Page MenuHomeVyOS Platform

Rollout typos check workflow
Closed, ResolvedPublic

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Event Timeline

Vijayakumar triaged this task as High priority.
Vijayakumar created this object in space S1 VyOS Public.

Status check 2026-06-18 (triage of open GitHub Infrastructure tasks). @Vijayakumar — current state of this rollout:

  • The check-typos.yml reusable is live in vyos/.github (incl. the 2026-05-28 pure-deletion if:-gate fix + Bullfrog egress-audit step — https://github.com/vyos/.github/pull/128 + https://github.com/vyos/.github/pull/129).
  • It is adopted by exactly one consumer: vyos/vyos-1x (caller added 2026-04-13, commit cc7a0379; mirror twin VyOS-Networks/vyos-1x follows it). No other active code repo has the caller — checked vyos-build, vyatta-cfg-system, vyconf, vyos-documentation, vyos-utils, libvyosconfig, vyatta-cfg (all absent).

So the rollout is effectively paused at 1 repo (no new adoption since 2026-04-13). To reach a clean close:

  1. What is the intended consumer scope? All active code repos, a specific subset, or was vyos-1x the only target? (This task has no description, so the completion bar is undefined.)
  2. If broader, the remaining adoption is straightforward per-repo caller PRs — each adds a .github/workflows/check-typos.yml that calls vyos/.github/.github/workflows/check-typos.yml@production.

Leaving this open pending your scope decision — flag if you want help fanning the caller out to a defined repo set.

Taking over from @Vijayakumar and re-scoping. Research outcome: Mergify cannot run content scanners (it only gates on *existing* check results), so the path forward is fleet-wide-capable enforcement via a GitHub repository ruleset ("require workflows to pass") — no per-repo caller files — piloted on vyos-1x / vyos-build / vyatta-cfg-system / vyconf (branches rolling/circinus/sagitta) in evaluate → active mode, with a rebuilt standalone typos.yml (official crate-ci/typos action, prebuilt binary, fork-safe on: pull_request, full-tree scan, central _typos.toml allowlist). The per-repo-caller rollout (stalled ~2 months at 1 repo) is superseded.

Spec (Architect + Plan-Reviewer gated — Codex gpt-5.5 + Gemini): VYOS/966557697. Jira [System] Change: IS-555. Reassigning to me to drive the pilot.

Phase 1 + Phase 2 (evaluate) progress — 2026-06-19:

Phase 1 SHIPPED: standalone typos.yml + central _typos.toml merged to vyos/.github@production (https://github.com/vyos/.github/pull/150 , squash 2b5ec2d). Uses crate-ci/typos (SHA-pinned, prebuilt binary) over the full tree with a central-config-only allowlist; fork-safe (on: pull_request, persist-credentials:false, same-repo-only failure comment); Bullfrog egress-audit step per org convention. Replaces the stalled per-repo-caller approach (only vyos-1x had a caller).

Phase 2.2 + 2.3 DONE — ruleset live in EVALUATE (non-blocking): created org ruleset require-typos-pilot-2026-06-18 (id 17912054) requiring the Typos workflow on vyos-1x / vyos-build / vyatta-cfg-system / vyconf × rolling / circinus / sagitta. bypass_actors = OrganizationAdmin + Mergify + vyos-bot. Injection verified end-to-end via a throwaway vyconf PR (https://github.com/vyos/vyconf/pull/58 , closed): the Typos check injected + ran (typos . --config .github-central/_typos.toml), caught a deliberate typo, posted the failure comment, stayed non-blocking.

Pending (soaking): the full-tree scan surfaces each pilot repo's pre-existing real typos (e.g. vyconf: Uncommited / meaninful / UNCOMMITED) — fix-in-repo or allowlist per repo to reach a clean baseline, then flip the ruleset evaluate → active (separate gated step), remove the legacy vyos-1x caller, and retire the old workflow_call reusable + scripts. Rollback = delete ruleset 17912054 (pre-state backed up).

Tracking: IS-555.

Typos-check pilot COMPLETE — 2026-06-29.

Typos checking is now enforced via the vyos-org repository ruleset require-typos-pilot-2026-06-18 (enforcement active) — the standalone typos.yml (full-tree scan, central _typos.toml allowlist) is injected as a required check, with no per-repo caller files. Pilot scope: vyos-1x, vyos-build, vyatta-cfg-system, vyconf; branches rolling (+ circinus/sagitta where they exist).

Delivery summary:

  • Phase 0/1: typos.yml + central _typos.toml shipped via vyos/.github#150.
  • Config allowlists/excludes: vyos/.github#152 (changelog/generated/smoketest/mibs excludes + protobuf/j2lint allowlist) + vyos/.github#153 (mke2fs, Maya "Mak", RFC "IDentifier", VPP "Forwrd" false positives).
  • Baseline clean (rolling): vyos/vyos-1x#5298, vyos/vyos-build#1229, vyos/vyatta-cfg-system#245, vyos/vyconf#59. LTS backports merged on VyOS-Networks/vyos-1x (circinus #2326, sagitta #2327) + vyos-build (#819/#820).
  • Activation (2.5): ruleset flipped evaluate→active (/destructive-op-check cleared).
  • Legacy retirement (2.6/2.7): per-repo check-typos.yml caller removed on vyos/vyos-1x + VyOS-Networks/vyos-1x (rolling/circinus/sagitta); old workflow_call reusable + scripts/{check-typos.sh,process-typos.py} retired via vyos/.github#154.

Deferred (future, separate): fleet-wide expansion beyond the 4 pilot repos, repo-local _typos.toml override, dedicated VyOS-Networks-org enforcement. Resolving — pilot objective achieved.