From 980be942971b5c3a97ca9cbbdf658e12f3e72e63 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 10 Nov 2026 22:14:58 +0100 Subject: [PATCH 1/3] docs(agents): link the consumer census from the blast-radius rule Before a change to a shared surface, list its consumers with the monorepo's consumer-census helper. Part of devantler-tech/monorepo#4842 Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index ac3f6c49..20fe0fc8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -330,7 +330,7 @@ actionlint The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`. -**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). +**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ""` prints each consumer's `file:line`; an `UNKNOWN` repository was not searched, which is never zero consumers. It does not yet search the monorepo's own workflows (devantler-tech/monorepo#4917), so also `git grep` the monorepo. **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check. From 0ba6380ff89b4ba3fb17f509f144e190e667d3b1 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 02:08:34 +0100 Subject: [PATCH 2/3] docs(agents): say what the consumer census does not cover Search by workflow or action path and read each caller's inputs, since an input-name search misses callers on a default. Name the consumers the census cannot see: the monorepo's own workflows, repositories that are not submodules, and repositories an organization ruleset makes run a workflow. Part of devantler-tech/monorepo#4842 Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 20fe0fc8..70d1d135 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -330,7 +330,7 @@ actionlint The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`. -**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ""` prints each consumer's `file:line`; an `UNKNOWN` repository was not searched, which is never zero consumers. It does not yet search the monorepo's own workflows (devantler-tech/monorepo#4917), so also `git grep` the monorepo. +**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ""` prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the monorepo's non-archived submodules: check separately the monorepo's own workflows (devantler-tech/monorepo#4917), repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check. From 81930eb4a1e5d0ac57840ecfb1b0c9c1f109d2eb Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 03:31:40 +0100 Subject: [PATCH 3/3] docs(agents): census by repository path and name its branch limit Search by the path inside this repository, without owner or ref, so remote and same-repository callers both match, and say that the census reads only each submodule's default branch. Part of devantler-tech/monorepo#4842 Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 70d1d135..8795ec70 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -330,7 +330,7 @@ actionlint The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`. -**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ""` prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the monorepo's non-archived submodules: check separately the monorepo's own workflows (devantler-tech/monorepo#4917), repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. +**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the default branches of the monorepo's non-archived submodules: check separately callers on this pull request's branch and other active branches, the monorepo's own workflows (devantler-tech/monorepo#4917), repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check.