From 98cd0e7505536f746b7615bdcccb4176dc14abe4 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 07:32:55 +0100 Subject: [PATCH 1/3] docs(agents): the consumer census now searches the monorepo itself devantler-tech/monorepo#4925 added the monorepo as a census row, so the blast-radius rule no longer needs to send readers to search it by hand. Co-Authored-By: Claude Fable 5.2 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 8795ec70..d26f80cb 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -330,7 +330,7 @@ actionlint The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`. -**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the default branches of the monorepo's non-archived submodules: check separately callers on this pull request's branch and other active branches, the monorepo's own workflows (devantler-tech/monorepo#4917), repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. +**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the default branches of the monorepo and its non-archived submodules: check separately callers on this pull request's branch and other active branches, repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check. From 7385245c3939bd6ea7a96d6f1326b498ef3306a2 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 08:07:41 +0100 Subject: [PATCH 2/3] docs(agents): say how to tell a census that searched the monorepo A checkout older than devantler-tech/monorepo#4925 runs a census that skips the monorepo without saying so. The row for `.` is the tell. Co-Authored-By: Claude Fable 5.2 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index d26f80cb..557bbe17 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -330,7 +330,7 @@ actionlint The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`. -**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers, and the census covers only the default branches of the monorepo and its non-archived submodules: check separately callers on this pull request's branch and other active branches, repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. +**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers. The output must have a row for `.`, the monorepo itself; a census without that row comes from a checkout older than devantler-tech/monorepo#4925, so update the checkout first. The census covers only the default branches of the monorepo and its non-archived submodules: check separately callers on this pull request's branch and other active branches, repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check. From c12c240b7ccd048f18650d39d9b5a5bdaf4641a8 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 08:34:04 +0100 Subject: [PATCH 3/3] docs(agents): run the consumer census from the monorepo itself, not a fork The monorepo row searches the checkout's origin, so a stale fork could report no consumers. Co-Authored-By: Claude Fable 5.2 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 557bbe17..0886914d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -330,7 +330,7 @@ actionlint The auto-merge workflow's own allow-lists (`TRUSTED_BOT_AUTHORS`, `TRUSTED_TRIGGER_ACTORS` and `TRUSTED_REVIEW_ACTORS` in `.github/workflows/enable-auto-merge.yaml`) decide what that workflow acts on and are maintained only there; they are separate from the agents' trust gate in the monorepo `AGENTS.md`. -**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers. The output must have a row for `.`, the monorepo itself; a census without that row comes from a checkout older than devantler-tech/monorepo#4925, so update the checkout first. The census covers only the default branches of the monorepo and its non-archived submodules: check separately callers on this pull request's branch and other active branches, repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. +**Blast radius first:** a change to a composite action / reusable workflow affects **every consumer repo**. Prefer additive, backward-compatible changes; call out any breaking input/output change prominently in the PR body and treat it as a deliberate decision (keep an alias where feasible). List the consumers first with the monorepo's [`consumer-census.sh`](https://github.com/devantler-tech/monorepo/blob/main/.claude/scripts/consumer-census.sh): from a monorepo checkout, `.claude/scripts/consumer-census.sh ".yaml, without owner or ref>"` (that form matches both remote and same-repository callers) prints each caller's `file:line`; read each caller's inputs there, because an input-name search misses callers that rely on a default. An `UNKNOWN` repository was not searched, which is never zero consumers. The output must have a row for `.`, the monorepo itself; a census without that row comes from a checkout older than devantler-tech/monorepo#4925, so update the checkout first. That row searches whatever the checkout calls `origin`, so run the census from a checkout of `devantler-tech/monorepo` itself, never from a fork. The census covers only the default branches of the monorepo and its non-archived submodules: check separately callers on this pull request's branch and other active branches, repositories that are not submodules, and repositories that an organization ruleset makes run a required workflow. **Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs. Native `$/` self-references bind to the defining file's repository and exact commit; same-source actions and reusable workflows use this form. Retain source checkouts only where scripts or fixture data still need their files. Deliberately checked-out product-base validators must retain that different source identity. Follow the catalogue guide's self-reference rules; never weaken a security control to pass a check.