Skip to content

ci(policies): schema-compliant file-level rule_id + PolicyRunner allowlist #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tomtastisch merged 7 commits into from
Feb 9, 2026
Merged

ci(policies): schema-compliant file-level rule_id + PolicyRunner allowlist #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
07bbfcf
ci(policies): add schema-compliant top-level rule_id
github-actions[bot] Feb 8, 2026
4da52f5
ci(policy-runner): allow optional top-level rule_id in rule files
github-actions[bot] Feb 8, 2026
b863755
docs(governance): rename CI policy doc to numbered DOC_NAME_RE format
github-actions[bot] Feb 8, 2026
6aabf98
ci: retrigger PR checks
github-actions[bot] Feb 8, 2026
cc62002
docs(governance): classify CI rules list as index (not policy) to sat…
github-actions[bot] Feb 8, 2026
ca02368
Update docs/governance/006_INDEX_CI_RULES.MD
tomtastisch Feb 9, 2026
e325bdb
Update docs/governance/006_INDEX_CI_RULES.MD
tomtastisch Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/governance/006_INDEX_CI_RULES.MD
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# CI Policy Rules
Comment thread
tomtastisch marked this conversation as resolved.
<!-- NOTE: This file should be named `CI_POLICY.MD` (uppercase extension) to be picked up by governance tooling that globs for `*.MD`. -->

Copilot AI Feb 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The NOTE about needing to name this file CI_POLICY.MD to be picked up by governance tooling appears incorrect/misleading: tooling already scans all docs/**/*.MD files (e.g., tools/check-doc-consistency.py uses DOCS_DIR.rglob("*.MD")), and the policy ROC tooling looks specifically for filenames containing POLICY (see tools/check-policy-roc.py). Please update or remove this NOTE so it accurately reflects how the repository’s governance tooling discovers markdown files.

Suggested change
<!-- NOTE: This file should be named `CI_POLICY.MD` (uppercase extension) to be picked up by governance tooling that globs for `*.MD`. -->

Copilot uses AI. Check for mistakes.

| rule_id | file |
| --- | --- |
| `CI-ARTIFACT-000` | `tools/ci/policies/rules/artifact_contract.yaml` |
| `CI-DOCS-000` | `tools/ci/policies/rules/docs_drift.yaml` |
| `CI-NAMING-000` | `tools/ci/policies/rules/naming_snt.yaml` |
| `CI-SHELL-000` | `tools/ci/policies/rules/shell_safety.yaml` |
| `CI-VERSION-000` | `tools/ci/policies/rules/versioning_svt.yaml` |
2 changes: 1 addition & 1 deletion tools/ci/checks/PolicyRunner/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -939,7 +939,7 @@ static bool IsConfiguredBinaryPath(string path, IReadOnlyList<string> configured
var unknownRootKeys = root.Children.Keys
.OfType<YamlScalarNode>()
.Select(static x => x.Value ?? string.Empty)
.Where(key => key is not ("rules_schema_version" or "rules"))
.Where(key => key is not ("rule_id" or "rules_schema_version" or "rules"))
.OrderBy(static x => x, StringComparer.Ordinal)
.ToList();
if (unknownRootKeys.Count > 0)
Expand Down
1 change: 1 addition & 0 deletions tools/ci/policies/rules/artifact_contract.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
rule_id: CI-ARTIFACT-000
rules_schema_version: 1
rules:
- rule_id: CI-ARTIFACT-001
Expand Down
1 change: 1 addition & 0 deletions tools/ci/policies/rules/docs_drift.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
rule_id: CI-DOCS-000
rules_schema_version: 1
rules:
- rule_id: CI-DOCS-001
Expand Down
1 change: 1 addition & 0 deletions tools/ci/policies/rules/naming_snt.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
rule_id: CI-NAMING-000
rules_schema_version: 1
rules:
- rule_id: CI-NAMING-001
Expand Down
1 change: 1 addition & 0 deletions tools/ci/policies/rules/shell_safety.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
rule_id: CI-SHELL-000
rules_schema_version: 1
rules:
- rule_id: CI-SHELL-001
Expand Down
1 change: 1 addition & 0 deletions tools/ci/policies/rules/versioning_svt.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
rule_id: CI-VERSION-000
rules_schema_version: 1
rules:
- rule_id: CI-VERSION-001
Expand Down
25 changes: 22 additions & 3 deletions tools/ci/policies/schema/rules.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,16 @@
"$id": "tools/ci/policies/schema/rules.schema.json",
"type": "object",
"additionalProperties": false,
"required": ["rules_schema_version", "rules"],
"required": [
"rules_schema_version",
"rules"
],
"properties": {
"rule_id": {
"type": "string",
"description": "Rule collection identifier (file-level). Optional.",
"pattern": "^CI-[A-Z0-9_-]+-[0-9]{3}$"
},
"rules_schema_version": {
"type": "integer",
"const": 1
Expand All @@ -15,7 +23,15 @@
"items": {
"type": "object",
"additionalProperties": false,
"required": ["rule_id", "policy_type", "severity", "title", "description", "applies_to", "params"],
"required": [
"rule_id",
"policy_type",
"severity",
"title",
"description",
"applies_to",
"params"
],
"properties": {
"rule_id": {
"type": "string",
Expand All @@ -36,7 +52,10 @@
},
"severity": {
"type": "string",
"enum": ["warn", "fail"]
"enum": [
"warn",
"fail"
]
},
"title": {
"type": "string",
Expand Down
Loading