From d802caf10db11da0f987da14205cf2704e887418 Mon Sep 17 00:00:00 2001 From: Parman Mohammadalizadeh Date: Mon, 9 Nov 2026 06:18:17 +0100 Subject: [PATCH] docs(ci): correct PR hygiene trusted-ref comment and policy history The pr-hygiene.yml header still said trusted scripts come from the PR base revision, but the checkout below it uses the fixed `dev` ref since #8381. The stale-branch cleanup plan said its new release-evidence entry repaired the ci.yml drift left by 28b38f9150. #8377 had already pinned that blob (4d1d82f1) on dev; the #8381 entry only pins its own ci.yml revision. --- .github/workflows/pr-hygiene.yml | 5 +++-- .../020_stale_branch_cleanup.md | 12 +++++++----- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pr-hygiene.yml b/.github/workflows/pr-hygiene.yml index 73e7bb72bfe..91dfea2ae66 100644 --- a/.github/workflows/pr-hygiene.yml +++ b/.github/workflows/pr-hygiene.yml @@ -10,8 +10,9 @@ on: # reasonably conclude the gate was broken. types: [opened, reopened, synchronize, edited, labeled, unlabeled] -# Trusted scripts from the PR base revision only. Patches are read through the -# GitHub API; PR-head code is never checked out or executed. +# Trusted scripts from the fixed `dev` ref only, never from the PR base or head. +# Patches are read through the GitHub API; PR-head code is never checked out or +# executed. # Least privilege: no default permissions; the hygiene job grants only what it needs. permissions: {} diff --git a/devlog/_plan/261108_dev_single_branch_release/020_stale_branch_cleanup.md b/devlog/_plan/261108_dev_single_branch_release/020_stale_branch_cleanup.md index ed56b4cc6c6..22c8ae47add 100644 --- a/devlog/_plan/261108_dev_single_branch_release/020_stale_branch_cleanup.md +++ b/devlog/_plan/261108_dev_single_branch_release/020_stale_branch_cleanup.md @@ -44,9 +44,10 @@ the PR-only security boundary, the `status` default-branch semantics, stacked PR support, or the no-`dev`-push / no-PR-macOS-Windows CI policy. `ci.yml` is edited only in comments. Because the release evidence policy pins -its blob, the final fingerprint entry is appended (history preserved), which -also repairs the pre-existing drift from `28b38f9150` (that commit changed -`ci.yml` without appending a policy entry). +its blob, a new final fingerprint entry for this unit's `ci.yml` revision is +appended (history preserved). It does not repair earlier drift: `28b38f9150` +changed `ci.yml` without appending a policy entry, but #8377 had already pinned +that revision (`4d1d82f1`) on `dev` before this unit merged. ## Verification @@ -81,8 +82,9 @@ Consequences: the deleted branch pushes are gone rather than retargeted, so no `react-doctor.yml` loses its per-push health-score trend scan, and `service-lifecycle.yml` now fans out on `dev`-based pull requests only, exactly as it already excluded stacked-child bases. The release-evidence policy gains a -new final fingerprint entry (earlier entries untouched), which also repairs the -pre-existing `ci.yml` drift at `28b38f9150`. +new final fingerprint entry for this unit's `ci.yml` (earlier entries +untouched). The earlier `ci.yml` drift at `28b38f9150` was repaired separately +by #8377. The `docs-site` build was run on this tree: 641 pages, 93,177 internal links checked, Pagefind index built.