ci(w6d): add patchwarden client dry run #489

Merged

pdurlej merged 1 commit from codex/patchwarden-client-dry-run into main

2026-05-25 22:54:43 +02:00

codex commented

2026-05-25 22:53:08 +02:00

Collaborator

Canary status: missing - workflow/governance change; rely on required Forgejo checks before merge.

Canary Context Pack

Product story

Patchwarden has moved into its own repo. Platform needs a first client handshake that proves the separate CLI can be consumed from platform CI without granting merge authority yet.

What changed

Added .forgejo/workflows/patchwarden-client-dry-run.yml.
The workflow collects PR diff/file data from an untrusted PR checkout, then runs trusted base-branch code only.
It tries to install Patchwarden from a runner-local source path or from pdurlej/patchwarden over HTTPS.
If Patchwarden is unavailable without secrets, it emits not_configured and exits green.
If available, it runs patchwarden pr-check, review-run, and resolve-findings, uploading artifacts only.
Updated docs/ci/README.md with the advisory/non-required contract.

Why it changed

This is the first platform-side dry-run client for Patchwarden v0. It keeps W6d moving without making Patchwarden a required merge authority prematurely.

Files touched

.forgejo/workflows/patchwarden-client-dry-run.yml
docs/ci/README.md

Relevant context

Patchwarden PRs #15-#20 established ownership, schemas, issue-check, pr-check, review artifacts, and finding resolver dry-run.
Existing platform workflow policy forbids PR secrets and pull_request_target; this workflow follows the same split as canary/PR sanity.

Runtime evidence

No runtime mutation. No RS2000/VPS restart/deploy/apply. No secrets. No merge authority. Local workflow lint passed with 0 findings.

Known constraints

This workflow is advisory only.
It must not be added to branch-protection required checks yet.
If pdurlej/patchwarden is not clone-readable by the runner, the expected status is not_configured.

Explicit out-of-scope

No automerge.
No Iskra approval bridge changes.
No model reviewer calls.
No required status check changes.

Requested decision

Merge as platform client dry-run. Next PR: narrow integration wiring after we observe this workflow artifact behavior.

Merge blockers

Workflow lint failure.
Any secret exposure concern.
Any indication this could mutate runtime or become merge authority.

Test plan

python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/patchwarden-client-workflow-lint.md --json /tmp/patchwarden-client-workflow-lint.json
git diff --check origin/main...HEAD

Spec sources read

.forgejo/workflows/patchwarden-pr-sanity.yml - existing trust-boundary pattern.
.forgejo/workflows/canary-required.yml - trusted-base + untrusted-diff-as-data pattern.
.forgejo/ci-policy.yaml and control-plane/platformctl/ci/lint_workflows.py - workflow safety policy.
docs/ci/README.md - CI contract docs.

Canary status: missing - workflow/governance change; rely on required Forgejo checks before merge. ## Canary Context Pack ### Product story Patchwarden has moved into its own repo. Platform needs a first client handshake that proves the separate CLI can be consumed from platform CI without granting merge authority yet. ### What changed - Added `.forgejo/workflows/patchwarden-client-dry-run.yml`. - The workflow collects PR diff/file data from an untrusted PR checkout, then runs trusted base-branch code only. - It tries to install Patchwarden from a runner-local source path or from `pdurlej/patchwarden` over HTTPS. - If Patchwarden is unavailable without secrets, it emits `not_configured` and exits green. - If available, it runs `patchwarden pr-check`, `review-run`, and `resolve-findings`, uploading artifacts only. - Updated `docs/ci/README.md` with the advisory/non-required contract. ### Why it changed This is the first platform-side dry-run client for Patchwarden v0. It keeps W6d moving without making Patchwarden a required merge authority prematurely. ### Files touched - `.forgejo/workflows/patchwarden-client-dry-run.yml` - `docs/ci/README.md` ### Relevant context - Patchwarden PRs #15-#20 established ownership, schemas, issue-check, pr-check, review artifacts, and finding resolver dry-run. - Existing platform workflow policy forbids PR secrets and `pull_request_target`; this workflow follows the same split as canary/PR sanity. ### Runtime evidence No runtime mutation. No RS2000/VPS restart/deploy/apply. No secrets. No merge authority. Local workflow lint passed with 0 findings. ### Known constraints - This workflow is advisory only. - It must not be added to branch-protection required checks yet. - If `pdurlej/patchwarden` is not clone-readable by the runner, the expected status is `not_configured`. ### Explicit out-of-scope - No automerge. - No Iskra approval bridge changes. - No model reviewer calls. - No required status check changes. ### Requested decision Merge as platform client dry-run. Next PR: narrow integration wiring after we observe this workflow artifact behavior. ### Merge blockers - Workflow lint failure. - Any secret exposure concern. - Any indication this could mutate runtime or become merge authority. ## Test plan - `python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/patchwarden-client-workflow-lint.md --json /tmp/patchwarden-client-workflow-lint.json` - `git diff --check origin/main...HEAD` ## Spec sources read - `.forgejo/workflows/patchwarden-pr-sanity.yml` - existing trust-boundary pattern. - `.forgejo/workflows/canary-required.yml` - trusted-base + untrusted-diff-as-data pattern. - `.forgejo/ci-policy.yaml` and `control-plane/platformctl/ci/lint_workflows.py` - workflow safety policy. - `docs/ci/README.md` - CI contract docs.

codex added 1 commit

2026-05-25 22:53:08 +02:00

ci(w6d): add patchwarden client dry run

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s