From e0840a14c400b5c53c56819888e4e343eb87dfe3 Mon Sep 17 00:00:00 2001 From: bigboateng Date: Tue, 28 Jul 2026 11:58:16 +0100 Subject: [PATCH] add Pitot protected native auto-merge gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Disclosure-Reviewed: reviewed — public-safe only, private facet kept out of this commit --- labkit/tests/test_labkit_gen.py | 7 ++- labs/15-pitot/.labkit/generated/verify.yml | 56 +++++++++++++++++++ .../15-pitot/pitot-distribution/UPSTREAM.json | 2 +- .../2026-07-28-native-auto-merge-gate.md | 5 ++ labs/15-pitot/pitot/e2e/e2e_coverage_test.go | 7 ++- labs/15-pitot/publish.config.json | 1 + 6 files changed, 72 insertions(+), 6 deletions(-) create mode 100644 labs/15-pitot/.labkit/generated/verify.yml create mode 100644 labs/15-pitot/pitot-distribution/release-notes/2026-07-28-native-auto-merge-gate.md diff --git a/labkit/tests/test_labkit_gen.py b/labkit/tests/test_labkit_gen.py index 007945a23..9f2a30695 100644 --- a/labkit/tests/test_labkit_gen.py +++ b/labkit/tests/test_labkit_gen.py @@ -150,9 +150,10 @@ def test_release_workflow_goreleaser_builds_and_attests_binaries(): def test_auto_merge_is_opt_in(): # Only labs that set `sync.auto_merge` get a generated public-repo verify.yml. - interlock = generated_artifacts(_config("21-interlock"), REPO_ROOT) - assert any(p.name == "verify.yml" for p in interlock), "interlock opts in => verify.yml" - for name in ("12-product-engineering-loop", "15-pitot", "14-product-value-projection"): + for name in ("21-interlock", "15-pitot"): + artifacts = generated_artifacts(_config(name), REPO_ROOT) + assert any(p.name == "verify.yml" for p in artifacts), f"{name} opts in => verify.yml" + for name in ("12-product-engineering-loop", "14-product-value-projection"): artifacts = generated_artifacts(_config(name), REPO_ROOT) assert not any(p.name == "verify.yml" for p in artifacts), f"{name} did not opt in" diff --git a/labs/15-pitot/.labkit/generated/verify.yml b/labs/15-pitot/.labkit/generated/verify.yml new file mode 100644 index 000000000..300ad57ee --- /dev/null +++ b/labs/15-pitot/.labkit/generated/verify.yml @@ -0,0 +1,56 @@ +# Generated by labkit (python -m labkit gen). Do not edit by hand. +# Edit labs//publish.config.json and regenerate; drift fails `labkit doctor`. +# Install into operatorstack/pitot at .github/workflows/verify.yml (bootstrap step). +name: Verify Pitot distribution + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +concurrency: + group: verify-pitot-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest, macos-latest, windows-latest] + runs-on: ${{ matrix.os }} + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-go@v7 + with: + go-version-file: go.mod + cache: true + - run: go test ./... + - run: go build ./... + + verify-sync-provenance: + if: >- + github.event_name == 'pull_request' && + github.event.pull_request.head.repo.full_name == github.repository && + startsWith(github.head_ref, 'sync/intelligence-flow-') + needs: test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha }} + - name: Verify generated projection provenance + env: + HEAD_BRANCH: ${{ github.head_ref }} + PR_AUTHOR: ${{ github.event.pull_request.user.login }} + shell: bash + run: | + source_repo="$(jq -r '.source.repository' UPSTREAM.json)" + source_commit="$(jq -r '.source.commit' UPSTREAM.json)" + short="${source_commit:0:12}" + [[ "$PR_AUTHOR" == "operator-stack-publisher[bot]" ]] + [[ "$source_repo" == "operatorstack/intelligence-flow" ]] + [[ "$HEAD_BRANCH" == "sync/intelligence-flow-$short" ]] diff --git a/labs/15-pitot/pitot-distribution/UPSTREAM.json b/labs/15-pitot/pitot-distribution/UPSTREAM.json index 3f3dbaa0d..82d6bb472 100644 --- a/labs/15-pitot/pitot-distribution/UPSTREAM.json +++ b/labs/15-pitot/pitot-distribution/UPSTREAM.json @@ -32,7 +32,7 @@ "conformance/fixtures/negative.jsonl": "503ea76988df595d96ebf695f991b8ea6c892be4a578522dff4ddb0d39b647e4", "conformance/fixtures/positive.jsonl": "881efdf58b66ee7d03171c6b4410bf1bce9e1b8db5c8bf969d0e8ec467420c3f", "doc.go": "a8abdafac969b1bf4372c8bb023aa51125dc073f03218f4ab9913dfc5ffa877d", - "e2e/e2e_coverage_test.go": "6235bd1df7212e4e229be324ac50f592aef70dce8855519d02e6b843656ea109", + "e2e/e2e_coverage_test.go": "09a738ca70749be94c462ce9974cdac9a7be0b24b9dc2b20ec0738d4686ebfbf", "e2e/e2e_hook_test.go": "5e184dc8907b6e36daeab90bbbb1654fa5336312866412031805a13ba535d1f8", "examples/doc.go": "58f3f9eb7d272d7b6eecdb05f43e1613d5e3ef92d15d97c5440bd4b6990c26f9", "examples/local-approval/main.go": "51386af324cd7d3bb07fe3ace53503884b02714b96b83073342fde81ce3b83a5", diff --git a/labs/15-pitot/pitot-distribution/release-notes/2026-07-28-native-auto-merge-gate.md b/labs/15-pitot/pitot-distribution/release-notes/2026-07-28-native-auto-merge-gate.md new file mode 100644 index 000000000..4b9ca76fa --- /dev/null +++ b/labs/15-pitot/pitot-distribution/release-notes/2026-07-28-native-auto-merge-gate.md @@ -0,0 +1,5 @@ +### Pitot syncs now use protected native auto-merge + +Pitot gains the generated Linux, macOS, and Windows verification gate. The +publisher App requests native squash auto-merge, while required checks decide +when the projected change may land. diff --git a/labs/15-pitot/pitot/e2e/e2e_coverage_test.go b/labs/15-pitot/pitot/e2e/e2e_coverage_test.go index 649c4e816..70fb01422 100644 --- a/labs/15-pitot/pitot/e2e/e2e_coverage_test.go +++ b/labs/15-pitot/pitot/e2e/e2e_coverage_test.go @@ -10,9 +10,12 @@ import ( ) func TestAllAdaptersHaveE2EScripts(t *testing.T) { - // The e2e package lives in labs/15-pitot/pitot/e2e - // The test scripts live in labs/15-pitot/tests + // Monorepo: labs/15-pitot/pitot/e2e -> labs/15-pitot/tests. + // Public projection: e2e -> tests. testsDir := filepath.Join("..", "..", "tests") + if _, err := os.Stat(testsDir); os.IsNotExist(err) { + testsDir = filepath.Join("..", "tests") + } for _, host := range adapters.Supported() { t.Run(string(host), func(t *testing.T) { diff --git a/labs/15-pitot/publish.config.json b/labs/15-pitot/publish.config.json index 90d56a173..bb4bfbc73 100644 --- a/labs/15-pitot/publish.config.json +++ b/labs/15-pitot/publish.config.json @@ -5,6 +5,7 @@ "source": { "repo": "operatorstack/intelligence-flow", "lab_path": "labs/15-pitot" }, "target": { "owner": "operatorstack", "repo": "pitot" }, "go_module": "github.com/operatorstack/pitot", + "sync": { "auto_merge": true }, "manifest": { "path": "pitot-distribution/UPSTREAM.json", "committed": true,