ci(agent-policy): re-vendor the canonical lifecycle workflow - #129
Merged
Conversation
The vendored copy had fallen behind canonical and was failing the fleet drift check on happyvertical/have-config. It still carried a concurrency block canonical no longer declares, the lifecycle / diagnostic job name, a stale pr_number description, and sigstore/cosign-installer@v4. The cosign change is the one that matters: cosign-installer v4 shells out to envsubst, which is not part of the provider-neutral general runner contract the brokered pool provides, so the old copy was a latent failure on those runners. Canonical downloads the publisher-compatible cosign v3 binary directly and verifies its pinned SHA-256. This repository declares agent_lifecycle_stage: diagnostic with no runner override, so canonical is have-config's templates/github/agent-policy.yml verbatim. The result is byte-equal to what happyvertical/smrt already runs. Closes #128
willgriffin
enabled auto-merge
July 28, 2026 06:35
auto-merge was automatically disabled
July 28, 2026 13:35
Pull request was closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
This repository's vendored
.github/workflows/agent-policy.ymlhad fallen behind canonical, failing the fleet drift check onhappyvertical/have-config:What changed
Replaced with the canonical bytes. Against the old copy that drops a
concurrency:block canonical no longer declares, renames the job fromlifecycle / diagnostictolifecycle, refreshes thepr_numberinput description, and — the part that actually matters — replacessigstore/cosign-installer@v4with a direct, checksum-pinned cosign v3 install.cosign-installerv4 shells out toenvsubst, which is not part of the provider-neutral general runner contract the brokered pool provides. The old vendored copy was therefore a latent failure on those runners. Canonical downloads the publisher-compatible binary directly and verifies its pinned SHA-256, so lifecycle enforcement has identical dependencies on every provider (have-config@c855132).Nothing else is touched — one file, 35 insertions, 3 deletions.
Verification
This repository declares
agent_lifecycle_stage: diagnosticwith no runner override, so canonical ishave-config'stemplates/github/agent-policy.ymlverbatim; the runner substitution is a no-op. The result is byte-equal both to that template and to whathappyvertical/smrtalready runs:actionlintclean.Generation safety
templates/github/agent-policy.ymlis byte-identical at generation 15 (6a565d6), generation 16 (a129dcf) and currenthave-configmain (15d61d2). This repository resolves thestablechannel — generation 15 — today, so the same bytes satisfy both the artifact it runs now and the candidate it will run once the generation-16 rollout finalizes. This change does not need sequencing around that rollout.Closes #128
Parent: happyvertical/have-config#329
{"schema":"hv-agent-run:v1","runtime":"claude","session":"claude-revendor-ocr-9a1d24","issue":"128","policy_revision":"1.0.0","validation":["byte-equality verified against have-config templates/github/agent-policy.yml","byte-equality verified against the copy happyvertical/smrt already runs","actionlint clean","canonical template confirmed unchanged across generations 15, 16 and current main","single-file diff confirmed"]}