Repository navigation
fix(standards-check): enumerate the fleet per owner, classify required - #192
Merged
Merged
Conversation
added 2 commits
October 12, 2026 13:43
The classifier listed repos with `gh repo list` under one token. A
fine-grained token reads only its own owner's repos, so it saw 3 of 14
nightowlstudiollc repos and reported a clean run. It also counted forks.
- List each owner with that owner's token (GH_TOKEN_SWM/_NOS/_TWM):
orgs/<o>/repos for orgs, user/repos for the twistedmelonman user
account. Prefer the real gh binary, since the dotfiles wrapper
overrides a GH_TOKEN prefix.
- Fail with exit 2 if a mapped token is unset, an owner listing is
empty, or the live non-fork count is below a sanity floor (35;
measured 38 on 2026-10-12, 28 smartwatermelon + 10 nightowlstudiollc).
- Skip forks (FORK) as well as archived repos.
- Read branch protection for repos that have a caller: CALLER-ONLY when
the check is not required, CANNOT-REQUIRE for Free-plan private repos.
A bare 403 is ERROR, because a wrong-owner token also returns 403.
Only classic protection is read; a ruleset-only requirement would
show as CALLER-ONLY, a loud false negative.
- Ignore-file entries carry a reason ("owner/repo # reason"); an entry
without one is ERROR. Exact whole-line matching would have silently
stopped matching once a reason was added.
- Drop the stale --extra-repos default; those repos moved to
smartwatermelon and are listed there.
- The class table and token rules move into --help.
Tests cover each new class plus two known-bad listings (too few repos,
one owner empty) that must fail without writing anything.
check_tokens looked only at --owners. An extra repo whose owner has a mapped but unset token hit `set -u` inside a command substitution and came out as a per-repo ERROR (exit 1) instead of the exit 2 that --help promises. Also fixes a stale stub comment (isArchived -> archived/fork).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The standards-check classifier undercounted the fleet. It listed repos with
gh repo listunder a single token, and a fine-grained token reads only its own owner's repos. It saw 3 of 14 nightowlstudiollc repos and still reported a clean run. It also counted forks as in scope.This PR lists each owner with that owner's token. The run now fails, with exit 2, if a token is missing, if an owner listing comes back empty, or if fewer than 35 live non-fork repos turn up. Two new classes separate a caller that is present from a check that is actually required: CALLER-ONLY (not required) and CANNOT-REQUIRE (a private repo on the Free plan, so branch protection is not available). Forks are now reported as FORK and skipped. Each ignore-file entry must give a reason.
Dry run on 2026-10-12 (no writes):
That makes 38 live non-fork repos (39 with the fork). 34 of them call the check and require it.
Branch protection is the only source read for "required". A check that only a ruleset requires would show up as CALLER-ONLY. That is a false negative, but it shows in the output rather than passing silently. No repo has one today.
Tests:
bash tests/test-bulk-install-standards-check.shpasses 47 of 47. There are two known-bad cases: a listing below the floor and an empty owner listing. Both must exit 2 without writing anything.shellcheck -S infois clean.