Enforce canonical GitHub megarepo sources#665
Merged
schickling-assistant merged 1 commit intoMay 20, 2026
Conversation
Devenv Performance
Chart: performance change versus baseline median. Green is faster, red is slower, gray is within noise or baseline range.
All measurements
Previous runs
|
schickling-assistant
force-pushed
the
schickling/2026-05-19-github-source-policy
branch
from
18cdefa to
5e83f92
Compare
Collaborator
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5e83f92a46
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
schickling-assistant
force-pushed
the
schickling/2026-05-19-github-source-policy
branch
from
5e83f92 to
8560fd5
Compare
schickling-assistant
deleted the
schickling/2026-05-19-github-source-policy
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Megarepo lock sync normalizes GitHub inputs to the
github:scheme, but repositories can still declare equivalent GitHub sources through SSH or git URLs. That lets source files and lock files drift into different auth/source shapes.Goal
Add a reusable check that flags non-canonical GitHub member sources and incomplete GitHub lock metadata before lock sync drift reaches downstream repos.
Decisions
@overeng/megarepoinstead of a repo-local CI script, so all consumers can share the same rule.mr check [--all] [--json], not a policy-specificmr config ...command, so the CLI can grow structurally without adding one-off top-level concepts.dirin canonical suggestions, while droppingref/revfrom the query and representing refs in the canonicalgithub:owner/repo[/ref]shape.rev,narHash,lastModified) for matched megarepo inputs so incomplete normalized locks are caught.Verification
CI=1 ./node_modules/.bin/vitest run src/lib/source-policy.unit.test.ts(4 tests, includingdirquery-param preservation)devenv tasks run ts:checkdevenv tasks run lint:check:oxlintdevenv tasks run lint:check:formatdevenv shell -- env DT_PASSTHROUGH=1 mr check --all --jsonreturned zero violations.devenv shell -- env DT_PASSTHROUGH=1 mr config --help | rg "check-source-policy"returned no matches.devenv tasks run mr:source-policy-check --mode before --no-tuiCI=1 devenv tasks run check:all(passed after rerunning a transienttest:megarepotimeout;CI=1 devenv tasks run test:megarepopassed independently)Complexity
Adds one policy module and a generic CLI entrypoint. The CLI surface stays small because future structural checks can compose under
mr checkinstead of introducing separate commands.Concerns
This check enforces source shape only. Private GitHub auth still must be provided to Nix explicitly through
access-tokensinNIX_CONFIG;GH_TOKEN/GITHUB_TOKENalone are not sufficient for Nixgithub:fetches.Friction & bottlenecks
Running multiple devenv commands concurrently briefly hit a local GC-root cleanup race. Sequential reruns succeeded.
Follow-ups
Downstream repos should adopt this helper version and switch private GitHub flake inputs to canonical
github:sources with explicit Nixaccess-tokensin CI/root flows.References
Refs the megarepo source/lock alignment work.
Posted on behalf of @schickling
agent_nameagent_session_idagent_toolagent_tool_versionagent_runtimeagent_modelworktreemachinetooling_profile