fix(w6d): use Patchwarden policy bundle in dry run #495

Merged

pdurlej merged 1 commit from codex/platform-patchwarden-dry-run into main

2026-05-26 01:37:54 +02:00

codex commented

2026-05-26 01:36:18 +02:00

Collaborator

Canary status: missing — workflow/governance path, manual review before merge.

Canary Context Pack

Product story

Patchwarden is now a separate product and platform is the first dogfood client. The existing platform dry-run workflow should use Patchwarden's repo-owned policy bundle instead of relying only on embedded defaults.

What changed

Adds --policy-bundle-file "${{ steps.patchwarden.outputs.source_dir }}/policies/platform.v0.toml" to the existing patchwarden-client-dry-run workflow.

Why it changed

Patchwarden #25/#26 made policy bundles available to pr-check and pipeline. This keeps the platform client aligned with that contract while staying dry-run only.

Files touched

.forgejo/workflows/patchwarden-client-dry-run.yml

Relevant context

Patchwarden #25: TOML policy bundle
Patchwarden #26: pipeline policy bundle support
Existing platform W6d dry-run workflow

Runtime evidence

No runtime mutation. Local verification only.

Known constraints

This workflow still runs as a dry-run client. It does not post comments, approve reviews, merge PRs, call LLMs, or mutate production.

Explicit out-of-scope

Webhooks
LLM reviewer orchestration
Automerge expansion
Runtime/deploy changes

Requested decision

Merge this tiny alignment PR if workflow checks stay green.

Merge blockers

Workflow lint failure
Canary/Patchwarden finding that this changes trust boundaries beyond dry-run behavior

Spec sources read

.forgejo/workflows/patchwarden-client-dry-run.yml — target workflow
.forgejo/workflows/patchwarden-pr-sanity.yml — adjacent Patchwarden workflow pattern
.forgejo/workflows/base-is-main.yml — Forgejo branch-protection workflow style
control-plane/platformctl/ci/lint_workflows.py — local workflow lint entrypoint

Tests

python3 control-plane/platformctl/ci/lint_workflows.py --workflows .forgejo/workflows --markdown /tmp/platform-workflow-lint.md --json /tmp/platform-workflow-lint.json → passed, 0 findings
python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py -q → 13 passed

Canary status: missing — workflow/governance path, manual review before merge. ## Canary Context Pack ### Product story Patchwarden is now a separate product and platform is the first dogfood client. The existing platform dry-run workflow should use Patchwarden's repo-owned policy bundle instead of relying only on embedded defaults. ### What changed Adds `--policy-bundle-file "${{ steps.patchwarden.outputs.source_dir }}/policies/platform.v0.toml"` to the existing `patchwarden-client-dry-run` workflow. ### Why it changed Patchwarden #25/#26 made policy bundles available to `pr-check` and `pipeline`. This keeps the platform client aligned with that contract while staying dry-run only. ### Files touched - `.forgejo/workflows/patchwarden-client-dry-run.yml` ### Relevant context - Patchwarden #25: TOML policy bundle - Patchwarden #26: pipeline policy bundle support - Existing platform W6d dry-run workflow ### Runtime evidence No runtime mutation. Local verification only. ### Known constraints This workflow still runs as a dry-run client. It does not post comments, approve reviews, merge PRs, call LLMs, or mutate production. ### Explicit out-of-scope - Webhooks - LLM reviewer orchestration - Automerge expansion - Runtime/deploy changes ### Requested decision Merge this tiny alignment PR if workflow checks stay green. ### Merge blockers - Workflow lint failure - Canary/Patchwarden finding that this changes trust boundaries beyond dry-run behavior ## Spec sources read - `.forgejo/workflows/patchwarden-client-dry-run.yml` — target workflow - `.forgejo/workflows/patchwarden-pr-sanity.yml` — adjacent Patchwarden workflow pattern - `.forgejo/workflows/base-is-main.yml` — Forgejo branch-protection workflow style - `control-plane/platformctl/ci/lint_workflows.py` — local workflow lint entrypoint ## Tests - `python3 control-plane/platformctl/ci/lint_workflows.py --workflows .forgejo/workflows --markdown /tmp/platform-workflow-lint.md --json /tmp/platform-workflow-lint.json` → passed, 0 findings - `python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py -q` → `13 passed`

codex added 1 commit

2026-05-26 01:36:18 +02:00

fix(w6d): use Patchwarden policy bundle in dry run

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s