Skip to content

chore(inventory): retire public-pii-gate from the contract (backend#1409) #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LukasWodka merged 1 commit into from
Aug 6, 2026
Merged

chore(inventory): retire public-pii-gate from the contract (backend#1409) #183

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 8 additions & 65 deletions repo-inventory.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
#
# MATCHING IS ON `uses:` CONTENT, NEVER ON FILENAME.
# Two filename conventions are mixed within nearly every repo, per-reusable:
# fr-gate, fr-pass-comment, public-pii-gate and code-quality use `<name>-caller.yml`
# fr-gate, fr-pass-comment and code-quality use `<name>-caller.yml`
# everywhere; customer-priority-bump uses the reusable's own name everywhere;
# advance-deploy-env, set-pr-status and kanban-closure-router use `-caller.yml` in
# .github and the plain name in all 14-16 others; kanban-closure-router's callers
Expand Down Expand Up @@ -84,7 +84,6 @@ reusables:
- fr-gate.yml
- fr-pass-comment.yml
- kanban-closure-router.yml
- public-pii-gate.yml
- set-pr-status.yml
- wip-limit-check.yml

Expand All @@ -106,10 +105,6 @@ shared_reasons:
it. Requiring it in any repo would land this guard red on day one; the decision to wire it
up or delete it is backend#1415 follow-up work. Exempt everywhere, deliberately and in
writing.
private_repo_no_public_exposure: &private_repo_no_public_exposure >-
public-pii-gate scans PR title, body and commit messages for PII that would be world-
readable. This repo is private, so there is no public exposure for it to guard. Structural,
not a gap.
no_staging_branch_no_hop_to_gate: &no_staging_branch_no_hop_to_gate >-
fr-gate gates the staging -> prod hop. This repo has no `staging` branch, so there is no hop
for it to gate. Structural, not a gap.
Expand Down Expand Up @@ -165,29 +160,13 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-caller.yml
# Remediated 2026-08-04 (.github#141, backend#1420): this repo was the last public
# repo running no PII gate on its own PRs (backend#1408, backend#1415). The caller is
# a SELF-reference - this repo hosts the reusable - and is pinned `@main` like every
# other caller, per RFC-BACKEND-1405 open question 3 (answered: branch promotion, one
# process for every repo).
#
# PRESENCE, NOT TEETH, and deliberately so: the reusable is unarmed org-wide because
# PII_DENYLIST is unset (backend#1409), which is now PARKED IN THE BACKLOG by decision
# - the org is likely to be restructured first. `required` here asserts the caller
# EXISTS, which is what this inventory tracks; it does not assert the gate can fail.
# When #1409 is unparked, arming the denylist arms all 15 callers at once, this one
# included.
#
# HOW "UNARMED" PRESENTS, since d2485830 (2026-08-03, #1409 defect 1) flipped it
# and the 2026-08-05 prod promotion carried it to main (backend#1556): the
# reusable FAILS CLOSED when the secret is unset - an inactive guard must be
# visible as red, not invisible as green (RFC-1405 property 2). Callers pin
# @main, so every public repo's pii-check now runs RED-INERT, live. Deliberate,
# and it blocks nothing: pii-check is a required status check NOWHERE (all 7
# public repos x all branches, measured 2026-08-04). The red is the honest
# signal that the gate cannot verify anything until #1409 unparks, and the
# check's own log names the fix (set the org secret).
public-pii-gate.yml: required # public-pii-gate-caller.yml
# public-pii-gate is RETIRED (Lukas, 2026-08-06, backend#1409) and no longer
# appears in this inventory. It never had a denylist - PII_DENYLIST was never
# created - so it failed closed on every PR in all 7 public repos while being a
# required check NOWHERE: a permanent red that blocked nothing and taught the org
# to filter it out. The reusable and its selftest remain in this repo, dormant with
# no callers. Restoring it is three steps: set the org secret, restore the 7
# callers, re-add the reusable here with its per-repo entries.
set-pr-status.yml: required # set-pr-status-caller.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -205,8 +184,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -224,8 +201,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -246,8 +221,6 @@ repos:
fr-pass-comment.yml:
exempt: *fr_pass_comment_caller_missing
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -265,7 +238,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml: required # public-pii-gate-caller.yml
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -292,7 +264,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml: required # public-pii-gate-caller.yml
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -310,8 +281,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -329,7 +298,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml: required # public-pii-gate-caller.yml
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -347,8 +315,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand Down Expand Up @@ -396,12 +362,6 @@ repos:
CODEOWNERS, and nothing in the org references it (backend#1408). Onboarding it is a
separate decision from this guard; recorded so its absence is a written exemption
rather than an oversight.
public-pii-gate.yml:
exempt: >-
devex-bootstrap has no .github directory at all, no branch protection and no
CODEOWNERS, and nothing in the org references it (backend#1408). Onboarding it is a
separate decision from this guard; recorded so its absence is a written exemption
rather than an oversight.
set-pr-status.yml:
exempt: >-
devex-bootstrap has no .github directory at all, no branch protection and no
Expand Down Expand Up @@ -448,7 +408,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml: required # public-pii-gate-caller.yml
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand Down Expand Up @@ -480,8 +439,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -499,8 +456,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -518,7 +473,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml: required # public-pii-gate-caller.yml
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -542,8 +496,6 @@ repos:
fr-pass-comment.yml:
exempt: *fr_pass_comment_caller_missing
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand Down Expand Up @@ -587,8 +539,6 @@ repos:
the stage and lack the valve.
kanban-closure-router.yml:
exempt: *kanban_closure_router_caller_missing
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -609,7 +559,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml: required # public-pii-gate-caller.yml
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -627,8 +576,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -646,8 +593,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand All @@ -670,8 +615,6 @@ repos:
fr-gate.yml: required # fr-gate-caller.yml
fr-pass-comment.yml: required # fr-pass-comment-caller.yml
kanban-closure-router.yml: required # kanban-closure-routing.yml
public-pii-gate.yml:
exempt: *private_repo_no_public_exposure
set-pr-status.yml: required # set-pr-status.yml
wip-limit-check.yml:
exempt: *wip_limit_check_has_no_callers
Expand Down
Loading