[Nic-dorman]

Round 2 (f6b0393): fixes Hermes's P2. The job now also watches rust-toolchain, rust-toolchain.toml, .cargo and every Cargo manifest, not only the root one. Review range 61697492..f6b0393.

Linear issue

Closes V2-1815

The notices job regenerated THIRD-PARTY-NOTICES.txt on every PR. Generation downloads licence texts from crate repositories (GitHub) and musl's COPYRIGHT from musl.libc.org, so an outage at either site turned unrelated PRs red. Example: run 41611316872, request failed after retries: https://musl.libc.org/releases/musl-1.2.5.tar.gz: … handshake operation timed out. Since #269 the job is in CI Gate, so a flake like that now blocks the gate too.

The job now generates only when the PR changes something the notices are generated from:

• every Cargo manifest (**/Cargo.toml, a nested one too) and Cargo.lock, which cargo tree and cargo metadata read;
• .cargo, cargo's own config (source replacement, path overrides);
• the toolchain pin, rust-toolchain or rust-toolchain.toml. rustup prefers it to the stable toolchain the job installs. rustc -vV picks the musl release, and the toolchain ships the standard library's copyright text (round 2);
• scripts/third_party_notices/**;
• ci.yml itself, which holds the generator's arguments.

Release-promotion PRs touch Cargo.toml/Cargo.lock, so they still generate.

• With fetch-depth: 2, the checkout has the PR's merge commit and its first parent, the base tip. A new first step diffs the two over those paths.
• With no relevant change, the step writes a ::notice:: and the toolchain, Python and generate steps are skipped. The job still succeeds, because CI Gate counts a skipped job as a failure.
• Fail safe: if HEAD isn't a merge commit (a ref other than a PR merge), it generates.
• The script itself is unchanged, and its gap detection stays hard-fail.

What this gives up: a new rustc stable can move the musl version without any PR changing. The release workflow regenerates the notices for every build anyway, so it catches that. The job comment says so.

I didn't take the ticket's other option, caching fetched texts. CI runs only on pull_request (V2-1353), and an Actions cache written on one PR's ref can't be read by another PR. A cache would only help re-runs of the same PR.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Compatibility

• Wire: none
• Storage: none
• API: none

Semver impact

• breaking
• feature
• fix

Test evidence

• actionlint .github/workflows/ci.yml: clean.

• I ran the new step's script, extracted from the YAML, against local repos:

  HEAD	Result
  merge commit of a PR changing only README.md	generate=false, notice printed
  merge commit of a PR changing Cargo.lock	generate=true, lists Cargo.lock
  merge commit in a --depth 2 clone (as actions/checkout gives)	generate=false
  plain commit, not a merge	generate=true (fail safe)

• Round 2: the step's script, extracted from the YAML, run against simulated PR merge commits, before (6169749) and after (f6b0393):

  PR changes	6169749	f6b0393
  adds rust-toolchain.toml	false	true
  adds rust-toolchain	false	true
  adds crates/x/Cargo.toml	false	true
  adds .cargo/config.toml	false	true
  root Cargo.toml / Cargo.lock / generator / ci.yml	true	true
  README.md only / src/main.rs only	false	false
  docs/Cargo.toml.md, docs/xCargo.toml	false	false
  not a merge commit	true	true

  actionlint is clean on f6b0393.

• On this PR the job should generate, because ci.yml changed. The skip path shows on the next PR that leaves those paths alone.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert the PR, and the job generates on every PR again.

🤖 Generated with Claude Code

[MaidSafe-Hermes]

REQUEST_CHANGES

Coverage: 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3). Both seats reviewed the same frozen head and raised input-coverage questions; I verified the workflow and generator paths below.

• [P2] Watch toolchain pin changes that alter generated notices — .github/workflows/ci.yml:97-98

The filter skips generation for a PR that adds or changes rust-toolchain / rust-toolchain.toml, because neither path is watched. That can change the rustc used by generate.py: its musl_copyright() reads rustc -vV, looks up that compiler commit’s musl.sh, and adds that musl release’s COPYRIGHT; the rendered notice also contains toolchain-provided Rust standard-library copyright text. Thus this PR can change the generated notices while generate=false skips the check. Please include toolchain pin files in the watched paths (or derive the watched inputs from the generator’s actual dependencies).

The merge-parent comparison, fail-safe branch and conditional step gating look sound. The PR’s Third-party notices check exercises generation because ci.yml itself changed, so the new no-generation path was not exercised by this run. CI Gate passes; Security Audit fails outside that gate and is separate from this code verdict.

[MaidSafe-Hermes]

APPROVE

Coverage: 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3). The prior finding is fixed: rust-toolchain and rust-toolchain.toml are now watched. The :(glob)**/Cargo.toml pathspec matches both root and nested manifests; .cargo covers its tracked descendants. I verified these match behaviors locally, including non-matching lookalike filenames. The merge-parent comparison and conditional step flow look correct.

All CI Gate prerequisites and CI Gate pass at this head, including Ubuntu, macOS and Windows tests. Security Audit still fails outside CI Gate; it is not part of this code verdict, but remains separate merge-readiness work. The new generate=false branch is not exercised by this PR because ci.yml itself triggers generation; path-filter matching was checked locally.