fix: align with j4k-align 17.15.4 #16
Loading…
Reference in a new issue
No description provided.
Delete branch "chore/align-17-15-4"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Moves
.node-versionfrom Node 26.12.1 to 26.13.0, the version baked into the CI image (node-ci:26-bookworm), so CI stops downloading Node on every run.The package now declares
engines.node>=26.0.0and builds against@types/node26, and CI drops its Node 24.15.0 matrix leg. The next release no longer supports Node 24.The managed workflows also gain a
same-repo-prjob that fails fork and AGit pull requests, and the release job now waits forcheck-tip. The oxlint config adds thenodeTestpreset.Review
01M6GVZCD41HNXVHTKC2DBXA3F— headc205875ed3ce34b152a6d510e8e2d6d1b467d04bReview — j4k-oss/conventional-commit-msg @
47433b4d5eScope: diff against base tree
b5c77f6c4dc5Review finished: 6 succeeded, 0 failed, 4 skipped by dispatch
Triage: settled
Facts: current review-wide projection
Computed under:
Findings (1)
low —
same-repo-prencodes the trusted-PR rule as a hand-negated copy of the guard, then classifies the PR a third time in shell01M6GWBT4CVYJ5G5FG6ZKHT3X4.forgejo/workflows/commit-msg.yml(snippet)01M6GWEBMGS221MFKS20WHRQR5· valid: The grounded excerpt shows that the new same-repo-pr job's if is the hand-written De Morgan negation of the commitlint guard the body quotes (head.repo.full_name == github.repository && toJSON(flow) == '0'). The body also quotes the step's third classification of the same values ([ HEAD_REPO = GITHUB_REPOSITORY ] && [ FLOW != 1 ]). That is one design decision, the trusted-PR rule, encoded several times in code this change adds. The only link between the encodings is the comment 'the guard's exact complement'. This is information leakage under the split-join-and-layers reference. The body checks the skill's limits. 'An explicit coupling' requires a pinning test, and per the claim and item 01M6GWDHPWVYR01ZG120MR9YEN's grep none exists. 'Repository conventions' cuts the other way: review.yml decides inside one unit and takes a labeled skip branch. The body also keeps the correction inside the change's scope by conceding that the cross-file copies cannot be joined with needs. The proposed pr-origin gate job is a credible one-home remedy: it states the rule positively once, sets an output, and commitlint uses needs/if on it. It relies on Forgejo skipping a job whose needs failed, which the author flags. Low fits: the duplication is within the new job and nothing has drifted yet.01M6GWDHPWVYR01ZG120MR9YEN(aposd-plain)Other claims
01M6GWB7B4Y98DWS4JTH7QWSSXlow — Publishedengines.nodefloor jumps from >=24.15.0 to >=26.0.0 with no code need, excluding Node 24 users of the CLI01M6GWDJ97M8X0H88WQGHGPG9Alow —same-repo-prmerges the fork/AGit refusal and the Forgejoflowcanary into one job, then re-derives in shell which one fired01M6GWDHPWVYR01ZG120MR9YENmedium —same-repo-pradds a hand-inverted copy of the fork/AGit guard, and only comments tie it to the guards in other workflows →01M6GWBT4CVYJ5G5FG6ZKHT3X4Coverage
Coverage pass: 01M6GVZCD7VFM071X1QQQ25F5Z
Accounting: complete (all slots terminal; see slot results for failures)
Slot health: healthy
@ -130,0 +132,4 @@# the guard's exact complement: it fails those PRs and runs none of their code.# It also fails every PR if Forgejo stops sending a usable `flow`.same-repo-pr:if: github.event.pull_request.head.repo.full_name != github.repository || toJSON(github.event.pull_request.flow) != '0'low —
same-repo-prencodes the trusted-PR rule as a hand-negated copy of the guard, then classifies the PR a third time in shelllens
module-design· armdefault· tally 1 valid / 0 invalid / 0 uncertainclaim
01M6GWBT4CVYJ5G5FG6ZKHT3X4of review01M6GVZCD41HNXVHTKC2DBXA3FConfirmed as a maintenance risk: the trusted-PR rule now appears in
commitlint,quality-checks,dedupe-check, the negatedsame-repo-prcondition and its step's shell classification, tied together only by comments. Today the complement is exact, so no PR is misclassified, and the job still turns a fork or AGit PR's silent green into a failure. All of these are rendered by j4k-align 17.15.4 (templates/workflows/commit-msg.yml.hbsand the checks and dedupe templates), so a hand edit here would be overwritten by the nextj4k-align --fix; giving the rule one home (for example a gate job thatcommitlintneeds) is an align template decision. This fleet rollout may not change align, so I've reported it to the user as an align follow-up rather than opening one.