fix(lychee): add the five missing private repos to the exclusions#214
Conversation
The private-repo exclusion list named 4 of the org's 9 private repositories. itinerary-planner, knowledge-corpus, medley-archive, melodic-main-archive, and songwriting were absent, so a link to any of them 404s in the online lane for exactly the reason the list exists to prevent: the calling repo's GITHUB_TOKEN cannot read another private repo. Latent rather than breaking today, since no tracked file currently links to the five. The comment already states the rule this drifted from: "add newly created private repos here". medley-archive precedes medley in the alternation so the longer name cannot be shadowed by a prefix match. Verified with `lychee --dump` over a fixture covering all 9 private repos plus .git and github.com/ghraw variants: the old config leaked 8 private URLs, the new config excludes all of them, and the 3 public repos (standards, ci-workflows, .github) still survive exclusion and stay checked.
|
Claude finished @kyle-sexton's task in 1m 14s —— View job Review
Verdict: Approve — clean maintenance fix, no issues found. What the change doesTwo alternation groups in Regex correctnessThe boundary anchor The Both patterns are internally consistent: the same nine repo names, in the same alphabetical order, in both lines. REVIEW.md checklistNone of the blocking criteria in REVIEW.md are triggered: no handler with object IDs, no tenant-scoped data, no secrets, no parameterization concern, no high-risk auth action, no multi-record atomicity requirement. All applicable checks pass. No nits. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 55da9e0f90
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The contract test pins the private-repo exclusion regexes as exact literals and asserts exclusion against a fixture, so widening the inventory without updating both made the suite fail. Updates the two pinned literals and extends the exclusion loop from 4 to all 9 private repos. The fixture gains the five new repos as well: the loop asserts a URL is absent from the dump, which passes vacuously for any repo the fixture never mentions, so the fixture entries are what make the new assertions real. Adds a raw-content assertion for medley-archive. It is a superstring of medley, so it proves the longer name matches on its own rather than being shadowed by the shorter alternation arm. Verified by mutation: removing songwriting from the config fails assertion [13] (fixture-backed exclusion), not only the literal comparison, confirming the added coverage is not vacuous.
|
Claude finished @kyle-sexton's task in 2m 46s —— View job Review
Verdict: Approve — the second commit squarely addresses the Codex finding, and all three files are consistent end-to-end. What changedThe PR adds five missing private repos (
All three agree on the same nine repos in the same alphabetical order. The alternation in both TOML patterns is identical, which is the only property the raw-url pattern requires (beyond consistent ordering, the Codex finding (resolved)The Codex comment flagged that Regex boundary analysisgithub.laiyagushi.com pattern — ends with github.com/ghraw pattern — ends with The new Coverage
REVIEW.md checklistNo blocking criteria are triggered: no object-level auth, no tenant scope, no secrets, no injection surface, no audit requirement, no multi-record atomicity concern. No nits. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5688944b6a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The component README restated the private-repo inventory as a four-entry list, so widening the config left the maintainer-facing doc wrong. That is the second copy causing the drift, not just a stale line: any future visibility change would desync it again. Replaces the enumeration with a pointer to the alternations in lychee.toml, which owns the fact. Keeps the surrounding description of what the exclusion is for.
|
Claude finished @kyle-sexton's task in 1m 1s —— View job Review
Verdict: Approve — all three commits land cleanly together; no issues found. What the third commit does
End-to-end consistency across all four files
All four files agree. No divergence. REVIEW.md checklistNone of the blocking criteria apply: no object-level auth, no tenant scope, no secrets, no parameterized-input concern, no audit requirement, no multi-record atomicity. All applicable checks pass. No nits. |
Closes #212
Summary
The private-repo exclusion list named 4 of the org's 9 private repositories. Missing:
itinerary-planner,knowledge-corpus,medley-archive,melodic-main-archive,songwriting.A link to any of the five 404s in the online link lane for precisely the reason the list exists to prevent — the calling repo's
GITHUB_TOKENcannot read another private repo. Latent rather than breaking today, since no tracked file currently links to them. The block's own comment states the rule it drifted from: "Keep in sync with actual visibility: add newly created private repos here."medley-archiveis ordered beforemedleyin the alternation so the longer name cannot be shadowed by a prefix match.Test plan
Verified empirically with
lychee --dumpover a fixture covering all 9 private repos plus.gitandgithub.laiyagushi.com/ghrawvariants, comparing old config against new..gitandraw.variants.standards,ci-workflows,.github— confirming the change does not over-exclude.medleyvsmedley-archivedisambiguation confirmed by the fixture, not by reasoning about alternation order.Related
fix(lychee): drop claude-code-plugins and standards from the private-repo exclusions), which moved entries the other direction when repos went public.melodic-software/.github(chore: fix drifted references and workflow schema gap .github#29). Not fixable there —lycheeis an upstream-managed component, so the change belongs here and reaches consumers through the reconciliation sync.gh repo list --visibility private), so it will drift again. A generation or CI-check step would remove the class of problem rather than this instance. Not in scope here.