ci(pg-erd): centralize quality on isolated self-hosted runners

[seonghobae]

Summary

Adds the fixed-consumer pg-erd-cloud quality reusable workflow to the organization control plane. The product-specific workflow retains backend/frontend gates and inherits the self-hosted-only CWL CI isolated + cwlab-ci-isolated routing contract from canonical runner-policy owner #2565. No hosted fallback, arbitrary executable input, inherited secrets, or author self-approval is added.

Current exact-head topology — 2026-10-09

• Exact head: 9c209b3bed74c5af91d00905777400134be34e9c
• Exact tree: bf1e491743c5636a29ed488a7bcf0a35f061f8ad
• First ordinary merge: b8194dfb41b045b4830b54088994e39b4f351679, parents prior ci(pg-erd): centralize quality on isolated self-hosted runners #2606 9d03f53b6deeac062b51af4f12c86c5997495091 and exact runner-policy owner ci: stage all workflows on isolated self-hosted runners #2565 a206770680895adba000d7538fc3d5a5b499149e
• Second ordinary merge: current head, parents b8194dfb41b045b4830b54088994e39b4f351679 and exact current-time fixture owner test(codeql): keep current-time fixtures fresh #2609 8ba032a3df47c8f401a7017ae84302c725c2f9c8
• Publication used an expected-head protected, non-force ref update. No rebase or Force Push occurred.
• Base is ci: stage all workflows on isolated self-hosted runners #2565 branch ci/sdp-all-self-hosted-20261003. The child comparison contains the three pg-erd-owned files plus test(codeql): keep current-time fixtures fresh #2609's one owner fixture file; it does not duplicate either prerequisite implementation.

Root cause and repair

The prior PR targeted main while claiming #2565's runner labels and custom actionlint vocabulary. That made the consumer a parallel writer of a mutable shared policy. Ordinary integration exposed seven true conflicts between protected-main runner routing and #2565. They were resolved identically to the already-published #2607 stack: #2565 remains the canonical owner of CWL CI isolated routing.

The first merged-tree repository suite then reproduced two time-dependent failures in tests/test_audit_org_codeql_coverage.py (5,512 passed, 2 failed, 10 skipped, 40 subtests). Those are the exact RED failures owned and repaired by #2609, so its exact head was integrated as a second merge parent instead of copying the fix.

Exact-tree executable evidence

• Combined pg-erd, runner-policy, queue, and CodeQL-time contracts: 346 passed normally and 346 passed with GITHUB_ACTIONS=true
• Warning-fatal complete repository suite: 5,514 passed, 10 skipped, 40 subtests
• 39/39 workflow YAML files parse successfully
• Python compileall, git diff --check, and clean worktree: GREEN
• Current exact-head CodeQL is in progress; JavaScript Coverage and Repository Metadata are queued. Pending Checks are not source failures and were not rerun or replaced.

Activation requirements / lifecycle

Draft / Proposed / merge HOLD. Draft is required because #2565 is a mutable, unready runtime prerequisite whose isolated runner group/capacity and cleanup canary remain absent.

• ci: stage all workflows on isolated self-hosted runners #2565 owns global routing, group/label policy, and isolated-capacity activation.
• test(codeql): keep current-time fixtures fresh #2609 remains an independent Ready prerequisite and requires terminal exact-head Checks plus qualifying approval before merge.
• Operator lane ContextualWisdomLab/linux-cluster-ops#326 owns disposable runner isolation/canary. Do not borrow or relabel privileged runners.
• A thin consumer caller must use a real immutable central commit SHA without secrets: inherit; required check names must be reconciled without weakening protection.
• Noema/OpenCode routes remain orchestrator/free; no provider/model/paid fallback is introduced.
• No bypass, auto-merge, source-neutral rerun, predecessor retirement, or merge is authorized by this receipt.

Provenance correction retained

Earlier offline artifact manifests contained unsupported web-retrieval claims. They remain withdrawn. Local executable results and independently reviewed source bytes are evidence; live documentation retrieval must be verified before activation.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0c24b183-c879-4b02-a1dd-bfee163d0963

📥 Commits

Reviewing files that changed from the base of the PR and between 4e32b99 and 7ad86ae.

