Skip to content

ci(ui-merge): delete objectui's nested workflows and Dependabot config; retire the action-ref scan and the CI page pin test with them - #26058

Merged
os-zhuang merged 5 commits into
mainfrom
claude/project-thread-6qe56u
Oct 26, 2026
Merged

ci(ui-merge): delete objectui's nested workflows and Dependabot config; retire the action-ref scan and the CI page pin test with them#26058
os-zhuang merged 5 commits into
mainfrom
claude/project-thread-6qe56u

Conversation

@objectstack-fleet

@objectstack-fleet objectstack-fleet Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Requested by Tesla · project thread

Part of #25712 (4b PR 2d-3c: delete objectui's nested workflows; Tier H).
Part of objectstack#25677.

Clause-②: no
Metadata-protocol: none

维护者速读(草稿)

席位核对

(left for the dispatch seat)

Why

GitHub runs only the repository root's .github/workflows/ and reads only the root .github/dependabot.yml. Since the cutover (#25825), objectui's 26 workflows at ui/.github/workflows/ and its ui/.github/dependabot.yml have run nowhere. The earlier PRs of #25712 moved every test that read them:

The Repo Gates steps run in the root lint-ui job since #25902. This PR deletes the files and retires the two readers that had no root carrier: the action-ref scan (ruling B) and the CI page pin test (Q4).

What changes

  • Deleted: ui/.github/workflows/** (26 files) and ui/.github/dependabot.yml. Each workflow is accounted for in the table below. A follow-up port reads the deleted file from git at this PR's parent. The root .github/dependabot.yml already covers the one root pnpm-lock.yaml, which includes ui/ (npm, directory: "/"), and the root workflows (github-actions).
  • Retired: the action-ref convention scan (ruling B). Deleted: ui/scripts/check-action-ref-convention.mjs, its test, the check:action-ref-convention alias, and the Action Ref Convention step of the root lint-ui job. It was written for objectui's workflows. On the root workflows, the convention it encodes is not this repository's (ci: pin credential-holding third-party actions by sha, and pass the Turbo cache credentials only to merge-queue and main runs #25559 pins third-party actions by SHA), and Lint UI runs only on the ui filter, so a workflow-only change would skip it. The Repo Gates comment block in ci.yml now names the retirement and no longer counts its gates. A repository-wide convention goes to sub-issue 4 (F22).
  • Retired: ui/scripts/__tests__/ci-cd-pipeline-doc.test.ts (Q4). It held ui/content/docs/guide/ci-cd-pipeline.md to the deleted workflows. The page now describes CI that no longer exists. F14 (widened) rewrites or retires it in sub-issue 4, and the test's 15 describes are its checklist (below). The markdown-test-inputs ledger drops the test's entry. scripts-type-check's by-name coverage list names check-pre-install-import-graph.test.ts in its place.
  • Retargeted: check-pre-install-import-graph.test.ts sections 3–5 (33 → 37 cases). These sections read objectui's repo-gates.yml; they now read the root ci.yml's lint-ui job by path, through helpers/root-ci.ts:
    • One step runs both legs, self-test first, before the install.
    • The root trigger filters no path and subscribes merge_group.
    • The ui filter matches .github/workflows/ci.yml and the gate.
    • No other job or root workflow runs the gate.
    • The step keeps the Pre-Install Import Graph Check name.
    • The header count pin and the measurement-point pin read the job's comments.
    • Section 3's floor gains the four repo-gates rows its comment scheduled for this change: check-control-bytes, check-doc-component-types, check-doc-links and check-skills-paths, now derived under lint-ui.
    • The self-walk case asserts that the gate is in its own derived population.
    • No pre-install step is added: ci(ui-merge): run objectui's Repo Gates in the root Lint UI job (18 of 19; the pre-install import graph waits for ui/.github to retire) #25902 carries it.
  • scripts/check-closing-keyword-parity.mjs drops its NON_PARSERS row for ui/.github/workflows/cross-repo-issue-closer.yml, as that row's comment scheduled. The sweep fails on an exemption that matches nothing.
  • check-governed-queue-guard.test.ts carries the recommended option (b) for the open question below, in its own commit.

Deleted workflows, by roster row

Roster = the #25697 workflow audit (comment 6388182608). "kept, follow-up port" files are read from git at this PR's parent when ported.

