ci: import Quantum-L9 org governance templates and v2 CI workflows#3
Merged
Conversation
Import community health files, issue templates, CODEOWNERS, and dependabot config from Quantum-L9/.github. Add l9-lint-test-node.yml (self-contained ESLint/tsc/vitest gates) and l9-analysis.yml + governance pack, adopting l9-ci-core's v2 architecture (pinned by commit SHA; semgrep ruleset adapted to p/javascript + p/typescript for this TS repo). Also carries over 9 workflow-templates/*.yml starters from the org repo that still reference l9-ci-core's retired v1 kernels (pr-pipeline.yml, security.yml, etc.) which no longer exist in l9-ci-core. These will fail until replaced or removed; kept for visibility per explicit request. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Resolves the ESLint and Vitest CI failures on this branch: - Add eslint.config.js (flat config, ESLint v9) and typescript-eslint devDependency; the CI job was failing because no config file existed. - Remove unused imports surfaced once linting could run (src/index.ts, src/vision/index.ts). - Document + scope-suppress the intentionally duplicated vision-tier enum values in src/types.ts (they alias base model IDs on purpose). - Add 65 unit tests across 5 new files covering BudgetTracker, the Perplexity/general model matrices, the vision config resolver, and the L9LLMRouter routing/reporting surface. Vitest was failing with "No test files found". Verified locally: lint, verify:types, test, and build all pass. The remaining "Analyze (semgrep -> SDK)" CI failure is an upstream defect in Quantum-L9/l9-ci-core's provision-sdk action (it never installs the l9-ci-sdk's own Python deps before probing it; the SDK's identity resolver does `import yaml` and PyYAML is never installed) and is out of scope for this repo. Co-authored-by: Cursor <cursoragent@cursor.com>
3 tasks
cryptoxdog
added a commit
that referenced
this pull request
Jul 20, 2026
…le 1) PR #16's CI run surfaced 5-6 pre-existing failing governance workflows, confirmed (via `gh run list --branch main`) to already be failing on main since they were imported in PR #3 — unrelated to this PR's own diff, but blocking this PR's checks, so fixed here as part of the remediation loop. Root cause 1 (9 files): every `uses: Quantum-L9/l9-ci-core/.github/ workflows/*.yml@v1` reference targets a tag that does not exist in that repo — `gh api repos/Quantum-L9/l9-ci-core/tags` shows only `v0.1.0` is published. Re-pinned all 9 refs to `@v0.1.0`; verified each target workflow file exists at that tag via the GitHub API before committing. Root cause 2 (l9-node-ts-monorepo.yml, self-contained, no external repo involved): `install-and-typecheck` ran `npm run typecheck`, but package.json only defines `verify:types` — fixed to call the real script name. `test-by-segment` ran `npx jest --testPathPattern=...` across a non-existent unit/integration split, but this package has no Jest dependency and uses Vitest exclusively with a flat tests/ directory — replaced with a single `test` job running `npm test`. Known deferred item (not fixed, documented instead): `L9 Analysis` (.github/workflows/l9-analysis.yml) pins l9-ci-core to a direct commit SHA (not a tag) and still fails — captured logs show the failure is `ModuleNotFoundError: No module named 'yaml'` inside l9-ci-core's own `provision-sdk` action (missing `pyyaml` in that action's pip install step). This is a defect in the external Quantum-L9/l9-ci-core / l9-ci-sdk repositories, not in any file this repo owns — no local fix is possible; recommend filing against Quantum-L9/l9-ci-core. Local verify (blocking gate, re-run after these changes): build, verify:types, lint (0 errors), test (137/137), npm audit --audit-level=high --omit=dev (0 vulnerabilities) — all green. YAML syntax of every edited workflow validated with python3 -c "yaml.safe_load(...)". Co-authored-by: Cursor <cursoragent@cursor.com>
cryptoxdog
added a commit
that referenced
this pull request
Jul 20, 2026
Core commit 54a2f2fc (pinned via L9_CORE_REF) predates Core's own fix for a provision-sdk bug where the cloned SDK's requirements.txt was never installed before probing its CLI, causing `ModuleNotFoundError: No module named 'yaml'`. Bump to Core main HEAD (d2c2cd7f), which fixed this the next day (98f012f05b92, "provision: install SDK deps") and shipped two more provisioning refinements since. Diffed the two commits via `gh api compare` to confirm no breaking changes to the actions/inputs this workflow calls: resolve-governance is untouched; provision-sdk, route-artifacts, validate-bundle, and publish-analysis.yml changed only via backward-compatible bug fixes. Bonus: also picks up a fix for route-artifacts' copy_exact() raising SameFileError when the raw report is already at its routed destination, matching this workflow's artifact layout. Applied on this branch (not the original ci/l9-v2-setup) because PR #3 was already merged into main by the time this landed, and the bug had propagated to main and to this branch via that merge. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Quantum-L9/.github.l9-lint-test-node.yml(self-contained ESLint /tsc --noEmit/ Vitest gates, no external dependency).l9-analysis.yml+.github/governance/*.yamlpack, adoptingl9-ci-core's v2 architecture (pinned to commit54a2f2fc8d060674d544fab14388bb5eff6b8e78; semgrep ruleset adapted top/javascript+p/typescriptfor this TS repo).mainnow requiresESLint,tsc --noEmit,Vitestas status checks.Known issue (intentional, kept per explicit request)
9 of the imported workflows (
l9-pr-pipeline.yml,l9-security.yml,l9-scorecard.yml,l9-sbom.yml,l9-nightly.yml,l9-pre-commit.yml,l9-governance.yml,l9-release.yml,l9-node-ts-monorepo.yml) referenceQuantum-L9/l9-ci-core/.github/workflows/*.yml@v1kernels that no longer exist inl9-ci-core(retired in the v2 rewrite). These will fail on every trigger. Kept in this PR for visibility; not fixed here.Test plan
l9-lint-test-node.ymlruns ESLint / tsc / Vitest and reports 3 checksl9-analysis.ymlanalyzejob runs (resolve-governance → semgrep → SDK normalize) and either publishes a check or fails informativelyl9-*.ymlworkflows fail as expected (proves the retired-kernel diagnosis)Made with Cursor