[yakimoto]

User description

GitHub Actions is retired for good and Buildkite is this repo's CI (pipeline buildkite/api-spec, the only required check on main).

This deletes the dead workflow below and nothing else. It's part of the GH_PACKAGES_READ_TOKEN retirement after the s03 exposure: the workflow writes an npm.pkg.github.com npmrc, and that path is being replaced by registry.wave-ci.internal.

Deleted:

• .github/workflows/governance-enforce.yml (not a required status check; the governance gate runs on Buildkite)

No other files are touched (dependabot.yml left alone). Draft: do not merge without Orchestrator's go-ahead.

Refs: WAVE-28266

---

CodeAnt-AI Description

Remove the retired GitHub Actions governance workflow

What Changed

• Pull requests, pushes to the main branches, and merge-queue events no longer start this GitHub Actions scan for secrets and hardcoded paths.
• Governance enforcement and required CI checks remain on Buildkite.

Impact

✅ No GitHub Actions runs for governance scanning
✅ Governance checks stay on Buildkite
✅ No GitHub Packages token needed for this workflow

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Note

Remove retired governance-enforce GitHub Actions workflow

Deletes governance-enforce.yml in full. This removes the enforce job that ran on pull requests, merge queue, and main/master pushes. Risk: the A_BLOCK governance enforcement no longer runs from this workflow, so check whether another mechanism now covers it.

^{Macroscope summarized 7061731.}

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	7061731	Oct 24, 2026 · 18:47	18:47

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codeant-ai]

CodeAnt PR Risk: Low Risk

• The PR appears safe to merge; no actionable issues were identified in the review.

Assessed commit: 7061731936c3

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub
    participant BK as Buildkite
    participant Reg as registry.wave-ci.internal
    participant Gov as Governance Enforcer (@wave-av/governance)

    Note over Dev,GH: CI/CD Pipeline for api-spec Repository
    
    Dev->>GH: Push to main / open PR / merge queue
    GH->>BK: Trigger buildkite/api-spec pipeline
    
    alt Required CI checks on main
        BK->>BK: Run CI pipeline
        BK-->>GH: Report check status
    end
    
    Note over GH,BK: Governance Gate (Buildkite-hosted)
    
    BK->>Reg: Fetch governance enforcer package
    Reg-->>BK: @wave-av/governance@0.4.6
    BK->>Gov: Execute enforce.mjs --changed BASE
    Gov->>Gov: Scan diff for secrets & hardcoded paths
    Gov-->>BK: Enforcement results (PASS/FAIL)
    BK-->>GH: Report governance check status
    
    Note over GH,Gov: GitHub Actions retired - no longer runs governance scans
    Note over Dev,GH: GH_PACKAGES_READ_TOKEN no longer needed for workflow
    Note over Reg: npm.pkg.github.com registry path replaced

Loading

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[wave-bugbot]

🟢 WAVE BugBot — clear

No confident findings on the changed lines.

_{Local review · $0 inference · wave-dispatch}