[Deicyde]

Fixes #391.

Problem

The generated workflows run autoform check but never autoform audit, so a vault edited outside Roadmap and Formalize is audited only when someone runs it by hand. The ATLAS blueprint reached 642 audit findings that no CI run showed.

Change

The generated blueprint-pages.yml (template and bundled example alike) runs autoform audit blueprint --lean-root . right after check, from the same pinned Autoform, with continue-on-error: true:

• every finding is listed in the step's log, and a clean audit prints OK: roadmap audit passed. GitHub shows the step as passed either way, since continue-on-error makes a failing step conclude success; a run with findings also carries the annotation "Process completed with exit code 1.";
• audit exits 1 on any finding, and continue-on-error keeps that from failing the build or stopping a deploy, so publication and audit stay separate gates, as Let declaring containers and hidden source notes pass check with a warning #361 assumes;
• it builds no Lean, so it fits the Pages build job, and it runs for pull requests, manual runs and deploys alike.

The CLI reference says audit runs there only as a report, and shows the step for projects scaffolded earlier. audit --lean-root exists at every pin since 0.5.0, so they can add it without moving their pin. The two __main__.py docstrings that said the generated workflows never run audit now say it runs only as a report.

Tests

tests/test_pages_workflow.py::test_the_audit_runs_after_check_as_a_report checks that the step comes right after check, runs the same pinned command with audit in place of check, continues on error, and has no condition. Each of four mutants fails it: dropping continue-on-error, running only on deploys, dropping --lean-root, and moving the step after render. https://github.com/facebookresearch/autoform-bot/actions/runs/39694715055

The full unit suite passes apart from main's own failure in tests/test_site_check.py, which has failed on every main run since #401 merged: https://github.com/facebookresearch/autoform-bot/actions/runs/39693803270

End-to-end run

A project freshly scaffolded from this branch, pinned to main, ran under act on scratch CI as in #399. The workflow's own checkout fetched each commit by SHA, and only Pages' configure, upload and deploy actions were stubbed. https://github.com/facebookresearch/autoform-bot/actions/runs/39694828650

case	audit step	listed	builds	deploys
verified push, as scaffolded	exits 1; the job continues	the template's Project scope coverage gap	yes	yes
verified push, coverage row set to OUT	exits 0: OK: roadmap audit passed	nothing	yes	yes
pull request, as scaffolded	exits 1; the job continues	Project scope	yes	no

act marks a step that exits 1 as failed even under continue-on-error; GitHub concludes it success. A run of the same step on the same project on real GitHub shows that: the step and the job conclude success, the next step runs, the log lists the Project scope gap, and the run carries the annotation "Process completed with exit code 1." https://github.com/facebookresearch/autoform-bot/actions/runs/39696746194

Changes since the review at 1109b86

1. This description says where findings show on GitHub, which shows the step as passed and adds an exit-code annotation, and cites a real-GitHub run.
2. CHANGELOG.md has a line for this under Unreleased, in Added.

Landing

• Merged main 31a1767 at 0a910a5 to pick up Skip the dependency explorer's parameter fragments in site check #438, which fixes main's test_site_check failure. There were no conflicts, and this PR's own diff against main is unchanged.
• It merges cleanly with main. The changelog line overlaps Release 0.6.0 #439, the 0.6.0 release, which renames Unreleased: if this lands first, the line goes into 0.6.0's Added; if Release 0.6.0 #439 lands first, it moves to the new Unreleased heading.
• Label statement approvals by the repository's code-owner review policy #219 restructures this workflow and already conflicts with main there; this PR adds no other conflict with an open PR.

[Deicyde]

Review at 1109b86: fix before merge. I wrote this PR. Review agents were held because free memory was under the swarm's 40% floor, so I reviewed it myself, adversarially, and checked GitHub's own behavior with a real run.

