Repository navigation
#632 added four Python files; the language policy check is red on main and every PR #650
Description
What
governance / Language / package anti-pattern policy fails on main and on every PR since #632 (2026-10-31, "ci: migrate fleet secret scanner to bounded suite"). That PR added four Python files, and Python is fully banned in the estate:
| File | Lines | Run by |
|---|---|---|
scripts/audit-lock-regeneration.py |
119 | — |
scripts/audit-workflow-lock-map.py |
185 | e2e.yml |
tests/lock-regeneration-test.py |
125 | e2e.yml |
tests/workflow-lock-map-test.py |
219 | e2e.yml |
Options
- Port to Rust (recommended). These parse workflow YAML and
actions.lock, which is structured parsing. A small Rust binary (serde_yaml + serde_json) is the dependable route, and it can live next to the existing lock tooling. - Port to bash +
yq/jq. Fitsscripts/check-lock-sync.sh, but YAML parsing in shell is fragile for the map/closure logic. - Exempt them via
.hypatia-ignore(cicd_rules/banned_language_file:…). This is contrary to the "no exceptions" Python rule, so it's not recommended.
Whichever option is chosen, keep the existing test cases as the conformance suite for the port, and remove the .py files in the same PR that wires in the replacement.
Activity