From 5672db406f011844a36b1e5b23501087f80923a9 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Mon, 2 Nov 2026 20:39:05 -0500 Subject: [PATCH 1/2] ci(review): count the legacy FAILs file as read through generated-data verify-legacy-fails.json is 184 KB of generated verdict records the review lanes can never read whole, so every review of a change to it ends partial. List it in scripts/review-generated-data.txt and pass that list to both hosted review lanes through ci-workflows' generated-data input, read at the merge base. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VcupomBPg7kuobwLoNpxEW --- .github/workflows/pr-review-hosted.yml | 2 ++ .github/workflows/pr-review-security-hosted.yml | 2 ++ scripts/review-generated-data.txt | 5 +++++ 3 files changed, 9 insertions(+) create mode 100644 scripts/review-generated-data.txt diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml index eb060a54c05..d99b8b55104 100644 --- a/.github/workflows/pr-review-hosted.yml +++ b/.github/workflows/pr-review-hosted.yml @@ -242,6 +242,8 @@ jobs: # Copies scripts/sync-shared-copies.sh generates, read at the merge base: # identical changes to copies of one source are read once, hooks included. generated-copies: scripts/shared-copies.txt + # Generated data files counted as read, read at the merge base. + generated-data: scripts/review-generated-data.txt # A hold adds this label and a `claude-lane-hold` marker comment; ci-status # fails while the label is on. The review holds only for a real-charge # cost or a CRITICAL security finding; hold-paths names the files the diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml index d7e3d7a07c2..59db8b786ee 100644 --- a/.github/workflows/pr-review-security-hosted.yml +++ b/.github/workflows/pr-review-security-hosted.yml @@ -242,6 +242,8 @@ jobs: # Copies scripts/sync-shared-copies.sh generates, read at the merge base: # identical changes to copies of one source are read once, hooks included. generated-copies: scripts/shared-copies.txt + # Generated data files counted as read, read at the merge base. + generated-data: scripts/review-generated-data.txt # A hold adds this label and a `claude-lane-hold` marker comment; ci-status # fails while the label is on. The review holds only for a real-charge # cost or a CRITICAL security finding; hold-paths names the files the diff --git a/scripts/review-generated-data.txt b/scripts/review-generated-data.txt new file mode 100644 index 00000000000..ef099b1912f --- /dev/null +++ b/scripts/review-generated-data.txt @@ -0,0 +1,5 @@ +# Generated data files the review lanes count as read without reading them, +# read at the merge base (ci-workflows pr-review-cli.yml `generated-data`). +# One repo-relative path per line. Each is built by a script and checked by its +# own loader, and gitleaks still scans it. +plugins/source-control/skills/babysit-prs/scripts/verify-legacy-fails.json From d2b3ecedfb3174f50221c54d2872f2429173d625 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Mon, 2 Nov 2026 21:12:16 -0500 Subject: [PATCH 2/2] docs(review): a generated-data entry stays listed only while its file is added The legacy FAILs file's loader checks structure, not content, so the header no longer promises content checks, and states that an entry is removed once the commit adding its file is on main, so later edits are reviewed in full. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VcupomBPg7kuobwLoNpxEW --- scripts/review-generated-data.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/review-generated-data.txt b/scripts/review-generated-data.txt index ef099b1912f..c675feb2fd3 100644 --- a/scripts/review-generated-data.txt +++ b/scripts/review-generated-data.txt @@ -1,5 +1,7 @@ # Generated data files the review lanes count as read without reading them, # read at the merge base (ci-workflows pr-review-cli.yml `generated-data`). -# One repo-relative path per line. Each is built by a script and checked by its -# own loader, and gitleaks still scans it. +# One repo-relative path per line. A listed file's loader checks its structure +# only, never its content, so a path stays listed only while the one commit that +# adds the file lands, and is removed once that commit is on main; later edits +# are then reviewed in full. plugins/source-control/skills/babysit-prs/scripts/verify-legacy-fails.json