Workflow branch-role audit
The durable, freshness-checked classification of every git-branch and tag reference in
.github/workflows/*.yml, folded against the branch-role contract in dos.toml [branch_roles].
It is the checkable map for the dev/main front-door migration (#1697/#1701): development gates,
release/front-door gates, tag-driven release, and intentional legacy arms are each labeled, and a
newly-introduced unclassified development-path reference reds the trunk.
Regenerating and gating this audit
Generated by internal/workflowaudit; regenerate with fak workflow-audit --write-doc and gate it
with --check-doc. The block between the markers is generated – do not hand-edit it.
Verdict: ALL CLASSIFIED – 89 reference(s) across 47 workflow file(s); roles: development=main release=main source=main front-door=main
Generated from .github/workflows/*.yml and classified by internal/workflowaudit against the branch-role contract in dos.toml [branch_roles] (read via internal/branchrole) – not hand-typed. Every branch and tag reference in every workflow is folded onto one closed class so the dev/main front-door migration (#1697/#1701) has a checkable map of what each branch filter is FOR. The distribution is WITNESSED from the tree, never self-reported. A development-path reference that names no configured role and is not an intentional allowlisted legacy/compat arm renders as unclassified – and reds go test ./internal/workflowaudit (the regression gate). Regenerate with fak workflow-audit --write-doc.
| Class | Meaning | References |
|---|---|---|
| development | push/PR branch filter on a configured development branch | 15 |
| release-front-door | if-gate that runs a job only on the release / public front-door branch | 27 |
| tag | tags: filter – the tag-driven release surface | 3 |
| legacy | intentional compat / hidden-baseline reference (allowlisted) | 44 |
| unclassified | development-path ref matching no role and not allowlisted – gate fails | 0 |
| Workflow | Line | Kind | Ref | Class |
|---|---|---|---|---|
| backlog-feed.yml | 53 | ref-name-gate | main |
release-front-door |
| backlog-feed.yml | 53 | ref-name-gate | master |
legacy |
| bench-feed.yml | 58 | ref-name-gate | main |
release-front-door |
| bench-feed.yml | 58 | ref-name-gate | master |
legacy |
| bench-signal.yml | 52 | ref-name-gate | main |
release-front-door |
| bench-signal.yml | 52 | ref-name-gate | master |
legacy |
| bench.yml | 26 | branches-filter | main |
development |
| bench.yml | 26 | branches-filter | master |
legacy |
| bench.yml | 26 | branches-filter | fak-v0.1 |
legacy |
| bench.yml | 80 | hidden-shell-ref | main |
legacy |
| bench.yml | 150 | ref-heads-gate | main |
release-front-door |
| bench.yml | 151 | ref-heads-gate | master |
legacy |
| bench.yml | 152 | ref-heads-gate | fak-v0.1 |
legacy |
| blockers-feed.yml | 58 | ref-name-gate | main |
release-front-door |
| blockers-feed.yml | 58 | ref-name-gate | master |
legacy |
| cachevalue-feed.yml | 43 | ref-name-gate | main |
release-front-door |
| cachevalue-feed.yml | 43 | ref-name-gate | master |
legacy |
| cachevalue-gate.yml | 48 | ref-name-gate | main |
release-front-door |
| cachevalue-weekly.yml | 40 | ref-name-gate | main |
release-front-door |
| cachevalue-weekly.yml | 40 | ref-name-gate | master |
legacy |
| cadence.yml | 56 | ref-name-gate | main |
release-front-door |
| cadence.yml | 56 | ref-name-gate | master |
legacy |
| capacity-feed.yml | 48 | ref-name-gate | main |
release-front-door |
| capacity-feed.yml | 48 | ref-name-gate | master |
legacy |
| ci-fast.yml | 19 | branches-filter | main |
development |
| ci-fast.yml | 19 | branches-filter | master |
legacy |
| ci-fast.yml | 19 | branches-filter | fak-v0.1 |
legacy |
| ci.yml | 10 | branches-filter | main |
development |
| ci.yml | 10 | branches-filter | master |
legacy |
| ci.yml | 10 | branches-filter | fak-v0.1 |
legacy |
| cross-platform.yml | 16 | branches-filter | main |
development |
