ci: address shared Codex workflow feedback

[haasonsaas]

Summary

• make the label churn workflow template use portable grep instead of assuming rg exists on hosted runners
• avoid duplicate Ruby test discovery in the shared Codex rails check
• keep proto_consumer validation independent from depends_on shape errors

Feedback addressed

• Add reusable Codex workflow templates #25 Cursor thread on unavailable rg in codex-label-churn-audit
• ci: deepen shared GitHub Actions rails #21 Cursor thread on duplicate top-level Ruby test discovery
• docs: add .github maintainer README #23 Cursor thread on validate-services-catalog.rb skipping independent proto_consumer validation

The #21 "Ruby only executes first test file" and #14/#15 label delete-race threads are already fixed on current main; I will resolve those stale threads after this PR is available as the follow-up anchor.

Verification

• ruby -Itest test/validate_services_catalog_test.rb
• ruby -Itest -e 'ARGV.each { |path| require "./#{path}" }' test/**/*_test.rb
• actionlint .github/workflows/agent-authorship-label.yml .github/workflows/codex-rails-check.yml .github/workflow-templates/codex-label-churn-audit.yml
• git diff --check

[cursor]

PR Summary

^{Cursor Bugbot is generating a summary for commit 3b38b5c. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Ruby unless...else is a readability anti-pattern
  • Swapped the depends_on type check to an if with the branches reversed, preserving behavior while removing the unless...else anti-pattern.

Preview (ccb4d8398e)

diff --git a/.github/scripts/validate-services-catalog.rb b/.github/scripts/validate-services-catalog.rb
--- a/.github/scripts/validate-services-catalog.rb
+++ b/.github/scripts/validate-services-catalog.rb
@@ -69,17 +69,16 @@
   end
 
   depends_on = service.fetch("depends_on", [])
-  unless depends_on.is_a?(Array)
+  if depends_on.is_a?(Array)
+    depends_on.each do |dependency|
+      unless services.key?(dependency)
+        error(errors, name, "depends_on references unknown service #{dependency.inspect}")
+      end
+    end
+  else
     error(errors, name, "depends_on must be a list when present")
-    next
   end
 
-  depends_on.each do |dependency|
-    unless services.key?(dependency)
-      error(errors, name, "depends_on references unknown service #{dependency.inspect}")
-    end
-  end
-
   next unless service.key?("proto_consumer")
 
   proto_consumer = service["proto_consumer"]

diff --git a/.github/workflow-templates/codex-label-churn-audit.yml b/.github/workflow-templates/codex-label-churn-audit.yml
--- a/.github/workflow-templates/codex-label-churn-audit.yml
+++ b/.github/workflow-templates/codex-label-churn-audit.yml
@@ -33,7 +33,16 @@
             gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/events" --paginate
             echo
             echo "# Workflows that mention labels"
-            rg -n "add-label|remove-label|gh pr edit|issues.addLabels|issues.removeLabel|labels" .github/workflows scripts || true
+            search_paths=()
+            for path in .github/workflows scripts; do
+              if [ -e "${path}" ]; then
+                search_paths+=("${path}")
+              fi
+            done
+
+            if [ "${#search_paths[@]}" -gt 0 ]; then
+              grep -RInE "add-label|remove-label|gh pr edit|issues.addLabels|issues.removeLabel|labels" "${search_paths[@]}" || true
+            fi
           } > codex-label-churn-evidence.md
 
       - name: Run Codex label audit

diff --git a/.github/workflows/codex-rails-check.yml b/.github/workflows/codex-rails-check.yml
--- a/.github/workflows/codex-rails-check.yml
+++ b/.github/workflows/codex-rails-check.yml
@@ -176,7 +176,7 @@
         run: |
           set -euo pipefail
           shopt -s globstar nullglob
-          tests=(test/**/*_test.rb test/*_test.rb)
+          tests=(test/**/*_test.rb)
           if [ "${#tests[@]}" -eq 0 ]; then
             echo "No Ruby tests found."
             exit 0

diff --git a/test/validate_services_catalog_test.rb b/test/validate_services_catalog_test.rb
--- a/test/validate_services_catalog_test.rb
+++ b/test/validate_services_catalog_test.rb
@@ -48,6 +48,18 @@
     assert_match(/identity: runtime must be one of gke, none, standalone/, stderr)
   end
 
+  def test_proto_consumer_is_validated_even_when_depends_on_type_is_invalid
+    catalog = minimal_catalog
+    catalog["services"]["identity"]["depends_on"] = "proto"
+    catalog["services"]["identity"]["proto_consumer"] = "yes"
+
+    stdout, stderr, status = run_validator(catalog)
+
+    refute status.success?, stdout
+    assert_match(/identity: depends_on must be a list when present/, stderr)
+    assert_match(/identity: proto_consumer must be true or false when present/, stderr)
+  end
+
   private
 
   def run_validator(catalog)

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 3b38b5c. Configure here.}

[cursor]

Ruby unless...else is a readability anti-pattern

Low Severity

The unless...else construct at the depends_on type check is a universally discouraged Ruby anti-pattern (flagged by RuboCop's Style/UnlessElse rule). It forces the reader to mentally double-negate: "unless it's an array → error; else → iterate." Flipping to if depends_on.is_a?(Array) with the branches swapped is clearer and idiomatic.

 

^{Reviewed by Cursor Bugbot for commit 3b38b5c. Configure here.}