Deleted file Roster row Disposition (roster) Carried by now
board-snapshot.yml 1 → sub-issue 4 root board-snapshot.yml
changelog.yml 2 → sub-issue 4 (none)
changeset-guard.yml 3 → sub-issue 4 (none); its pins retired in 2d-3b
changeset-presence.yml 4 → sub-issue 4 root pr-automation.yml Check Changeset
check-links.yml 6 → sub-issue 4 root check-links.yml (root trees only)
ci.yml 7 Type Check, Test, Build & E2E ported in PR A; the rest → sub-issue 4 or kept, follow-up port root ci.yml type-check-ui, test-ui, build-e2e-ui
cross-repo-issue-closer.yml 8 → sub-issue 4 root cross-repo-issue-closer.yml
dependabot-auto-merge.yml 9 → sub-issue 4 (none)
docs-deploy.yml 10 → sub-issue 4 (none; objectui's site is a separate Vercel project)
governed-surface-guard.yml 11 covered by root governed-surface-guard.yml → sub-issue 4 root guard; its register governs ui/.github/workflows/** at Tier H
half-state-patrol.yml 12 covered by root half-state-patrol.yml → sub-issue 4 root half-state-patrol.yml
hook-selftests.yml 13 covered by root lint.yml → sub-issue 4 root lint.yml (not ui/.claude/hooks)
labeler.yml 14 covered by root pr-automation.yml Auto Label → sub-issue 4 root Auto Label; ui/.github/labeler.yml (the config) stays, F12 = B
line-citation-gate.yml 15 → sub-issue 4 (none)
lint.yml 16 ported in PR A → Lint UI root ci.yml lint-ui
live-e2e.yml 17 kept, follow-up port (none until ported)
lockfile-dedupe.yml 18 kept, follow-up port (none until ported)
lockfile-integrity.yml 19 kept, follow-up port (none until ported)
merge-queue-head-patrol.yml 20 → sub-issue 4 root merge-queue-triage.yml
node-esm-load-gate.yml 21 kept, follow-up port (none until ported)
performance-budget.yml 22 kept, follow-up port (fold into Build & E2E UI) (none until ported)
published-dist-gate.yml 23 kept, follow-up port (none until ported)
repo-gates.yml 24 → sub-issue 4 root ci.yml lint-ui (#25902), less the action-ref scan (ruling B)
required-check-set-patrol.yml 25 covered by root required-set-patrol.yml → sub-issue 4 root required-set-patrol.yml
shadcn-check.yml 26 kept, follow-up port (none until ported)
test-shard-timings-refresh.yml 28 → sub-issue 4 root shard-timings-refresh.yml (core only)
ui/.github/dependabot.yml (not a workflow) root .github/dependabot.yml (npm and github-actions at /)

Rows 5 (changeset-release.yml) and 27 (spec-range-floors.yml) were deleted earlier.

Ruled (b): the ui register's .github/workflows/** row (objectui#12255)

The maintainer ruled (b) on #25712 at 2026-10-26 10:47Z (comment 6414192040). The last commit carries it. Its code comment still reads "PENDING the maintainer's call"; the queue holds this branch, so that comment is corrected in the next #25712 PR.

What the row protects today. GOVERNED_SURFACES in ui/scripts/check-governed-queue-guard.mjs declares six rows. Its workflows row (prefix .github/workflows/) was added by the maintainer's ruling on objectui#12255 (「两仓加治理行」). In objectui, ui/.github/workflows/governed-surface-guard.yml ran this guard, and a pull request touching a workflow could not pass the merge queue without an approval from GOVERNED_APPROVERS (os-zhuang, hotlong). In this repository the row protects nothing at runtime:

  • No root workflow runs the ui guard. Its only runner was that nested workflow, and check:governed-queue-guard is the self-test alone.
  • The protection of ui/.github/workflows/** is carried by root files:
    • the register in scripts/pm/check-governed-merges.mjs (row ui-workflows, Tier H);
    • .github/workflows/governed-surface-guard.yml, which enforces that register;
    • .github/CODEOWNERS (/ui/.github/workflows/ @os-zhuang @hotlong);
    • the governed lists in AGENTS.md, .claude/skills/pm-dispatch/SKILL.md and scripts/pm/check-governed-prose.mjs.

