Skip to content

ci: unbreak Charter governance workflow#36

Merged
stackbilt-admin merged 1 commit intomainfrom
ci/unbreak-charter
Apr 23, 2026
Merged

ci: unbreak Charter governance workflow#36
stackbilt-admin merged 1 commit intomainfrom
ci/unbreak-charter

Conversation

@stackbilt-admin
Copy link
Copy Markdown
Member

Summary

Charter CI has failed on every PR since 65780bd (7/7 red). Fixes the three compounding root causes so the check actually gates what it claims to gate. Closes #31.

Root causes

  1. Install ENOENT — workflow ran `npm ci` at repo root, no `package.json` existed there, just a 5-line stub lockfile
  2. `@stackbilt/cli@0.10.0` unpublishable — npm tarball carries `workspace:^` protocol deps that can't resolve outside the Charter monorepo. Pin to `^0.9.2`.
  3. Policy gates tripped on clean checkouts — `validate` required trailers the repo has never authored; `doctor` flagged a missing `advisory-board.adf` (Stackbilt-specific, doesn't belong in OSS)

Changes

  • New root `package.json` scoped to governance tooling (private, sole devDep `@stackbilt/cli@^0.9.2`)
  • Proper root `package-lock.json`
  • `.charter/config.json`: `requireTrailers: true` → `false`
  • `.ai/manifest.adf`: remove `advisory-board.adf` reference

Verified locally

All 5 Charter steps exit 0 against this branch: `validate=0 drift=0 doctor=0 adf-evidence=0 audit=0`.

Test plan

Follow-ups

  • File charter-repo bug for 0.10.0 workspace protocol publish failure
  • Re-author trailer convention + re-enable strict mode once ecosystem adopts it

Charter CI has been failing on every PR since the workflow was added in
65780bd (7/7 runs red). This fixes the three compounding root causes so
the check actually gates what it claims to gate.

## Problems

1. **Install step failed with ENOENT.** Workflow ran `npm ci` at repo root,
   but the repo only had a 5-line stub `package-lock.json` and no
   `package.json`. The application lives in `web/`; the root install was
   never wired for Charter's governance CLI.

2. **`@stackbilt/cli@0.10.0` is unpublishable.** Its npm tarball carries
   `workspace:^` protocol deps that can't be resolved outside the Charter
   monorepo. Pin to `^0.9.2` until upstream publishes a clean 0.10.x.

3. **Policy gates failed on clean checkouts.**
   - `validate` (exit 1): `requireTrailers: true` + `trailerThreshold:
     HIGH` + no trailer convention in this repo's history = every PR red.
     Dependabot PRs (#22) cannot possibly author trailers. Softened to
     `requireTrailers: false` — charter still surfaces suggestions, but
     doesn't block. Re-enable once the repo adopts a trailer convention.
   - `doctor --adf-only` (exit 1): `.ai/manifest.adf` referenced
     `advisory-board.adf` (Atlas/Mercer/Sloan advisor modules), which
     belongs in the daemon, not the OSS core. Removed the reference.

## Fixes

- Add root `package.json` scoped to governance tooling (private, name
  `aegis-oss-governance`, sole devDep `@stackbilt/cli@^0.9.2`)
- Generate proper `package-lock.json` so `npm ci` works in CI
- Relax `.charter/config.json` trailer gate to non-blocking
- Remove `advisory-board.adf` (Stackbilt-specific) from ADF manifest

## Verified locally

All 5 Charter steps exit 0 against this branch:

  validate=0 drift=0 doctor=0 adf-evidence=0 audit=0

## Follow-ups

- Unblock PR #22 (8 dependabot advisories) via rebase once this lands
- Unblock PR #27 (cost_health regression, #26) via rebase once this lands
- File charter-repo bug for `@stackbilt/cli@0.10.0` workspace protocol
  publish failure
- Consider re-authoring a trailer convention and re-enabling strict mode
  once this repo + daemon both adopt it

Refs: #31, #22, #27
@stackbilt-admin stackbilt-admin merged commit 3090acd into main Apr 23, 2026
2 checks passed
@stackbilt-admin stackbilt-admin deleted the ci/unbreak-charter branch April 23, 2026 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci: Charter check failing at 'Install dependencies' — blocks PRs #22 + #27 cost_health field regression: missing from /health endpoint response

1 participant