mirror of
https://github.com/rustfs/rustfs.git
synced 2026-07-26 08:18:18 +00:00
Zhengchao An
f38006868f
Add a default-on multi-role adversarial validation policy to the root AGENTS.md (risk tiers, six reviewer roles, findings protocol, exit criteria), a shared adversarial-validation skill with repo-specific attack probes grounded in shipped bugs, seven audit fixes to the root instruction files, and an actionlint gate for workflow changes.
1.4 KiB
1.4 KiB
GitHub Workflow Instructions
Applies to .github/.
Pull Requests
PR conventions (English title/body, template usage, --body-file with the
heredoc pattern, review-thread etiquette) live in the root AGENTS.md under
"Git and PR Baseline" — that section is the single normative home; do not
duplicate its rules here.
Workflow Changes
- Any change touching
.github/workflows/must passactionlint(run from the repo root) with zero findings before commit/PR. Install viabrew install actionlint, or the download script in the actionlint repo (rhysd/actionlint);make pre-prdoes not cover workflow files, so this is the required check for them. - Custom self-hosted runner labels (
sm-standard-*,dind-*) are declared in.github/actionlint.yaml. When introducing a newruns-on:label, declare it there in the same change. Never use the config or-ignoreto silence real findings — fix the workflow (rootAGENTS.md: make checks pass by fixing the cause, not by weakening the gate). - If
shellcheckis installed, actionlint also lintsrun:scripts; treat those findings as part of the gate.
CI Alignment
When changing CI-sensitive behavior, keep local validation aligned with
.github/workflows/ci.yml. Read the workflow file directly for the current
gate steps — do not rely on (or add) a copied command list here; copies go
stale. make pre-pr is the local equivalent of the main gate.