What happens when the nested workflows are deleted.

  • The ui row names a directory that no longer exists. Its test every declared surface exists in this tree goes red. This is the only red case in the deletion layout, measured with the whole suite.
  • The root ui-workflows row needs no existing path: its self-test uses specimen strings. It keeps any re-created ui/.github/workflows/ at Tier H. node scripts/pm/check-governed-merges.mjs --test ui/.github/workflows/ci.yml answers GOVERNED, tier H, row ui-workflows.
  • The CODEOWNERS line points at a missing path. That is harmless, and it is left as is.

Options.

  • (a) Drop the row from the ui register (6 → 5). This edits the register and the self-test assertions the ruling added: the-register-declares-exactly-the-six-ruled-surfaces, the glob list, the reversed "governs its own workflow" pins and the test's declares exactly the six ruled surfaces. In form it reverses objectui#12255, so it needs the maintainer's word. The root row is unchanged.

  • (b) Keep the row; read it through the root register (recommended for this PR; on the branch). The existence case covers the other five rows. A new case asserts two things:

    • ui/.github/workflows/ is absent. If it comes back, the case goes red and asks for the row to rejoin the existence check.
    • The root predicate, run by path, judges ui/.github/workflows/ci.yml GOVERNED at Tier H under ui-workflows.

    No ruling is touched. The diff is one test file, +32/−3.

  • (c) Retire the ui queue guard and its register for the root one. That means the script, its test, the check:governed-queue-guard and governed aliases, and the register. It is the cleanest end state, and it is roster row 11's question ("the register must decide which ui/** paths are governed"), so it belongs in sub-issue 4 rather than here.

  • (d) Keep a placeholder under ui/.github/workflows/ (for example a README pointing at the root) so the row has a target. Not recommended: it keeps a directory whose only job is to satisfy a test.

Why (b): it is the smallest change that keeps the record true, leaves the ruling and the root rule as they are, and hands the register question to (c) in sub-issue 4, where it belongs.

Unchanged here, on purpose

  • ui/.github/labeler.yml stays (F12 = B, sub-issue 4).
  • The root register row ui-workflows, the CODEOWNERS line, and the governed lists in AGENTS.md, pm-dispatch/SKILL.md and check-governed-prose.mjs: governance, sub-issue 4 and 2h. They are named in the ruled section above.
  • ui/scripts/dependabot-merge-gate.mjs still names Repo Gates and describes the action-ref step in comments. That is objectui's Dependabot register, roster row 9 (sub-issue 4).

Follow-up rows

  • F14 (widened, Q4). ui/content/docs/guide/ci-cd-pipeline.md describes the deleted CI. Sub-issue 4 rewrites it for the root workflows or retires it. The retired test's 15 describes are the rewrite checklist, each a claim the page made that a rewrite must re-establish or drop:

    1. enforced console budget (row 22)
    2. advisory package size tiers (row 22)
    3. workflow inventory: every workflow has a section and every section a workflow (rows 1–28)
    4. lockfile merge driver
    5. ci.yml job table (row 7), with its nested what each job runs
    6. lint.yml step list (row 16)
    7. contexts that can never be required (#4170) (rows 7, 17, 25)
    8. live-e2e backend pin (#7689) (row 17)
    9. Half-State Patrol wiring (#8043, objectui#11174) (row 12)
    10. the Playwright report claim (#8238) (row 17)
    11. live-e2e.yml — the run conclusion may not contradict the job (#8084) (row 17)
    12. the vi-mock and shadcn sections (rows 24, 26)
    13. the four sections measured as parity defects, with its nested the eager-closure half of the budget step (rows 22, 24)
    14. populations are pointed at, never counted in prose
    15. command parity, every workflow section

    The page's Action Ref Convention section (and its pointer near the release-lane text) goes with ruling B. These comments cite the retired test and go stale with it; the rewrite should sweep them:

    • the page itself;
    • ui/scripts/check-lockfile-integrity.mjs;
    • check-skill-eval-tokens.test.ts, check-skill-examples.test.ts, check-doc-example-types.test.ts, doc-version-claims.test.ts and ci-setup-pnpm-wiring.test.ts;
    • ui/e2e/live/ci/backend.env and ui/e2e/live/saved-view-filter.spec.ts;
    • ui/packages/auth/src/__tests__/reserved-auth-features.test.ts.

