest, macos-latest, windows-latest] + check: + name: Repository check + runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 - uses: pnpm/action-setup@v4 @@ -21,8 +24,4 @@ jobs: node-version: 24 cache: pnpm - run: pnpm install --frozen-lockfile - - run: pnpm run lint - - run: pnpm run format:check - - run: pnpm run typecheck - - run: pnpm test - - run: pnpm run build + - run: pnpm run check