ci(policies): schema-compliant file-level rule_id + PolicyRunner allowlist

[tomtastisch]

Changes:

• Add optional file-level rule_id to policy rule YAMLs (schema-compliant)
• Extend rules.schema.json to allow optional rule_id
• PolicyRunner: allow root key rule_id (preflight/artifact_contract/summary now pass)

Verification (local):

• tools/ci/bin/run.sh preflight => pass
• tools/ci/bin/run.sh artifact_contract => pass
• tools/ci/bin/run.sh summary => pass

[Copilot]

Pull request overview

Adds support for an optional file-level rule_id in CI policy rule YAMLs by updating the JSON schema and relaxing PolicyRunner’s root-key validation, plus introducing a governance doc mapping file-level IDs to rule files.

Changes:

• Extend rules.schema.json to allow an optional root-level rule_id.
• Update PolicyRunner to allow rule_id as a root YAML key.
• Add file-level rule_id to existing policy YAMLs and document the mapping in governance docs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/ci/policies/schema/rules.schema.json	Adds optional root-level rule_id to the rules YAML schema.
tools/ci/policies/rules/versioning_svt.yaml	Adds file-level rule_id.
tools/ci/policies/rules/shell_safety.yaml	Adds file-level rule_id.
tools/ci/policies/rules/naming_snt.yaml	Adds file-level rule_id.
tools/ci/policies/rules/docs_drift.yaml	Adds file-level rule_id.
tools/ci/policies/rules/artifact_contract.yaml	Adds file-level rule_id.
tools/ci/checks/PolicyRunner/Program.cs	Allowlists root rule_id in YAML root key validation.
docs/governance/CI_POLICY.md	Adds a table mapping file-level rule_id to rule YAML files.

Comments suppressed due to low confidence (1)

tools/ci/checks/PolicyRunner/Program.cs:954

• PolicyRunner now allowlists a root-level rule_id, but it never validates its value. That means malformed/empty file-level IDs will silently pass PolicyRunner validation even though the JSON schema constrains the format. Consider reading the root rule_id (if present) and applying the same regex check used for rules[*].rule_id, adding a validation error when invalid.

        var unknownRootKeys = root.Children.Keys
            .OfType<YamlScalarNode>()
            .Select(static x => x.Value ?? string.Empty)
            .Where(key => key is not ("rule_id" or "rules_schema_version" or "rules"))
            .OrderBy(static x => x, StringComparer.Ordinal)
            .ToList();
        if (unknownRootKeys.Count > 0)
        {
            validationErrors.Add($"root has unknown keys: {string.Join(",", unknownRootKeys)}");
        }

        var versionText = GetScalar(root, "rules_schema_version");
        if (!int.TryParse(versionText, out var parsedVersion) || parsedVersion != schemaVersion)
        {
            validationErrors.Add($"rules_schema_version must equal {schemaVersion}");
        }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tomtastisch]

@codex review

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

tools/ci/checks/PolicyRunner/Program.cs:953

• Root-level rule_id is now allowed, but it isn’t validated anywhere (unlike rules[i].rule_id). This means a malformed file-level rule_id will silently pass PolicyRunner’s YAML validation. Consider reading the optional root rule_id and validating it against the same ^CI-[A-Z0-9_-]+-[0-9]{3}$ regex (and emitting a clear validation error when invalid).

        var validationErrors = new List<string>();
        var unknownRootKeys = root.Children.Keys
            .OfType<YamlScalarNode>()
            .Select(static x => x.Value ?? string.Empty)
            .Where(key => key is not ("rule_id" or "rules_schema_version" or "rules"))
            .OrderBy(static x => x, StringComparer.Ordinal)
            .ToList();
        if (unknownRootKeys.Count > 0)
        {
            validationErrors.Add($"root has unknown keys: {string.Join(",", unknownRootKeys)}");
        }

        var versionText = GetScalar(root, "rules_schema_version");
        if (!int.TryParse(versionText, out var parsedVersion) || parsedVersion != schemaVersion)
        {
            validationErrors.Add($"rules_schema_version must equal {schemaVersion}");

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The NOTE about needing to name this file CI_POLICY.MD to be picked up by governance tooling appears incorrect/misleading: tooling already scans all docs/**/*.MD files (e.g., tools/check-doc-consistency.py uses DOCS_DIR.rglob("*.MD")), and the policy ROC tooling looks specifically for filenames containing POLICY (see tools/check-policy-roc.py). Please update or remove this NOTE so it accurately reflects how the repository’s governance tooling discovers markdown files.

Suggested change

<!-- NOTE: This file should be named `CI_POLICY.MD` (uppercase extension) to be picked up by governance tooling that globs for `*.MD`. -->

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".