  • F16 (open). check:prompt-keys in lint-ui reads the root .github/prompts/ (2d-3a), but the ui filter has no .github/prompts/** glob, so a prompts-only change skips Lint UI.

  • F19, F20 stand as listed on test(ui-merge): the ui tests stop reading objectui's nested workflows — Lint UI and Repo Gates readers pin the root lint-ui job, governance pins retire with their roster rows #26013: the workflow-checks.ts parser has no caller, and check-cross-repo-closer-outcome.mjs lost its subject.

  • F21 (new). The pre-install import graph scan reads every root workflow, but the ui filter names only .github/workflows/ci.yml. A change to another root workflow alone does not start Lint UI. Today only ci.yml carries a ui pre-install step.

  • F22 (new, ruling B). A repository-wide action-ref convention needs a home that no path filter skips. ci: pin credential-holding third-party actions by sha, and pass the Turbo cache credentials only to merge-queue and main runs #25559's SHA-pin practice is the reference.

Verification

Head b8af88b8, on main 0d83ee8f. 37 files, +140 / −14224. Tier H by path (.github/workflows/**, ui/.github/workflows/**) and by size.

Test runs are from ui/, per ui/AGENTS.md.

Run Result
Whole scripts/__tests__ suite 180 files passed, 2 skipped; 5216 tests passed, 2 skipped. Without the last commit, exactly one case is red: check-governed-queue-guard every declared surface exists in this tree, the ruled question above.
check-pre-install-import-graph.test.ts, check-governed-queue-guard.test.ts, scripts-type-check.test.ts, markdown-test-inputs.test.ts 4 files, 79 tests passed (check-pre-install-import-graph 33 → 37, check-governed-queue-guard 9 → 10)
pnpm exec eslint --max-warnings=0 (touched files), markdown-test-inputs --audit, lint:coverage, check:entry-guard, check:pre-install-import-graph (both legs), check:test-path-roots, check:bash32-floor all exit 0; the audit reads "114 candidate test files, all adjudicated"
node scripts/check-closing-keyword-parity.mjs and --self-test (repository root) both exit 0; the sweep reads "all registered"
pnpm type-check:scripts the one error is packages/components/src/renderers/action/resolve-icon.ts(265,69) TS2339, identical on unmodified main; none in a touched file

Gate sweep on b8af88b8: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 87 families for this diff. All 87 ran and exited 0, pnpm check:pm-dispatch-gates included. --ran reconciliation: 87 derived, 87 run, 0 NOT-MEASURED, 0 UNRUN.

Push-environment battery (GITHUB_ACTIONS=true GITHUB_EVENT_NAME=push node scripts/pm/check-dispatch-gates.mjs) on b8af88b8: ✓ 2182 cases pass, 0 failed (fast tier 1917 in 446.9 s, slow tier 265 in 1168.9 s), exit 0. It also passed on 39ca5878.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS

claude added 5 commits October 26, 2026 10:23
@claude
test(ui-merge): ci-cd-pipeline-doc retires with the workflows it pinn…
1bc0f01 
…ed the CI page to

`ci-cd-pipeline-doc.test.ts` held `content/docs/guide/ci-cd-pipeline.md` to
objectui's own workflows under `ui/.github/workflows/`: the console budget, the
workflow inventory, the ci.yml job table, the lint.yml step list, live-e2e,
the half-state patrol, and command parity for every workflow section. GitHub
runs none of those workflows since the cutover, and the next change deletes
them, so the page describes CI that no longer exists and the test that held it
to that CI retires with it. Rewriting or retiring the page goes to sub-issue 4.

The markdown-test-inputs ledger drops its entry. `scripts-type-check` names
another gate pin test in its by-name coverage list.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS
@claude
test(ui-merge): the pre-install import graph test pins the root lint-…
d297282 
…ui job

Sections 4 and 5 of `check-pre-install-import-graph.test.ts` read objectui's
`repo-gates.yml`, which GitHub never runs under the monorepo and which the
next change deletes. objectstack#25902 ported its steps into the root
`ci.yml`'s `lint-ui` job, so the wiring pins read that job by path: one step
runs both legs, before the install; the root trigger filters no path and
subscribes merge_group; the `ui` filter matches `ci.yml` and the gate; no
other job or root workflow runs it; the step keeps the check name. The header
count pin and the measurement-point pin read the job's comments.

