TirSystem/github-action
0
1
Fork 0
Code Issues 5 Pull Requests 1 Actions Packages Projects Releases 3 Wiki Activity

Review and accept ADR-0008

Browse Source
This commit is contained in:
Tirsvad
2026-10-11 12:43:40 +08:00
parent ac6925e21a
commit 9e7aeddb11
4 changed files with 71 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/adr-0008-cpp-csharp-quality-check-contract.md
+12 -5
View File
@@ -9,7 +9,8 @@
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-11 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [11cba35] |
| 2026-10-11 | Deprecated | Jens Tirsvad Nielsen | S01 | Initial version | [11cba35] |
| 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Reviewed (RC-054): abbreviations expanded at first use and the security impact of downloading tools named | pending |
Allowed Status values: `Proposed`, `Accepted`, `Rejected`, `Deprecated`, `Superseded by ADR-NNNN`.
@@ -30,12 +31,12 @@ on 2026-10-11 and bound the decision:
Facts (MIL-007 task 2, runs 692 and 699 on `ubuntu-latest`, Ubuntu 24.04,
root, `gcc`/`g++` 13.3 present):
- `clang-format` 23.1.3 and `clang-tidy` 22.1.8 install from PyPI in a few
seconds with an exact version.
- `clang-format` 23.1.3 and `clang-tidy` 22.1.8 install from the Python Package
Index (PyPI) in a few seconds with an exact version.
- `cppcheck` is only available as an old version (apt 2.13.0; the latest
release is 2.22.0; the PyPI package of that name is another project).
- The .NET SDK 10.0.401 installs with the official `dotnet-install.sh` in about
20 s with an exact `--version`; apt gives an older band (10.0.112).
- The .NET software development kit (SDK) 10.0.401 installs with the official
`dotnet-install.sh` in about 20 s with an exact `--version`; apt gives an older band (10.0.112).
- A `clang-tidy` run needs flags or a compile database, and a C# format check
and build need the project's package restore, which needs the network.
@@ -118,6 +119,12 @@ The rules that follow from it:
change and costs a major version (ADR-0006).
- A caller pinned to an exact tag is pinned completely only when `tools-ref`
names the same tag (as for `quality-checks.yml`).
- Security: each run downloads and executes code from outside the repository
(wheels from PyPI and the `dotnet-install.sh` script from `dot.net`, and for
C# the NuGet packages of the project). Exact versions limit what can change
but are not verified against a hash, so a compromised package index or
download host would reach the run. The jobs get `contents: read` and no
secret, which limits what such code can do.
## Affected Artifacts
docs/artifact-registry.md
+1 -1
View File
@@ -11,7 +11,7 @@ each document lives in *this* project and the next version to use.
| SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 |
| PP | Project Plan | docs/project-plan.md | 002 |
| MIL | Milestone / Gateway | docs/milestones/*.md | 008 |
| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 054 |
| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 055 |
| TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 |
| ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0009 |
| UCD | Use Case Diagram | docs/use-case-diagram.md | 002 |
docs/sqa/reviews/rc-054-adr-0008.md
+51
View File
@@ -0,0 +1,51 @@
# Review Record: ADR-0008
## Metadata
| Key | Value |
| --- | --- |
| ID | RC-054 |
| CrossReference | [ADR-0008], [QC-ADR-001] |
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | pending |
---
## Artifact Under Review
- Instance reviewed: [ADR-0008]
- Checklist used: [QC-ADR-001]
## Checklist Results
| # | Criterion | Status | Evidence/Notes |
| --- | --- | --- | --- |
| 1 | The ID (`ADR-NNNN`, 4-digit) matches the filename number and is unique and sequential | Pass | ADR-0008 in `adr-0008-cpp-csharp-quality-check-contract.md`, after ADR-0007. |
| 2 | Context states the problem, the forces (cost, risk, constraints) and the options evaluated | Pass | States the two requirements from S01, the facts from runs 692 and 699, and the options. |
| 3 | At least two options were considered, or the absence of alternatives is justified | Pass | Three options for the workflows, three for `cppcheck`, two for the SDK pin. |
| 4 | Decision is stated in one or two unhedged sentences and matches one of the evaluated options | Pass | One sentence naming option 2, dropping `cppcheck` (c) and an exact SDK version (b). |
| 5 | Consequences list both Positive and Negative outcomes | Pass | Three positive and six negative (after the fix of criterion 6). |
| 6 | Quality-attribute impacts (performance, security, portability, etc.) are named where the decision affects them | Pass | Finding fixed during this review: the security impact of downloading and running tools and packages in every run was not named (ADR-0005 names it for PyPI); it is now a negative consequence, with the limit that the jobs have `contents: read` and no secret. |
| 7 | Affected Artifacts are listed as links, and each is also in CrossReference | Pass | MIL-007, UC-005, US-001, ADR-0005 and ADR-0006 are linked and cited. |
| 8 | Status changes are recorded as new Version History rows with a Change summary and Commit link; retained rows are never rewritten | Pass | The Proposed row keeps its status as Deprecated and the Accepted row is added. |
| 9 | A superseded or deprecated ADR names its successor, and the successor links back | N-A | Nothing is superseded; ADR-0005 is extended and unchanged. |
| 10 | Written in business or technical language of the domain, with no unexplained abbreviations | Pass | Finding fixed during this review: PyPI and SDK were used without being expanded; both are introduced at first use. |
| 11 | Status is one of `Proposed`, `Accepted`, `Rejected`, `Deprecated` or `Superseded by ADR-NNNN`, and every Version History row uses only these | Pass | Deprecated and Accepted. |
## Overall Verdict
Go - all applicable criteria pass; the two findings (criteria 6 and 10) were fixed during the review. It unlocks tasks 4 and 5 of MIL-007 (#98 and #99) under the plan-first gate, once MIL-007 itself is Accepted again (its amendment after RC-052 is still Proposed). S01 gave the Go in chat on 2026-10-11, standing in for the other reviewers as ADR-0002 records; there is no independent reader.
## Action Items
| Action | Owner | Due |
| --- | --- | --- |
| Review and accept the amendment of MIL-007 (current tool versions, .NET SDK 10 or later, results of run 699) so that its latest row is Accepted | S01 | before #98 and #99 |
| Choose the exact default of `dotnet-sdk-version` (an `10.0.x` band) when the C# workflow is built, and check it is still the current stable release | S05 | task 5 |
---
[ADR-0008]: ../../adr/adr-0008-cpp-csharp-quality-check-contract.md
[QC-ADR-001]: ../../../framework/qc/qc-adr.md
docs/sqa/traceability-matrix.md
+7 -4
View File
@@ -4,13 +4,13 @@
| Key | Value |
| --- | --- |
| ID | TM-001 |
| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [MIL-006], [MIL-007], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [RC-015], [RC-016], [RC-017], [RC-018], [RC-019], [RC-020], [RC-021], [RC-022], [RC-023], [RC-024], [RC-025], [RC-026], [RC-027], [RC-028], [RC-029], [RC-030], [RC-031], [RC-032], [RC-033], [RC-034], [RC-035], [RC-036], [RC-037], [RC-038], [RC-039], [RC-040], [RC-041], [RC-042], [RC-043], [RC-044], [RC-045], [RC-046], [RC-047], [RC-048], [RC-049], [RC-050], [RC-051], [RC-052], [RC-053], [ADR-0007], [UC-007], [UC-006], [ADR-0006], [UC-005], [ADR-0005], [UCD-001], [US-001], [UC-001], [UC-002], [UC-003], [UC-004], [ADR-0001], [ADR-0002], [ADR-0003], [ADR-0004] |
| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [MIL-006], [MIL-007], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [RC-015], [RC-016], [RC-017], [RC-018], [RC-019], [RC-020], [RC-021], [RC-022], [RC-023], [RC-024], [RC-025], [RC-026], [RC-027], [RC-028], [RC-029], [RC-030], [RC-031], [RC-032], [RC-033], [RC-034], [RC-035], [RC-036], [RC-037], [RC-038], [RC-039], [RC-040], [RC-041], [RC-042], [RC-043], [RC-044], [RC-045], [RC-046], [RC-047], [RC-048], [RC-049], [RC-050], [RC-051], [RC-052], [RC-053], [RC-054], [ADR-0007], [ADR-0008], [UC-007], [UC-006], [ADR-0006], [UC-005], [ADR-0005], [UCD-001], [US-001], [UC-001], [UC-002], [UC-003], [UC-004], [ADR-0001], [ADR-0002], [ADR-0003], [ADR-0004] |
## Version History
| Date | Status | Author | Reviewer | Change | Commit |
| --- | --- | --- | --- | --- | --- |
| 2026-10-11 | Deprecated | Jens Tirsvad Nielsen | S01 | Added RC-051 (ADR-0005 tools-ref) | [670f0ac] |
| 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Added MIL-007, RC-052 and RC-053 | [e3ad1fa] |
| 2026-10-11 | Deprecated | Jens Tirsvad Nielsen | S01 | Added MIL-007, RC-052 and RC-053 | [e3ad1fa] |
| 2026-10-11 | Accepted | Jens Tirsvad Nielsen | S01 | Added ADR-0008 and RC-054 | pending |
---
@@ -67,6 +67,7 @@ updated whenever an artifact instance is created or reviewed.
| [UC-006] | UC | [UCD-001], [US-001], [SA-001] | [ADR-0006] | [RC-042] |
| [ADR-0006] | ADR | [MIL-004], [UC-006], [US-001], [ADR-0004], [ADR-0005] | - | [RC-043] |
| [ADR-0007] | ADR | [MIL-004], [UC-006], [ADR-0006] | - | [RC-047] |
| [ADR-0008] | ADR | [MIL-007], [UC-005], [US-001], [ADR-0005], [ADR-0006] | - | [RC-054] |
| [UC-007] | UC | [UCD-001], [US-001], [SA-001] | - | [RC-044] |
| [RC-019] | RC | [UCD-001] | - | - |
| [RC-020] | RC | [US-001] | - | - |
@@ -103,6 +104,7 @@ updated whenever an artifact instance is created or reviewed.
| [RC-051] | RC | [ADR-0005] | - | - |
| [RC-052] | RC | [MIL-007] | - | - |
| [RC-053] | RC | [PP-001] | - | - |
| [RC-054] | RC | [ADR-0008] | - | - |
## Coverage Notes
@@ -186,11 +188,12 @@ updated whenever an artifact instance is created or reviewed.
[RC-051]: ./reviews/rc-051-adr-0005-tools-ref.md
[RC-052]: ./reviews/rc-052-mil-007.md
[RC-053]: ./reviews/rc-053-pp-001-mil-007.md
[RC-054]: ./reviews/rc-054-adr-0008.md
[ADR-0008]: ../adr/adr-0008-cpp-csharp-quality-check-contract.md
[ADR-0007]: ../adr/adr-0007-release-publish-destination.md
[UC-007]: ../uc-007/uc.md
[UC-006]: ../uc-006/uc.md
[ADR-0006]: ../adr/adr-0006-release-process-and-version-pinning.md
[UC-005]: ../uc-005/uc.md
[ADR-0005]: ../adr/adr-0005-quality-check-contract.md
[670f0ac]: https://git.tirsystem.com/TirSystem/github-action/commit/670f0ac469043bb166c84290c0dbf62b4908e3cc
[e3ad1fa]: https://git.tirsystem.com/TirSystem/github-action/commit/e3ad1fa7e7eef57a6793a479edb41ac6fd2db688