✨ Workflow models: ingest issue templates, triage, owners and branch rules into drafts by clubanderson · Pull Request #17708 · hivecommons/hive

clubanderson · 2026-11-11T17:00:16Z

RFC phase 5 of the workflow-models RFC (#17620): repository ingest now proposes the intake half of a workflow next to its pipelines, from the repository's own process conventions. Everything is confidence: inferred, cites its source (path:line or api:<endpoint>), uses no LLM, and passes workflowmodel.Compile. Trees without these inputs produce the byte-identical model as before (TestLifecyclePipelineOnlyUnchanged, existing goldens).

What each source produces

Source	Proposes
`.github/ISSUE_TEMPLATE/*.{yml,yaml,md}`, `.github/ISSUE_TEMPLATE.md`	One `requested-<slug>` state per distinct label set in an Intake column, `issue-opened-with-template:<slug>` events (`labels has <bind label>`), transitions open→requested→triage/actionable/closed, label rows per template label
`.github/ISSUE_TEMPLATE/config.yml`	`workflow.hivecommons.dev/blank-issues: disabled` annotation when `blank_issues_enabled: false`
Triage labels in templates, `settings.yml`, `labels.yml`, `labeler.yml`, `CONTRIBUTING.md` (`needs-triage`, `triage/accepted`, `triage/declined`, …)	`triage` state in a Triage column, `triage-requested`/`-accepted`/`-declined` events, `triage-decision` gate released by `approver` (else `maintainer`) with reply `/label <accepted>`, label→state rows; `good first issue`/`help wanted` as plain rows
`kind/`, `priority/`, `type/`, `area/`, `severity/`, `size/` labels	Plain classification label rows (no state), sorted
PR templates (`PULL_REQUEST_TEMPLATE.md`, `.github/PULL_REQUEST_TEMPLATE/*.md`)	`pr-template-<slug>` manual checks per checklist item
`CODEOWNERS` (root, `.github/`, `docs/`)	`approver` role of kind `members`
root `OWNERS`, `OWNERS_ALIASES` (Prow)	`approver` and `reviewer` roles; review gate reply `/approve`
`MAINTAINERS`, `MAINTAINERS.md`	hive-default `maintainer` role becomes kind `members` with the `@handle`/`github.com/handle` spellings named
Any `approver` role	`review` gate (`pr.review is approved`) on the hive-default merge-admission edges
Default-branch rules: `GET …/branches/{b}/protection` → fallback `GET …/rules/branches/{b}`; or probot `settings.yml` `branches[].protection`	`check-<slug>` required CI checks, `required-checks` guard, `review.minApprovals`, `codeowner-review` gate, bookkeeping effects (`enforce-admins`, `require-linear-history`, `require-signed-commits`, `dismiss-stale-reviews`)

The forge half arrives as a synthetic .hive/branch-rules.json file (ingest.BranchRulesPath) that cmd/hive's workflowRepoFiles fills via the new Client.FetchBranchRules when ingesting by repo; LifecycleOptions.BranchRules overrides it. workflow-survey counts intake/triage/role/gate proposals per repository.

Files

pkg/workflowmodel/ingest/{intake,templates,labels,owners,branchrules}.go — new; lifecycle.go, tree.go — wire the intake half and IsIntakePath
pkg/workflowmodel/lifecycle.go — intake/triage columns
pkg/github/branch_rules.go — FetchBranchRules (protection → rulesets fallback)
cmd/hive/workflow_ingest.go, cmd/workflow-survey/main.go
docs/design/workflow-models.md — phase 5 section (heuristics table, citations, techdocs reading, limitations)
Fixtures: testdata/{k8s-owners,md-template,techdocs,maintainers-labels,empty}

Tests / coverage (local, targeted)

workflowmodel 93.3%, ingest 97.1%, github 88.0%, workflow-survey 96.6%; check-api-reference-citations.sh clean; changelog fragment at changelog.d/added-workflowmodel-ingest-intake.md.

