kevinveenbirkenbachandClaude Opus 4.8
0bcd63b658
The merged subset feature failed test-lint: a .py under scripts/, a local parents[N] PROJECT_ROOT, a direct yaml.safe_load, an uncached read, and narration comments. - move scripts/meta/resolve/pr/subset_roles.py -> cli.meta.ci.subset_roles (scripts/ is .sh-only); dispatcher invokes it via python -m - parse via utils.cache.yaml.load_yaml_str; import utils.PROJECT_ROOT - test invokes the module via -m against real roles; nocheck the tempfile read - strip narration comments; docs document HOW not WHY Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2.9 KiB
Summary
Briefly describe the CI/CD or pipeline change and the expected effect.
Examples:
- Add a new workflow or reusable workflow
- Fix flaky CI, release, or image automation behavior
- Improve workflow permissions, observability, or execution flow
Template Type
Select the primary intent of this PR:
- Feature - Adds or extends CI/CD functionality
- Fix - Repairs broken or incorrect CI/CD behavior
Affected Components
List the impacted workflows and related automation.
- Workflow file(s):
- Related scripts, actions, jobs, or images:
- Fork, PR, release, or scheduled paths affected:
Roles (optional 🧩 Subset CI scope)
Optional. Ignored unless a maintainer applies the 🧩 Subset label; without the label CI uses the diff-derived role set as usual. When the label is set, CI deploys only the roles listed here — each must be an existing roles/<id> directory, or the run fails. See pipeline.md.
roles:
# - web-app-nextcloud
# - sys-version
Change Type
Select the semantic version impact of this change:
- Major - Breaking change
- Minor - New backwards-compatible feature
- Patch - Small improvement or compatible adjustment
Change Details
Explain what changed and why.
Key points:
- What pipeline problem or capability does this address?
- How do triggers, permissions, concurrency, or artifacts behave after this change?
- Are fork, secret, or release paths affected?
- Which alternatives were considered?
Validation
Describe how the pipeline change was validated.
- Local or targeted script validation performed
- Workflow run in fork or equivalent validation
- Relevant logs or run links attached
- Failure-path or retry behavior checked
Security Impact
Indicate whether this change has security implications.
- No relevant security impact
- Security impact present
If security impact is present, explain:
- Affected permissions, secrets, tokens, artifacts, or release surfaces:
- Risk reduction, new exposure, fork-safety, or compatibility considerations:
- Security-specific validation performed:
Review Focus
Help reviewers focus on the riskiest parts of this PR. For repository-wide contribution and review expectations, see CONTRIBUTING.md.
- Highest-risk workflows, jobs, or scripts:
- Permissions, fork-safety, release, or security-sensitive concerns:
- Specific feedback requested from reviewers:
Definition of Done (DoD)
- The implementation follows the Definition of Done, and the contribution guidelines in CONTRIBUTING.md were considered and applied during implementation.
Additional Notes
Add any reviewer context for rollout, fork behavior, release impact, or follow-up work.