Repository navigation
ci(governance): 切换到组织统一门禁 - #136
Conversation
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a16de1e6b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c67f0a6552
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
改动内容
把本仓库的 PR 门禁切换到组织统一治理动作
GdeiAssistant/.github/pr-governance@8c0acac64cf24f9e31484dcd6bff87e2e22c962d。risk-gate.yml、codex-nudge.yml、gitleaks.yml改为调用共享 action，按 PR 并发取消，策略从默认分支读取。pr-review-signal.yml：fork 与 Dependabot PR 的 review 事件只拿到只读 token，无法发布状态；现在由该无权限信号工作流触发workflow_run，在受信任上下文里重新评估。engineering-governance.yml只保留 commitlint，内联 Gitleaks job 移除（改用共享 action 的同名Gitleaks检查）。secret-scan-weekly.yml：它从不传--baseline，每次运行都以 exit 2 结束。完整历史扫描改由共享 action 提供，需先配置SECRET_SCAN_BASELINE_B64；未配置前该定时任务保持关闭。.github/scripts/test_risk_gate.py及 hygiene 中的对应步骤：它校验的是已删除的 v2 内联实现。.github/scripts/secret_scan.py、.gitleaks.toml、install-gitleaks.sh：CI 仍用它们在上传前扫描精确制品路径。governance/policy.json收敛为pr-governance/v3；所有者身份不写入策略，由组织变量RISK_GATE_OWNER_ID和RISK_GATE_OWNER提供。.github/engineering.md同步更新扫描、基线与本地验证说明。不改会怎样
v2 实现留在仓库里会与统一门禁并行产出同名
risk-gate/Gitleaks检查，状态互相覆盖；四仓规则继续漂移，Codex 回执、标签绑定、基线扫描的修复无法统一下发。fork PR 的 review 事件也无法更新门禁状态。怎么验证的
node --test六个套件 159 项通过；test_secret_scan.py40 项通过（Gitleaks 8.30.1）。actionlint：模板与调用方无告警。check_workflows.py/test_workflows.py/check_hygiene.py通过（以本次 PR 的 CI 结果为准）。检查清单
local.properties或环境配置文件涉及隐私、权限或数据流的改动
不涉及。门禁只读取 PR 元数据，不检出、不执行 PR 代码。
关联 Issue
无
AI 辅助
Qoder（Claude）编写并运行了本地测试；PR 审查由 Codex 完成。
风险
R2：改动包含工作流与治理策略。合并后
ai-review由统一门禁发布，再把它加入必需检查。回滚方式是 revert 本 PR，v2 文件在历史中完整保留。