Known gaps

Only the root OWNERS is read; CODEOWNERS owners are all approver.
Triage label names come from a fixed table; a repository's own word (status: new) is not recognised.
codeowner-review is informational (the engine does not see touched files).
Rulesets endpoint omits legacy settings such as enforce_admins when administration:read is missing.
Nothing lands in Intake/Triage at runtime until the label-driven engine half writes model labels onto items.

Refs #17620

Ingest now reads the repository's process conventions next to its pipelines and adds an inferred, cited intake half to the draft lifecycle: - issue templates (forms and front-matter Markdown) become one requested-<slug> state per label set in an Intake column, with an issue-opened-with-template:<slug> event bound to the template's label; - a repository triage label (needs-triage, triage/accepted|declined, from templates, settings.yml, labels.yml, labeler.yml or CONTRIBUTING.md) becomes a triage state and gate; - PR template checklist items become manual checks; CODEOWNERS and Prow OWNERS/OWNERS_ALIASES become approver/reviewer member roles owning the review gate; - branch rules (API protection or rulesets via .hive/branch-rules.json, or probot settings.yml) become required CI checks, a required-checks guard, review min approvals, a codeowner-review gate and bookkeeping. Trees without any of these inputs produce the byte-identical model as before; a regression test asserts this over the corpus. Schema gains Gate.MinApprovals, RoleMembers, Check.Kind (all omitempty). Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Client.FetchBranchRules reads GET /repos/{o}/{r}/branches/{b}/protection and falls back to /rules/branches/{b} on 404/403; workflowRepoFiles carries the result at ingest.BranchRulesPath so the dashboard seam is unchanged. A failure to read rules is logged, not fatal. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Per-repo intake stats (intake states, triage, member roles, inferred gates, manual/CI checks, branch rules, template findings) and a repository count per element in summary.json and summary.md, so the RFC phase 5 heuristics can be measured across the corpus. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Heuristics table, citation format, what cncf/techdocs now proposes and the limitations; changelog fragment. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

@handle

A MAINTAINERS / MAINTAINERS.md file (root, .github/, docs/) now turns the hive-default permission-based maintainer role into a members role listing the @handle and github.com/handle spellings it names, and releases the review gate by maintainer when no approver role exists. kind/*, priority/*, type/*, area/*, severity/* and size/* labels declared in labels.yml, settings.yml, labeler.yml, templates or backticked in CONTRIBUTING.md are carried as plain label rows so the triage vocabulary is visible in the editor. Adds the maintainers-labels fixture and direct tests for Client.FetchBranchRules (protection, rulesets fallback, nothing reported, errors). Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

kubestellar-prow · 2026-11-11T17:00:27Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hivecommons-hive · 2026-11-11T17:00:49Z

5c8efc2

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head 5c8efc2af8dc) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

sensitive_path — changes 8 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
- src/pkg/workflowmodel/ingest/testdata/k8s-owners/OWNERS
- src/pkg/workflowmodel/ingest/testdata/k8s-owners/OWNERS_ALIASES
- src/pkg/workflowmodel/ingest/testdata/md-template/.github/CODEOWNERS
- src/pkg/workflowmodel/ingest/testdata/techdocs/.github/workflows/copilot-setup-steps.yml
- src/pkg/workflowmodel/ingest/testdata/techdocs/.github/workflows/format-check.yml
- src/pkg/workflowmodel/ingest/testdata/techdocs/.github/workflows/link-check.yml
- src/pkg/workflowmodel/ingest/testdata/techdocs/.github/workflows/spell-check.yml
- src/pkg/workflowmodel/ingest/testdata/techdocs/.github/workflows/trigger-contribute-site-netlify.yml
secret_exposure — workflow step routes secrets or the environment to a shell sink (Workflow change that prints, encodes or ships secrets off-host)
- src/pkg/workflowmodel/ingest/testdata/techdocs/.github/workflows/trigger-contribute-site-netlify.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

kubestellar-prow · 2026-11-11T17:00:53Z

The OWNERS file contains untrusted users, which makes it INVALID. The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the hivecommons org. You can then trigger verification by writing /verify-owners in a comment.