📒 Files selected for processing (3)

• .github/workflows/pg-erd-cloud-quality.yml
• docs/doctoring/pg-erd-central-quality-20261008.md
• tests/test_pg_erd_quality_workflow.py

 __________________________________
< RabbitMQ is just my side hustle. >
 ----------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current authority — exact stacked head

• Lifecycle: Draft / Proposed / merge HOLD. Draft is required by mutable, unready runner-policy prerequisite ci: stage all workflows on isolated self-hosted runners #2565; pending Checks or missing approval are not the reason for Draft.
• Exact head: 9c209b3bed74c5af91d00905777400134be34e9c; tree bf1e491743c5636a29ed488a7bcf0a35f061f8ad.
• Topology: ordinary merge b8194dfb41b045b4830b54088994e39b4f351679 has parents prior head 9d03f53… and ci: stage all workflows on isolated self-hosted runners #2565 exact a206770…; current head then has parents b8194df… and test(codeql): keep current-time fixtures fresh #2609 exact 8ba032a…. The ref moved with force=false and expected prior head; no rebase or Force Push.
• Base is ci: stage all workflows on isolated self-hosted runners #2565 branch ci/sdp-all-self-hosted-20261003; GitHub confirms merge-base equals exact ci: stage all workflows on isolated self-hosted runners #2565 and the child comparison is four files: three pg-erd-owned files plus test(codeql): keep current-time fixtures fresh #2609's owner fixture.
• RED on the first merged tree: the two time-dependent CodeQL fixture tests failed (5,512 passed, 2 failed). GREEN after owner integration: 346/346 combined contracts normally and under GITHUB_ACTIONS=true; full warning-fatal suite 5,514 passed, 10 skipped, 40 subtests; 39/39 workflow YAML parses; compileall and diff check GREEN.
• Exact-head CodeQL run 37895349947 is Draft-skipped. JavaScript Coverage run 37895350181 and Repository Metadata run 37895349960 are queued. They were not rerun or replaced. Reviews 0; unresolved threads 0.

This COMMENT/evidence is not approval. No bypass, auto-merge, merge, runner relabeling, access expansion, or source-neutral rerun is authorized.

[seonghobae]

Current authority — exact head 56c1435ab16fec9ef196e3bd4773845acf8f50a2

This Draft stack now consumes #2565 causal owner repair 8d4a2eb1061c060360741d4015e4350ffde6a3eb as an ordinary merge parent.

• exact tree: 18950f46bb7c6ad011dab2dd047fa7463ced29f7
• base: ci/sdp-all-self-hosted-20261003 at that exact owner head
• child delta remains bounded; the only inherited change is the fail-closed CWL law CI ↔ law-ai-agent-ci contract
• affected contracts: 59 passed normally and 59 passed with GITHUB_ACTIONS=true
• git diff --check: GREEN
• Draft reason remains the mutable owner prerequisite; queued Checks or missing approval are merge blockers only
• no force push, destructive rebase, rerun, or state toggle

[seonghobae]

PR2606 인프라 예외 병합 기록

사용자의 2026-10-13 직접 지시에 따른 인프라 한정 bypass merge를 적용한다. 보호 규칙이나 검사 결과를 변경하지 않는다.

• 정확 head: 7ad86ae
• main 기준: 4e32b99
• 검토 tree: fdad8d98487781f35d08fd662a97efea5c336fd4
• main 대비 신규 3개 파일만 추가한다. 기존 중앙 workflow와 전체 다른 tracked blobs/modes는 main 그대로다.
• 부모의 집중 시험 57 PASS. 넓은 관련 subset 135 PASS/2 FAIL; 두 실패는 pristine main에서도 동일 재현됐다. 전체 suite PASS로 보고하지 않는다.
• 독립 source security/logic APPROVE, 24 PASS/actionlint 통과. final-review.json에 검토 identity와 범위를 보존했다.
• PR2606 Actions 실행, 정식 Noema/OpenCode App 승인 및 제품 실제 runner 실행은 INCOMPLETE/ABSENT. 로컬 source 리뷰를 App APPROVED로 표시하지 않는다.
• push의 baseline Dependabot 배너는 37 alerts(2 critical/18 high/17 moderate)를 알렸다. 소스 3개 파일에는 dependency 변경이 없다. 배너만으로 scanner 성공이나 각 finding 해결을 주장하지 않는다. 해당 기존 finding remediation은 별도 남은 작업이다.
• 기존 OpenCode artifact upload 장애/스토리지 quota, 승인 전송 부재는 소스 납품과 별도 복구 노드다.
• source 충돌 8개는 수리했고 검토된 head는 충돌 없는 tree다. source defect를 infrastructure로 재분류하지 않았다.
• 실행: Ready 전환 후 gh pr merge --admin --merge --match-head-commit 7ad86ae. 실제 mergedAt/mergeCommit/main tree는 실행 후 별도 검증한다.

병합은 소스 전달만 완료한다. 운영 활성화, Actions 검증, App 승인, release 완료를 의미하지 않는다.

[devin-ai-integration]

Devin Review found 1 potential issue.

⚠️ 1 issue in files not directly in the diff

🟨 PR dependencies share persistent npm cache

On a same-repository PR, npm ci installs untrusted dependencies while npm caching uses persistent runner storage. A PR can poison packages later jobs restore.