feat(hygiene): add an advisory org-wide repository hygiene sweep - #125
Merged
Conversation
The blocking guard runs in the repo being checked, so every private repo
firing it pays a billable minute for a job that averages 6.6 seconds --
~292 minutes a month across fleet-infra and nix-config.
The check reads pull request metadata and a diff. It needs no private
repository content, so it can run against the API from a public repo and
cost nothing.
This is ADVISORY and says so in its own comment text. It reports; it cannot
block a merge. That is a real difference from the guard, not an
implementation detail -- repository-hygiene-guard.yml stays exactly as it is,
and no repo should lose its blocking gate without someone deciding that
advisory is acceptable there. exclude-repos exists for the repos that keep
the gate.
Changed files come from the pulls/{n}/files API rather than a clone: a sweep
would otherwise have to check out every repo in the org to diff two refs.
Findings are posted as a sticky comment on the offending pull request, keyed
off an HTML marker and updated in place. An advisory check that appends a new
comment every tick is one people mute.
Verified against the live org, including that the gate can fail rather than
only that it passed:
- default globs: 30 repos, 38 open PRs, 0 offenders, exit 0
- deny '**/*.yml': 21 offenders detected, run fails
- allowlist '.*' over the same globs: back to 0
- exclude-repos: 30 -> 28 repos, 21 -> 19 offenders
Refs #123
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AJYmuNrmiYv9wGRABoQYUi
ExtraToast
added
type: feature
This was referenced Aug 27, 2026
ExtraToast
added a commit
to JorisJonkers-dev/.github
that referenced
this pull request
Aug 29, 2026
…runner (#37) * feat(hygiene): schedule the advisory org hygiene sweep from a public runner Actions minutes are billed to the caller, never to the repo holding the reusable workflow. The blocking guard runs in the repo being checked, so each private repo firing it pays for the run -- ~292 minutes a month across fleet-infra and nix-config for a job averaging 6.6 seconds. Standard runners are free in public repositories, and this repo is public. This does not replace repository-hygiene-guard.yml. The guard blocks a merge; this only reports. fleet-infra and nix-config are excluded for now precisely because they still run the blocking guard, so the sweep would otherwise report the same thing twice. Remove a name from that list in the same change that removes its gate. Every 6 hours rather than every 15 minutes: advisory findings gain nothing from a tighter loop, and the sticky PR comment is the real signal. Depends on the sweep added in JorisJonkers-dev/github-workflows#125. Refs #34 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AJYmuNrmiYv9wGRABoQYUi * docs(hygiene): correct the claim that the guard blocks merges Repository Hygiene is not a required status check in any repo in this org -- only Pipeline Complete is, and no repo uses classic branch protection. Verified by reading the rulesets directly rather than inferring from the workflow's name. So the guard already only reports, and replacing it with the sweep gives up nothing. The previous comment claimed a blocking gate that does not exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AJYmuNrmiYv9wGRABoQYUi --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
repository-hygiene-sweep.yml— an advisory org-wide counterpart torepository-hygiene-guard.yml. The guard is untouched.Why
The blocking guard runs in the repo being checked, so every private repo firing it pays a billable minute for a job that averages 6.6 seconds — ~292 minutes/month across
fleet-infraandnix-config.The check reads PR metadata and a diff. It needs no private repository content, so it can run against the API from a public repo and cost nothing. Minutes are billed to the caller, so the existing
uses:shim into this repo saves nothing on its own.The trade-off, stated plainly
This is advisory. It reports; it cannot block a merge. That's a real difference from the guard, not an implementation detail.
repository-hygiene-guard.ymlis unchanged, and no repo should lose its blocking gate without someone deciding advisory is acceptable there —exclude-reposexists for the ones that keep it. That decision belongs in #34, not here.The sweep fails its own run when it finds something, so it's visibly red in Actions without touching any PR's mergeability.
Design notes
pulls/{n}/filesAPI, not a clone. A sweep would otherwise have to check out all 30 repos to diff two refs.Verification
Run against the live org — including proving the gate can fail, not just that it passed:
deny: **/*.yml(negative control)allowlist: .*exclude-repos: fleet-infra, workspaceThe negative control caught this PR's sibling branches, which is the sort of confirmation that the matching actually works rather than the glob list silently never matching anything.
actionlintclean.Closes #123