Conversation
First pass at the RelOps Herald change-event reporter, focused on producing and reviewing the JSON output before any Herald service exists. - .github/workflows/herald-reporter.yml: placeholder; triggers on push:master but no-ops. Will be replaced with the production pipeline once the JSON output is approved. - .github/workflows/herald-real-commits-test.yml: runs the full pipeline against two fixture commits and uploads event.json artifacts. - .github/herald/build_event.py: maps changed paths to Herald entities (excluding r10k_modules and staging/alpha), calls GitHub Models for the AI summary, validates the assembled event against the schema. - .github/herald/event.schema.json: Herald change-event schema v1. The AI summary uses actions/ai-inference against GitHub Models via the workflow's GITHUB_TOKEN, so no Anthropic API key is required.
GitHub Models catalog for mozilla-platform-ops does not include Anthropic publishers; the initial run failed with '404 Unknown model: anthropic/claude-sonnet-4'. Swapping to openai/gpt-4o-mini, which is present in the catalog and accessible via GITHUB_TOKEN (no API key required).
GitHub Models is not enabled for mozilla-platform-ops, and Anthropic publishers are not in the GitHub Models catalog anyway. Now that an ANTHROPIC_API_KEY org/repo secret has been added, swap the AI step from actions/ai-inference to a plain bash + curl call against api.anthropic.com/v1/messages. Avoids the org Actions allowlist constraint that would apply to anthropics/claude-code-action. Model: claude-sonnet-4-6 (matches the pattern in mozilla/bigquery-etl's claude-review workflow). continue-on-error preserves the graceful failure path: if the curl step fails, the assemble step still produces a schema-valid stub with description=null, error=<reason>.
For each commit, derive the transitive set of Puppet roles affected and bucket them: roles whose name contains 'azure' are recorded as azure_images (Azure custom images Herald tracks separately); all other roles map 1:1 to Taskcluster worker pools and land in worker_pools. Impact is derived by parsing Puppet manifests with regex: - role/role-hiera change -> that role - profile change -> roles including the profile - module change -> profiles using the module -> roles including those profiles - data/os/<Family>.yaml -> roles matching OS substring (linux/win/mac/osx/darwin) - data/common.yaml -> all roles Schema gains a required top-level 'impact' object with worker_pools[] and azure_images[] arrays of role names. Staging/alpha roles continue to be excluded throughout.
Parsing improvements in build_event.py: - Strip Puppet comments before regex matching (drops '# include ...' false matches and /* ... */ blocks). - Add profile -> profile transitive closure so a module/profile change reaches every role whose profile chain pulls it in, not just direct includes. Verified by touching profile 'motd' (only included transitively via OS-base profiles): impact fans out from 8 to 41 roles, which matches reality. New .github/herald/CONVENTIONS.md documents ronin_puppet conventions for the reporter: - Repo shape and entity types - worker-pool vs azure-image (and the 'azure' substring rule) - staging/alpha exclusion - Impact derivation rules per entity type - Terminology guidance for AI summaries The herald-real-commits-test workflow now inlines CONVENTIONS.md into the Claude prompt so descriptions use the same terminology a ronin reviewer would (worker pool, Azure custom image, profile, module, Hiera).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First pass at the RelOps Herald change-event reporter. Scope here is intentionally narrow: produce a JSON event for ronin commits using GitHub Models, so we can review the output quality before any Herald service exists or the production reporter is enabled.
.github/workflows/herald-reporter.yml— placeholder, triggers onpush: masterbut logs only. Will be replaced with the production pipeline once the JSON output is approved..github/workflows/herald-real-commits-test.yml— runs the full pipeline against two fixture commits (f31351e..., 757b34d...) and uploadsevent.jsonas artifacts..github/herald/build_event.py— maps changed paths to Herald entities (excludesr10k_modules/and_staging/alphaper the proposal), parses the AI response (with fenced-JSON tolerance), validates the assembled event against the schema..github/herald/event.schema.json— Herald change-event schema v1.Notes
actions/ai-inferenceagainst GitHub Models via the workflow'sGITHUB_TOKEN, so no Anthropic API key is required.descriptionXORerrorcontract onai_summary, so AI failures degrade gracefully to a stub entry rather than dropping the change.Test plan
event.jsonartifacts for both fixture commitsmozilla-platform-ops(if not, the AI step fails open and emits the null-description stub — still schema-valid)🤖 Generated with Claude Code