Repository navigation
Qualify actual CLI Markdown reports in PRs - #3
Merged
Merged
Conversation
RootformCLI Architecture76 instances, 18 Relations, 68 Contexts, and 14 Contributions added. Form loaded. Planned changes compare Refreshed with Planned. Uncertainty
Planned changes
Instances: 76 added
Relations: 18 added
Contexts: 68 added
Contributions: 14 added
Reported driftNo drift reported in this plan. The export does not establish the refresh scope. Terraform and OpenTofu omit drift records both when refresh finds no drift and when refresh does not run. Plan JSON does not record whether refresh was limited (-refresh=false, -target); an unrefreshed object reports no drift; data sources and deposed objects are outside drift records. Δ Net changeSame determined changes as Planned changes. Planned architecture
Interpreted counts the instances a Rule matched; Relations, Contexts, and Contributions count determined facts; Uncertainty counts what the evidence could not settle. PoliciesCaution Verdict: VIOLATED Planned architecture1 Policy selected. 1 evaluation violated.
Requirement: Synthetic negative qualification policy. Violated: 1 evaluation
DetailsProvenance
|
soulbah
changed the title
4 tasks done
soulbah
added a commit
to rootform-dev/action
that referenced
this pull request
Oct 2, 2026
## Spec and outcome - Spec or repository-only rationale: SPEC-006, owner-approved complete review clarification. - Accepted outcome: every Markdown-producing Action call requests `--details`. Reports keep one identity and major result blocks, with audit detail last. Inline size limits retain CLI-written primary statements and evidence links; complete output files and artifacts retain every entry. - Explicit non-goals: semantic parsing, new inputs/outputs, dependency changes, CLI publication, or moving the published v1 ref. ## Done when and evidence - Done when command or protocol: `bun run verify`; `ROOTFORM_TEST_FIXTURES=<clean exact public fixture checkout> bun run test:integration`; public qualification PR 3. - Evidence path or exact output: 80 runtime tests / 538 assertions and 115 tooling tests pass. Ten genuine published-binary integrations at 0.1.0-pr.117.1 reject compact preview wording. Report tests cover current and legacy CLI hierarchy, exact statements/counts and large exhaustive detail. Final public execution and rendered result are tracked in [qualification PR 3](rootform-dev/action-qualification#3). - Full gate: `bun run verify` passed, including workflow lint, working-set/history secret scans and reproducible committed bundle. ## Risk and privacy - Security/privacy impact: no permission or artifact inventory change. Complete derived reports replace compact previews; raw inputs remain excluded. PR commenting stays opt-in with existing HEAD/run/concurrency guards. - Offline and determinism impact: no acquisition or semantic behavior change. Reports are generated in the same existing CLI calls. - Dependency or toolchain change: none. - Rollback path: pin the previous reviewed immutable Action commit. ## Review checklist - [x] Scope matches accepted spec or repository-only rationale. - [x] Success, boundary, failure, and regression paths have evidence proportional to risk. - [x] No secret, real Terraform material, private AI material, or generated noise enters Git. - [x] Primary reviewer inspected final diff and recorded remaining limits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The integrated workflow publishes a complete CLI review report to Job Summary and the single protected bot comment. The report uses one Rootform identity, Architecture/Policies/Details blocks, evaluated-side and change subsections, inline uncertainty, native verdict alerts and collapsed audit detail. Only the Delta symbol is retained for Net change.
The actual published Rootform
0.1.0-pr.117.1analyzes public shared-data-platform fixtures from74bd643f3001a37f8b4f881c0ae33db047b6aba3, then checks its Form with the synthetic negative Policy Pack. The public CLI module at reviewed commita1adfafa66a548b270727cfbce913325e5980f77renders that real saved evidence with--details. Compilation and new Policy evaluation are unavailable in the embedding. A recorded answer is reusable only for its exact Form digest, stage and selected Policies; exported Form and Policy result bytes must remain identical.Shared reporting and stale-run protection use qualified immutable Action commit
cc457702223d887c9db5da52ba36099ad3e1b4e0, whose source and bundle are identical to reviewed merged commit8b026e9c7268a960ed6f9b48ecea404180ddb151. This qualifies source presentation; it does not claim a newly distributed binary or move a published Action ref.Evidence includes 13 generated report cases rendered by GitHub GFM, both Delta goldens, full CLI/repository gates, ten actual published-binary integrations, and five native platforms. The complete report run preserved exact Form/Policy bytes and updated comment
5954262030; final source-pin refresh is recorded in its latest linked workflow. All 76 instances are present in the collapsed list. Raw inputs and executables are excluded from the eight-file derived artifact.Live GitHub dark rendering verifies hierarchy, native CAUTION, full disclosure lists and collapsed provenance. Light rendering remains unverified: this browser exposes no theme control. No system appearance preference was changed.
Final artifact:
11237652297, eight derived files. Form SHA-256:04eb843d7d27e7a1502368f13aa5449cf87e7832a9b3f986d30ae539d2b43857. Complete report SHA-256:cf1414409597bbbadba10be569ecf87fefe05fd5ad4f2016821ea1a23a2b1d9c. Same protected bot comment5954262030; complete CLI body preserved.