Skip to content

Keep audit-only Agent Law provisioner runs green #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
simongonzalezdc merged 1 commit into from
May 21, 2026
Merged

Keep audit-only Agent Law provisioner runs green #48

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions scripts/provision-agent-law.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,8 @@ def ensure_org_ruleset(owner: str, *, apply: bool) -> str:
return "skipped:not-org"
listed = gh_api(f"/orgs/{owner}/rulesets", check=False)
if listed.returncode != 0:
if not apply:
return "skipped:admin-org-scope-required"
Comment on lines +166 to +167
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Only skip dry-run when permission failure is confirmed

In scripts/provision-agent-law.py (checked alongside .github/workflows/agent-law-provisioner.yml), this dry-run branch now converts any gh api failure into skipped:admin-org-scope-required; because main() only exits non-zero for blocked:* statuses, transient API/network/auth failures in scheduled audits will be silently reported as success instead of surfacing a broken audit. This should only downgrade known permission-denied cases (and keep other non-zero outcomes blocked), and the same broad downgrade pattern appears in ensure_repo_ruleset as well.

Useful? React with 👍 / 👎.

return "blocked:admin-org-scope-required"
for item in json.loads(listed.stdout or "[]"):
if item.get("name") == RULESET_NAME:
Expand All @@ -176,6 +178,8 @@ def ensure_org_ruleset(owner: str, *, apply: bool) -> str:
def ensure_repo_ruleset(repo: Repo, *, apply: bool) -> str:
listed = gh_api(f"/repos/{repo.name_with_owner}/rulesets", check=False)
if listed.returncode != 0:
if not apply:
return "skipped:repo-admin-required"
return "blocked:repo-admin-required"
for item in json.loads(listed.stdout or "[]"):
if item.get("name") == RULESET_NAME:
Expand Down
Loading