fix: AGENTIC licence line + a2ml-validate-action repin - #35
Conversation
…, #669) 1. The AGENTIC.a2ml agent-constraint line "Never use AGPL license (...)" contradicts LICENCE-POLICY.adoc Rules 3 (co-developed), 4 (network services) and 5 (games), which MANDATE AGPL-3.0-or-later - and 144 copies named the retired PMPL-1.0-or-later. Replaced with a pointer to the policy plus the A2 no-automated-licence-edits rule, hardcoding no licence so it cannot go stale again. Same wording as the template fix in rsr-template-repo#45; owner-ruled sweep (2026-08-27). 2. Any workflow pinning hyperpolymath/a2ml-validate-action at 59145c7d or e558e79200 is repinned to 6ac6416f. Those two SHAs never existed: the repo itself was only created 2026-08-28 and populated by subtree split from a2ml/actions/validate (286 files, history preserved). The old pins could never resolve and made lockfile generation impossible. Direct push per owner ruling of 2026-08-28. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Up to standards ✅🟢 Issues
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe change expands agent licence guidance in ChangesLicence guidance
Estimated code review effort: 1 (Trivial) | ~2 minutes Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The pull request successfully updates the licensing instructions to allow AGPL-3.0-or-later in accordance with Rules 3, 4, and 5 of the organizational policy. However, the a2ml-validate-action repin mentioned in the PR title is missing from the diff.
While the code is up to standards according to Codacy, the missing functional change (the action repin) and the lack of automated validation for the updated instructions represent significant gaps in the current implementation. A minor path inconsistency was also identified in the instruction file.
About this PR
- The PR title and description specify an 'a2ml-validate-action repin', but no changes to workflow files or action references were found in the provided diff. This must be addressed to satisfy the PR requirements.
1 comment outside of the diff
[REDACTED:HIGH_ENTROPY]
line 25⚪ LOW RISK
Suggestion: The reference to the license policy document is inconsistent. Line 25 omits the 'standards/' directory prefix used in line 26.# sweep (standards/LICENCE-POLICY.adoc A2). New files get correct SPDX from birth.
Test suggestions
- Verify that the license instructions accurately reflect Rule 3 (co-developed), Rule 4 (network-deployed), and Rule 5 (games) as requiring AGPL-3.0-or-later.
- Verify that the a2ml-validate-action pin is updated in the relevant CI/CD workflow files.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the license instructions accurately reflect Rule 3 (co-developed), Rule 4 (network-deployed), and Rule 5 (games) as requiring AGPL-3.0-or-later.
2. Verify that the a2ml-validate-action pin is updated in the relevant CI/CD workflow files.
Low confidence findings
- There are no test files or automated validation steps included to verify that the updated AGENTIC instructions or the (missing) SHA pin are valid.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
🔍 Hypatia Security ScanFindings: 69 issues detected
View findings[
{
"reason": "Issue in auto-detect-new-domains.yml",
"type": "missing_timeout_minutes",
"file": "auto-detect-new-domains.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in casket-pages.yml",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "missing_timeout_minutes",
"file": "instant-sync.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in label-triage.yml",
"type": "missing_timeout_minutes",
"file": "label-triage.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in labels.yml",
"type": "missing_timeout_minutes",
"file": "labels.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
1 participant
Ruleset refused a direct push, so this lands by PR. Two mechanical fixes, owner-ruled:
Never use AGPL license (…)contradictsLICENCE-POLICY.adocRules 3/4/5 (which mandate AGPL for their scopes). Replaced with the policy pointer used inrsr-template-repo#45. Seestandards#646.a2ml-validate-actionrepin — the previously-pinned SHAs never existed; the repo was only created 2026-08-28 (split froma2ml/actions/validate, history preserved). Repinned to its real HEAD. Seestandards#669.🤖 Generated with Claude Code