Details
- Version
- -
- Is it a breaking change?
- Unspecified (possibly destroys the router)
- Issue type
- Unspecified (please specify)
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Vijayakumar | T6707 Implement a new build and release workflow based on GitHub Actions | |||
| Resolved | syncer | T8490 Rollout typos check workflow |
Event Timeline
Status check 2026-06-18 (triage of open GitHub Infrastructure tasks). @Vijayakumar — current state of this rollout:
- The check-typos.yml reusable is live in vyos/.github (incl. the 2026-05-28 pure-deletion if:-gate fix + Bullfrog egress-audit step — https://github.com/vyos/.github/pull/128 + https://github.com/vyos/.github/pull/129).
- It is adopted by exactly one consumer: vyos/vyos-1x (caller added 2026-04-13, commit cc7a0379; mirror twin VyOS-Networks/vyos-1x follows it). No other active code repo has the caller — checked vyos-build, vyatta-cfg-system, vyconf, vyos-documentation, vyos-utils, libvyosconfig, vyatta-cfg (all absent).
So the rollout is effectively paused at 1 repo (no new adoption since 2026-04-13). To reach a clean close:
- What is the intended consumer scope? All active code repos, a specific subset, or was vyos-1x the only target? (This task has no description, so the completion bar is undefined.)
- If broader, the remaining adoption is straightforward per-repo caller PRs — each adds a .github/workflows/check-typos.yml that calls vyos/.github/.github/workflows/check-typos.yml@production.
Leaving this open pending your scope decision — flag if you want help fanning the caller out to a defined repo set.
Taking over from @Vijayakumar and re-scoping. Research outcome: Mergify cannot run content scanners (it only gates on *existing* check results), so the path forward is fleet-wide-capable enforcement via a GitHub repository ruleset ("require workflows to pass") — no per-repo caller files — piloted on vyos-1x / vyos-build / vyatta-cfg-system / vyconf (branches rolling/circinus/sagitta) in evaluate → active mode, with a rebuilt standalone typos.yml (official crate-ci/typos action, prebuilt binary, fork-safe on: pull_request, full-tree scan, central _typos.toml allowlist). The per-repo-caller rollout (stalled ~2 months at 1 repo) is superseded.
Spec (Architect + Plan-Reviewer gated — Codex gpt-5.5 + Gemini): VYOS/966557697. Jira [System] Change: IS-555. Reassigning to me to drive the pilot.
Phase 1 + Phase 2 (evaluate) progress — 2026-06-19:
Phase 1 SHIPPED: standalone typos.yml + central _typos.toml merged to vyos/.github@production (https://github.com/vyos/.github/pull/150 , squash 2b5ec2d). Uses crate-ci/typos (SHA-pinned, prebuilt binary) over the full tree with a central-config-only allowlist; fork-safe (on: pull_request, persist-credentials:false, same-repo-only failure comment); Bullfrog egress-audit step per org convention. Replaces the stalled per-repo-caller approach (only vyos-1x had a caller).
Phase 2.2 + 2.3 DONE — ruleset live in EVALUATE (non-blocking): created org ruleset require-typos-pilot-2026-06-18 (id 17912054) requiring the Typos workflow on vyos-1x / vyos-build / vyatta-cfg-system / vyconf × rolling / circinus / sagitta. bypass_actors = OrganizationAdmin + Mergify + vyos-bot. Injection verified end-to-end via a throwaway vyconf PR (https://github.com/vyos/vyconf/pull/58 , closed): the Typos check injected + ran (typos . --config .github-central/_typos.toml), caught a deliberate typo, posted the failure comment, stayed non-blocking.
Pending (soaking): the full-tree scan surfaces each pilot repo's pre-existing real typos (e.g. vyconf: Uncommited / meaninful / UNCOMMITED) — fix-in-repo or allowlist per repo to reach a clean baseline, then flip the ruleset evaluate → active (separate gated step), remove the legacy vyos-1x caller, and retire the old workflow_call reusable + scripts. Rollback = delete ruleset 17912054 (pre-state backed up).
Tracking: IS-555.
Typos-check pilot COMPLETE — 2026-06-29.
Typos checking is now enforced via the vyos-org repository ruleset require-typos-pilot-2026-06-18 (enforcement active) — the standalone typos.yml (full-tree scan, central _typos.toml allowlist) is injected as a required check, with no per-repo caller files. Pilot scope: vyos-1x, vyos-build, vyatta-cfg-system, vyconf; branches rolling (+ circinus/sagitta where they exist).
Delivery summary:
- Phase 0/1: typos.yml + central _typos.toml shipped via vyos/.github#150.
- Config allowlists/excludes: vyos/.github#152 (changelog/generated/smoketest/mibs excludes + protobuf/j2lint allowlist) + vyos/.github#153 (mke2fs, Maya "Mak", RFC "IDentifier", VPP "Forwrd" false positives).
- Baseline clean (rolling): vyos/vyos-1x#5298, vyos/vyos-build#1229, vyos/vyatta-cfg-system#245, vyos/vyconf#59. LTS backports merged on VyOS-Networks/vyos-1x (circinus #2326, sagitta #2327) + vyos-build (#819/#820).
- Activation (2.5): ruleset flipped evaluate→active (/destructive-op-check cleared).
- Legacy retirement (2.6/2.7): per-repo check-typos.yml caller removed on vyos/vyos-1x + VyOS-Networks/vyos-1x (rolling/circinus/sagitta); old workflow_call reusable + scripts/{check-typos.sh,process-typos.py} retired via vyos/.github#154.
Deferred (future, separate): fleet-wide expansion beyond the 4 pilot repos, repo-local _typos.toml override, dedicated VyOS-Networks-org enforcement. Resolving — pilot objective achieved.