potiuk opened a new pull request, #41:
URL: https://github.com/apache/airflow-steward/pull/41
## Summary
Follow-up to #40. Wire the drift-detection mechanism into every framework
skill's pre-flight, alongside the override-consultation hook from #39. Each of
the 15 framework skills (excluding `setup-steward`, the bootstrap + drift
mechanism itself) now carries a `## Snapshot drift` section right after its
existing `## Adopter overrides` section.
## Standard block inserted
```markdown
## Snapshot drift
Also at the top of every run, this skill compares the
gitignored `.apache-steward.local.lock` (per-machine
fetch) against the committed `.apache-steward.lock`
(the project pin). On mismatch the skill surfaces the
gap and proposes
[`/setup-steward upgrade`](../setup-steward/upgrade.md).
The proposal is non-blocking — the user may defer if
they want to run with the local snapshot for now. See
[`docs/setup/install-recipes.md` § Subsequent runs and drift
detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection)
for the full flow.
Drift severity:
- **method or URL differ** → ✗ full re-install needed.
- **ref differs** (project bumped tag, or `git-branch`
local is behind upstream tip) → ⚠ sync needed.
- **`svn-zip` SHA-512 mismatches the committed
anchor** → ✗ security-flagged; investigate before
upgrading.
```
The block is identical across all 15 skills (the link target is the same —
`setup-steward/upgrade.md` — for every skill).
## Skills updated (15)
| Setup family | Security family | PR-management family |
|---|---|---|
| `setup-isolated-setup-install` | `security-issue-import` |
`pr-management-code-review` |
| `setup-isolated-setup-update` | `security-issue-import-from-md` |
`pr-management-stats` |
| `setup-isolated-setup-verify` | `security-issue-import-from-pr` |
`pr-management-triage` |
| `setup-shared-config-sync` | `security-issue-invalidate` | |
| | `security-issue-sync` | |
| | `security-cve-allocate` | |
| | `security-issue-deduplicate` | |
| | `security-issue-fix` | |
**Not updated**: `setup-steward` — it IS the bootstrap + upgrade + verify +
override-management skill; the drift check it would perform is the same one its
`verify` sub-action already exposes.
## Test plan
- [x] All `prek run --all-files` hooks pass (markdownlint, typos, doctoc,
check-placeholders)
- [x] Every framework skill except `setup-steward` has the `## Snapshot
drift` section (visual grep — 15/15 covered)
- [x] Insertion point is consistent: directly after each skill's `## Adopter
overrides` block, before the next `##` heading (Golden rules / Inputs /
Prerequisites depending on the skill)
- [ ] CI link-check (lychee) passes
## Out of scope
- Mechanical enforcement of the drift check (currently a documented
convention, not a runtime injector). Future tooling — e.g. a sentinel
pre-flight pre-commit hook on framework skill files — can verify each skill
carries the section. Beyond this PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