sig-widgets-reviewers
- User is not a member of the org. Satisfy at least one of these conditions to make the user trusted.
bob
- User is not a member of the org. Satisfy at least one of these conditions to make the user trusted.
sig-widgets-leads
- User is not a member of the org. Satisfy at least one of these conditions to make the user trusted.
alice
- User is not a member of the org. Satisfy at least one of these conditions to make the user trusted.

github-actions · 2026-11-11T17:00:57Z

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#17706	✨ Workflow models: visual editor with live compile, YAML, diff, simulate and export	CONFLICT	`src/docs/design/workflow-models.md` (conflict)
#17710	✨ Workflow models: safe label garbage collection on rebind and model-defined human-gate replies	CONFLICT	`src/docs/design/workflow-models.md` (conflict)

github-actions · 2026-11-11T17:16:44Z

Mutation testing

⏱️ The 900s mutation budget ran out, so 1 package(s) were not fully mutated and the results below do not cover them:

pkg/workflowmodel: skipped (not started)

❌ gremlins did not produce a report for 1 package(s), so no verdict can be derived from this run (see the job log):

pkg/github: gremlins exited 137

4 mutant(s) in changed files are not reached by any test (NOT COVERED). A maintainer may apply the mutation/acknowledged label to accept this.

File	Line	Mutation
`src/cmd/hive/workflow_ingest.go`	40	CONDITIONALS_NEGATION
`src/cmd/hive/workflow_ingest.go`	42	CONDITIONALS_NEGATION
`src/cmd/hive/workflow_ingest.go`	43	CONDITIONALS_NEGATION
`src/cmd/workflow-survey/main.go`	332	CONDITIONALS_NEGATION

Verdict: error (#17349).

github-actions · 2026-11-11T17:23:20Z

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

clubanderson added 5 commits November 11, 2026 09:59

📖 workflow-models: document the phase 5 intake ingest

c4bbcb9

Heuristics table, citation format, what cncf/techdocs now proposes and the limitations; changelog fragment. Refs #17620 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Nov 11, 2026

kubestellar-prow Bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Nov 11, 2026

kubestellar-prow Bot added the do-not-merge/invalid-owners-file Indicates that a PR should not merge because it has an invalid OWNERS file in it. label Nov 11, 2026

github-actions Bot added the conflicts-with-open-pr Open PR has a merge conflict with another open PR label Nov 11, 2026

This was referenced Nov 11, 2026

✨ Workflow models: safe label garbage collection on rebind and model-defined human-gate replies #17710

Merged

✨ Workflow models: visual editor with live compile, YAML, diff, simulate and export #17706

Merged

clubanderson merged commit b43221f into v5 Nov 11, 2026
82 of 90 checks passed

kubestellar-prow Bot deleted the workflowmodel/v5-p5-ingest-intake branch November 11, 2026 17:23

This was referenced Nov 11, 2026

🌱 Top up v6 with v5 (workflow models RFC phases 1–7, OpenShell runtime, benchmarks publisher and more) #17747

Merged

📝 RFC: Workflow models — ingest, store, edit and select a repository's workflow without changing the built-in one #17620

Open

Navigation Menu

Repository navigation

✨ Workflow models: ingest issue templates, triage, owners and branch rules into drafts - #17708

✨ Workflow models: ingest issue templates, triage, owners and branch rules into drafts#17708
clubanderson merged 5 commits into
v5from
workflowmodel/v5-p5-ingest-intake

clubanderson commented Nov 11, 2026

Uh oh!

kubestellar-prow Bot commented Nov 11, 2026

Uh oh!

hivecommons-hive Bot commented Nov 11, 2026

Uh oh!

kubestellar-prow Bot commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

clubanderson commented Nov 11, 2026

What each source produces

Files

Tests / coverage (local, targeted)

Known gaps

Uh oh!

kubestellar-prow Bot commented Nov 11, 2026

Uh oh!

hivecommons-hive Bot commented Nov 11, 2026

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Uh oh!

kubestellar-prow Bot commented Nov 11, 2026

Uh oh!

github-actions Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Open PR overlap check

Uh oh!

github-actions Bot commented Nov 11, 2026

Mutation testing

Uh oh!

Uh oh!

github-actions Bot commented Nov 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Nov 11, 2026 •

edited

Loading