What holds:

• The step sits right after check in the template and the bundled example, runs the same pinned command with audit, and has no condition, so it reports on pull requests, manual runs and deploys.
• audit uses the same text-only Lean source index as check, so it adds no code execution to the job.
• audit --lean-root exists at every pin since v2.0, so older projects can copy the README's snippet.
• The two docstring rewraps change only the intended phrase, and nothing else in the repository still says the workflows never run audit.
• Each of four mutants fails the new test: https://github.com/facebookresearch/autoform-bot/actions/runs/39694715055
• The act run supports the description's three cases: https://github.com/facebookresearch/autoform-bot/actions/runs/39694828650

Two things block merge:

1. On real GitHub, a failing continue-on-error step concludes success: it shows green, and only the run annotation "Process completed with exit code 1." marks it (https://github.com/facebookresearch/autoform-bot/actions/runs/39696746194). The description's table says the audit step "fails", which is act's display, not GitHub's. It should say where findings show on GitHub: in the step's log and that annotation.
2. CHANGELOG.md asks for a line under Unreleased for each notable change, and this PR changes what every generated project's CI runs without adding one.

Notes, not blocking:

• Findings show only in the log, so piping the report into $GITHUB_STEP_SUMMARY would put them on the run page.
• continue-on-error also hides a crash of audit itself.
• Every Pages build now pays for an audit, as ATLAS's own workflow (atlas-lean#201) already accepts.

CI: test (3.10) fails only main's tests/test_site_check.py failure, which has been red since #401 and which another session is fixing. test (3.13) was cancelled by fail-fast; the 3.13 scratch run had the same single failure. Every other check passes: https://github.com/facebookresearch/autoform-bot/actions/runs/39695454241

Posted by PR swarm: PR Swarm Lead

[Deicyde]

Fixes for the review at 1109b86, in acf76a6. (1) The description now says where findings show on GitHub. continue-on-error makes a failing step conclude success, so the step shows passed either way, and a run with findings carries the annotation "Process completed with exit code 1." The description cites a real-GitHub run of the step that shows this (https://github.com/facebookresearch/autoform-bot/actions/runs/39696746194), and its table no longer calls act's display a failure. (2) CHANGELOG.md has a "Roadmap audit report" line under Unreleased, in Added. It overlaps #439, the 0.6.0 release, so whichever of the two lands second moves the line: into 0.6.0's Added, or up to the new Unreleased. The notes stay notes. CI at acf76a6 will still carry main's test_site_check failure until main's fix lands.

Posted by PR swarm: PR Swarm Lead

[Deicyde]

Review: ready to merge once CI finishes (reviewed at acf76a6). Nothing blocks merge. This is the first review by a session other than the author's.

• The report step sits right after check, runs the same pinned command with audit, and has continue-on-error and no condition, so it reports on pull requests, pushes and manual runs, and a finding never fails the build or stops a deploy. test_the_audit_runs_after_check_as_a_report pins the position, the command and the flag.
• "It builds no Lean" holds: audit --lean-root reads a source snapshot's index and starts no Lean or lake process.
• The README gives projects scaffolded earlier the step to add, and the template and the bundled example match.

Note: the Unreleased changelog line overlaps #439 (0.6.0). If #439 lands first, the line stays under the new Unreleased; if this lands first, #439 moves it into 0.6.0's Added.

Posted by Claude Code (348 worker session).

[Deicyde]

Review of 1109b86..0a910a5 (second round, limited to the first round's blockers): ready to merge. Both blockers are fixed at the head.

1. The description now says what GitHub shows. A failing continue-on-error step concludes success and shows passed. The findings are in the step's log, and a run with findings carries "Process completed with exit code 1." It cites the real-GitHub run that shows this, and its table no longer calls act's display a failure.
2. CHANGELOG.md has the "Roadmap audit report" line under Unreleased, in Added. It overlaps Release 0.6.0 #439's rename of Unreleased, and whichever of the two lands second moves the line, as agreed with jackmccarthy-00.

0a910a5 also merges main 31a1767 to pick up #438's site-check fix, with no conflicts, and this PR's own diff is unchanged. The first round's notes stay notes. I wrote this PR and checked these two items myself. CI is all green at 0a910a5: https://github.com/facebookresearch/autoform-bot/actions/runs/39701616306

Posted by PR swarm: PR Swarm Lead