Skip to content

Shared tasks: prek with a 7-day cooldown, shared .npmrc cooldown - #10

Merged
jeyrb merged 1 commit into
mainfrom
alignment/prek-cooldown
Nov 8, 2026
Merged

jeyrb merged 1 commit into
mainfrom
alignment/prek-cooldown

Conversation

@jeyrb

@jeyrb jeyrb commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

Brings the shared mise tasks in line with the new prek and cooldown rules in policies/project_standards.md (hq, 11-08).

  • templates/python/tasks/refresh, templates/node/tasks/refresh and this repo's own: prek autoupdate --cooldown-days 7 replaces pre-commit autoupdate (prek 0.5.10 has the flag).
  • New templates/node/npmrc (min-release-age=7, @rhizomatics/* exempt). sync-admin.sh copies it to npm repos as .npmrc. I tested it with npm 12: npm ci and npm install keep a locked version that is only 2 days old, so CI isn't affected. Only new resolution, e.g. npm update, waits.
  • This repo: prek in mise.toml, and exclude-newer = "7 days". The re-lock moves zensical 0.1.0 back to 0.0.74, because 0.1.0 is under 7 days old. That is the cooldown working. Say if you want 0.1.0 kept with an exclude-newer-package entry.
  • README: a cooldown table, one row per updater.

Merge this first. The per-repo PRs copy these templates, so if the templates change in review they need re-syncing (scripts/sync-admin.sh --check).

Context: https://github.com/rhizomatics/hq-private/blob/main/reports/alignment/2026-11.md#addendum-policy-review-2026-11-08

🤖 Generated with Claude Code

- refresh tasks (python, node, and this repo's own) run
  `prek autoupdate --cooldown-days 7` instead of `pre-commit autoupdate`
- templates/node/npmrc: min-release-age=7, @rhizomatics/* exempt;
  sync-admin.sh copies it to npm repos as .npmrc
- this repo: prek in mise.toml, exclude-newer = "7 days", re-locked
- README: cooldown table and the prek switch

Per policies/project_standards.md in rhizomatics/hq (prek, cooldown).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedzensical@​0.1.0 ⏵ 0.0.7498 +1100100100100

View full report

@jeyrb
jeyrb merged commit 5038dc7 into main Nov 8, 2026
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant