Repository navigation
Run the ruleset drift check on a schedule #166
Description
scripts/apply-rulesets.ts --check (just rulesets-plan --check) exits 1 when a repo's branch rulesets differ from rulesets/index.ts, but no workflow runs it, so drift is only found when someone runs the plan by hand.
Proposal
- A scheduled workflow (weekly, plus
workflow_dispatch) that runsbun scripts/apply-rulesets.ts --checkand writes the plan to the job summary. - Auth: the script uses
gh, which needs to read rulesets on every managed repo. Use a GitHub App installation token (actions/create-github-app-token) scoped toadministration: readon the managed repos, not a PAT. Check whether the existing release-bot App can carry that permission or whether a separate read-only App is cleaner. - Read-only: never
--applyor--prunefrom CI. - Also run it on PRs that touch
rulesets/**, so a config change shows its plan before merge.
Done when
- A hand edit to a managed repo's ruleset turns the scheduled run red within a week, with the diff in the summary.
Activity
ci: use a dedicated read-only drifter App for the ruleset check
ci: run the ruleset drift check on a schedule (#231)
taraxvoid commentedon Oct 26, 2026
Status: #231 added rulesets-drift.yml, and #238 removed it again, because it ran --check against the built-in fleet that #238 deleted. The drift check now belongs in taraxvoid/infra (and ravenflight/infra), running against their own rulesets.ts. taraxvoid/infra has no workflows yet. It is waiting on #240 being released, so infra can run bunx @taraxvoid/voidflow@ rulesets plan --config rulesets.ts --check instead of using a checkout. Auth stays the same: an App token with administration: read.