ci: add CI gate for branch protection (RIG-2213) - #3
Merged
Conversation
Add a `.github/workflows/rigel-ci.yml` whose job is named `CI` so the fork's `main` branch-protection ruleset can pin `["CI"]` as its required status check. The job runs `ruff check .` — the same blocking lint upstream's `lint.yml` runs, with ruff pinned to the pyproject `dev` version (0.15.10) — on a GitHub-hosted `ubuntu-latest` runner. It is a real, self-contained gate under our control that goes green on this fork. Why standalone rather than aggregating upstream's `ci.yml`: upstream's `all-checks-pass` aggregator cannot go green here because the Python suite has a test-isolation defect — `tests/hermes_cli/test_models.py` patches only the OpenRouter `/v1/models` request, not the catalog-manifest fetch, which succeeds on GitHub-hosted network egress and returns a list disagreeing with the static snapshot, so three assertions fail. A `needs:`-aggregator over that suite would stay red and wedge the required-check pin. Fixing the suite is fork product work tracked separately; this producer unblocks the branch-protection rollout. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
mintaka-rig-2213-hermes-agent-ci
branch
from
August 21, 2026 19:19
c30c22a to
d02e57c
Compare
rigel-mintaka
marked this pull request as ready for review
August 21, 2026 19:20
The workflow display `name: CI` was identical to upstream's ci.yml orchestrator display name, making the two indistinguishable in the Actions tab and ruleset UI. Rename the display to `Rigel CI`; the job id stays `CI`, so the pinnable status-check context is unchanged and only this workflow produces it. Spec-impact: none
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a job named exactly
CIto the existing orchestrator workflow (.github/workflows/ci.yml). Itneeds: [all-checks-pass]and runsecho ok, so the posted check-run namedCIis green exactly when the real aggregated gate (tests, lint, js-tests, docs-site, history-check, contributor-check, uv-lockfile, docker-lint, supply-chain, osv-scanner) passes. This gives the fork's main-branch["CI"]ruleset a check-run to pin without duplicating or re-running the gate, and without touching upstream's other workflows.Co-authored-by: Matt Wilkinson matt@rigel.build