The shell translator rewrites test bodies and loses Bats reporting.
The unit lane needs complete TAP results and JUnit reports without
changing how live-cluster suites run.
Sourced production helpers still need a dash pass, and unit test bodies
need nounset without exporting shell options into subprocesses.
Assisted-by: LLM
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
CODEOWNERS applies only the last matching pattern and it replaces every
broader rule including the catch-all, it does not merge them. Half of
what that costs is already fixed: bd7b76691 added the architects to the
rules that were missing them, and hack/codeowners-invariant.bats keeps
them there. That invariant reads "every rule with owners is a superset
of the catch-all owners", and a rule naming nothing but the architects
satisfies it perfectly while gating on two people. Eleven rules on main
have that shape, 182 files between them.
The catch-all is those same two handles, so the invariant makes them
the floor for the whole repository and every path without a rule of its
own sits on that floor. Raising the floor means raising the catch-all,
after which the invariant carries the new set into every rule by
itself. Hence the shape here: the catch-all goes from two owners to
five, and all fifty rules carry those five.
This widens who may approve, not who may change code. Write access is
unchanged for all twelve collaborators, owner approval is OR and always
was, and the required checks that actually hold these paths are
untouched, api-review-gate.yaml included, so a sizeable API change
still needs an approval from one of its own two owners.
Three of the nine maintainers in MAINTAINERS.md own no path, for two
different reasons. c13c6ee2c gave kingdonb the two FluxCD tenant addon
packages and 7cca3d75e deleted them along with the addon, so his rules
went with the packages while the flux paths that stayed were never
handed to him. matthieu-robin and mattia-eleuteri were never in the
file at all. CONTRIBUTOR_LADDER.md says a maintainer may approve
changes to any area of the project.
Rules now group by area rather than by package, every rule names at
least five owners, and an area whose owner set does not differ from its
tier is left to the tier rule. Reviewers keep the areas MAINTAINERS.md
records for them, so that file needs no change.
The two-owner rule on /cmd/api-gate/, /internal/apigate/ and the
api-review-gate workflow goes with the rest. Those paths still require
an owner review, now under the Go source and CI rules.
The invariant test's exemption for a rule owned by exactly tym83 and
kvaps is dead code once the governance block is gone, and dead code in
that position is a hole: any future two-owner rule matching that set
would be waived. Dropping it puts such a rule back under the invariant,
where it belongs.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-by: LLM
CODEOWNERS is last-match-wins, so a new scoped rule that omits the
default owners silently strips their ownership for that path. Add a
hack/*.bats unit test (auto-discovered by make bats-unit-tests) that
requires every rule listing owners to repeat the owners of the *
catch-all, exempting ownerless rules and the governance roster.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Myasnikov Daniil