fix(ci): root-cause pre-existing CI infra failures (npm lockfile, RSR duplicate Python, A2ML identity) - #18
Merged
Merged
Conversation
1. RSR Anti-Pattern Check — `rsr-antipattern.yml` had ~75 lines of duplicated dead Python code (a second `BUILTIN_GLOBS = […]` block, another exemption parser, another `bad = sorted(…)` loop) sitting outside any heredoc between the first `PYEOF` and the next step. The shell tried to execute those lines as commands and the step died with exit 127 (`command not found`). Deleted the duplicate; the first heredoc already does the full TypeScript check. 2. NPM/Bun Blocker + RSR "Check for npm lockfiles" — both detect `package-lock.json` at the repo root and fail per the org's no-npm-lockfiles policy. The actual ReScript build runs through Deno's `npm:rescript` compat shim (see `deno.json`'s build task) which doesn't need a lockfile. Removed `package-lock.json`. 3. Dogfood Gate / Validate A2ML manifests — 25 `.a2ml` files were missing the required identity field (`agent-id`, `name`, or `project`). Injected `project = "odds-and-sods-package-manager"` (or `"opsm-ui"` for files under `opsm-ui/`) into each file's header. The validator regex-matches on the identity-field line so the placement-after-comments form works across all the in-repo a2ml dialects (TOML-style, s-expression-style, Rust-like-object). Hypatia / fleet-scan failures both depend on hyperpolymath/hypatia#237 (the broken-binary fix) landing — not addressable from this repo. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
May 14, 2026 09:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three independent pre-existing failures across opsm's CI — none of them caused by any recent change, all observable on `main` today. Surfacing them as a single infra-cleanup PR so the security PR (#17) and any future Dependabot bump can land green.
1. RSR Anti-Pattern Check — duplicate Python in `rsr-antipattern.yml`
The workflow had ~75 lines of duplicated dead Python code (a second `BUILTIN_GLOBS = [...]` block, another exemption parser, another `bad = sorted(...)` loop) sitting outside any heredoc, between the first `PYEOF` and the next `- name: Check for Go` step. The shell tried to execute those lines as commands and the step died with exit 127 (`command not found`). Deleted the duplicate — the first heredoc already does the full TypeScript check.
2. NPM/Bun Blocker + RSR "Check for npm lockfiles" — `package-lock.json` violation
Both checks detect `package-lock.json` at the repo root and fail per the org-wide no-npm-lockfiles policy. The actual ReScript build runs through Deno's `npm:rescript` compat shim (see `deno.json`'s build task) which doesn't need a lockfile. Removed `package-lock.json`.
3. Dogfood Gate / Validate A2ML manifests — missing identity fields
25 `.a2ml` files were missing the required identity field (`agent-id`, `name`, or `project`). Injected `project = "odds-and-sods-package-manager"` (or `"opsm-ui"` for files under `opsm-ui/`) into each file's header. The validator regex-matches on the identity-field line so the placement-after-comments form works across all the in-repo a2ml dialects (TOML-style, s-expression-style, Rust-like-object).
Remaining (out of scope, separate PRs needed)
🤖 Generated with Claude Code