| cross-platform.yml | 16 | branches-filter | master |
legacy |
| cross-platform.yml | 16 | branches-filter | fak-v0.1 |
legacy |
| dispatch-session-audit-feed.yml | 80 | ref-name-gate | main |
release-front-door |
| dispatch-session-audit-feed.yml | 80 | ref-name-gate | master |
legacy |
| dogfood-coverage.yml | 27 | branches-filter | main |
development |
| dogfood-coverage.yml | 27 | branches-filter | master |
legacy |
| dogfood.yml | 32 | branches-filter | main |
development |
| dogfood.yml | 32 | branches-filter | master |
legacy |
| dojo-feed.yml | 62 | ref-name-gate | main |
release-front-door |
| dojo-feed.yml | 62 | ref-name-gate | master |
legacy |
| dojo-rsi-feed.yml | 26 | ref-name-gate | main |
release-front-door |
| dojo-rsi-feed.yml | 26 | ref-name-gate | master |
legacy |
| dup-signal.yml | 32 | branches-filter | main |
development |
| dup-signal.yml | 32 | branches-filter | master |
legacy |
| dup-signal.yml | 45 | ref-name-gate | main |
release-front-door |
| dup-signal.yml | 45 | ref-name-gate | master |
legacy |
| fanout-cadence.yml | 54 | ref-name-gate | main |
release-front-door |
| fanout-cadence.yml | 54 | ref-name-gate | master |
legacy |
| garden.yml | 28 | branches-filter | main |
development |
| garden.yml | 28 | branches-filter | master |
legacy |
| gate-signal.yml | 47 | ref-name-gate | main |
release-front-door |
| gate-signal.yml | 47 | ref-name-gate | master |
legacy |
| issue-lane-router.yml | 69 | ref-name-gate | main |
release-front-door |
| issue-lane-router.yml | 69 | ref-name-gate | master |
legacy |
| negframe-ratchet.yml | 23 | branches-filter | main |
development |
| negframe-ratchet.yml | 23 | branches-filter | master |
legacy |
| negframe-ratchet.yml | 23 | branches-filter | fak-v0.1 |
legacy |
| node-usage-feed.yml | 52 | ref-name-gate | main |
release-front-door |
| node-usage-feed.yml | 52 | ref-name-gate | master |
legacy |
| product-feed.yml | 62 | ref-name-gate | main |
release-front-door |
| product-feed.yml | 62 | ref-name-gate | master |
legacy |
| propagation-feed.yml | 62 | ref-name-gate | main |
release-front-door |
| propagation-feed.yml | 62 | ref-name-gate | master |
legacy |
| release-artifacts.yml | 33 | tags-filter | v* |
tag |
| release-cadence.yml | 60 | ref-name-gate | main |
release-front-door |
| release-cadence.yml | 60 | ref-name-gate | master |
legacy |
| release-container.yml | 18 | tags-filter | v* |
tag |
| release-cuda-container.yml | 14 | tags-filter | v* |
tag |
| score-signal.yml | 59 | ref-name-gate | main |
release-front-door |
| score-signal.yml | 59 | ref-name-gate | master |
legacy |
| scoreboard-feed.yml | 60 | ref-name-gate | main |
release-front-door |
| scoreboard-feed.yml | 60 | ref-name-gate | master |
legacy |
| security-audit.yml | 26 | branches-filter | main |
development |
| security-audit.yml | 26 | branches-filter | master |
legacy |
| security-audit.yml | 26 | branches-filter | fak-v0.1 |
legacy |
| slack-beat.yml | 43 | ref-name-gate | main |
release-front-door |
| slack-beat.yml | 43 | ref-name-gate | master |
legacy |
| slack-watchdog.yml | 46 | ref-name-gate | main |
release-front-door |
| slack-watchdog.yml | 46 | ref-name-gate | master |
legacy |
| spine-invariance.yml | 9 | branches-filter | main |
development |
| spine-invariance.yml | 11 | branches-filter | main |
development |
| steering-guard.yml | 26 | branches-filter | main |
development |
| steering-guard.yml | 26 | branches-filter | master |
legacy |
| steering-guard.yml | 53 | ref-name-gate | main |
release-front-door |
| steering-guard.yml | 53 | ref-name-gate | master |
legacy |
| swallowed-error-floor.yml | 30 | branches-filter | main |
development |
| swallowed-error-floor.yml | 32 | branches-filter | main |
development |
| trajctl-signal.yml | 41 | ref-name-gate | main |
release-front-door |
Unclassified development-path references: none – every reference is a configured role, a tag, or an intentional allowlisted legacy arm.