Section 3's floor gains the four repo-gates rows its comment scheduled for
this change, now derived under `lint-ui`, and the self-walk case asserts the
gate is in its own derived population.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS
@claude
ci(ui-merge): retire objectui's action-ref convention scan with its w…
bbbea39 
…orkflows

`check:action-ref-convention` checks how `uses:` refs are spelled across
`.github/workflows/`, against a table of declared exceptions. It was written
for objectui's own workflows. objectstack#25902 ported it into the root
`lint-ui` job, where it reads the root workflows. That ruling is B on
objectstack#25712: the scan retires along with the nested workflows instead
of being re-aimed. Two reasons:

- On the root workflows, the convention it encodes is not the repository's.
  objectstack pins third-party actions by SHA (#25559).
- Lint UI runs only on the `ui` path filter, so a workflow-only change would
  skip it anyway.

A repository-wide action-ref convention needs a home that no path filter
skips, and that goes to sub-issue 4. This change drops the step, its package
alias, the script and its test. The Repo Gates comment block in `ci.yml` now
names the retirement and no longer counts its gates.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS
@claude
ci(ui-merge): delete objectui's nested workflows and Dependabot config
02ed94e 
GitHub runs only the repository root's `.github/workflows/` and reads only
the root `.github/dependabot.yml`. So since the cutover (#25825), the 26
workflows under `ui/.github/workflows/` and `ui/.github/dependabot.yml` have
run nowhere. They are deleted here, each against its row of the #25697
workflow roster: the Type Check, Test, Build & E2E and Lint jobs were ported
into the root `ci.yml` in PR A, Repo Gates by #25902, and the rest go to
sub-issue 4 or a follow-up port. A port reads the deleted file from git
history at the parent of this change. The earlier 2d PRs moved every test
that read these files.

`ui/.github/labeler.yml` stays until sub-issue 4 rules on it (F12 = B).
`check-closing-keyword-parity` drops its exemption row for objectui's copy of
the cross-repo closer, as that row's own comment scheduled.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS
@claude
test(ui-merge): the ui register's workflows row is read through the r…
b8af88b 
…oot register (pending a ruling)

objectui's queue-guard register declares `.github/workflows/**` by the
maintainer's ruling on objectui#12255, and `every declared surface exists in
this tree` reads each row's directory under `ui/`. That directory is gone with
the nested workflows. The guard that runs is the root one, and its register
governs `ui/.github/workflows/**` at Tier H. So for that row, the existence
case gives way to a case that asks the root predicate, by path, and that goes
red again if the directory comes back.

This is one of three options for a maintainer decision on objectstack#25712:
drop the row, keep it as here, or retire this register for the root one in
sub-issue 4. It is a separate commit so the ruling can replace it.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A6SEitNngAMugGbuJHWsDS
@objectstack-fleet objectstack-fleet Bot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Oct 26, 2026
@github-actions github-actions Bot added size/xl ci/cd dependencies Pull requests that update a dependency file tests labels Oct 26, 2026
@objectstack-fleet objectstack-fleet Bot mentioned this pull request Oct 26, 2026
Closed
@objectstack-fleet
objectstack-fleet Bot marked this pull request as ready for review October 26, 2026 10:50
@os-zhuang
os-zhuang added this pull request to the merge queue Oct 26, 2026
Merged via the queue into main with commit aa2f8e3 Oct 26, 2026
75 checks passed
@os-zhuang
os-zhuang deleted the claude/project-thread-6qe56u branch October 26, 2026 11:52
This was referenced Oct 26, 2026
Merged
Merged
Merged
Closed
Closed
Merged
Open
Closed
Open
Closed
This was referenced Oct 28, 2026
Merged
Merged
Merged
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@os-zhuang os-zhuang os-zhuang approved these changes
@hotlong hotlong Awaiting requested review from hotlong hotlong is a code owner

Assignees

@os-tesla os-tesla

Labels

ci/cd dependencies Pull requests that update a dependency file size/xl skip-changeset PR has no user-facing published change; bypasses the changeset gate tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@os-zhuang @os-tesla @claude