fix(ci): make publishing-check resolve only what was just published - #110
Merged
Merged
Conversation
The check listed jitpack.io alongside mavenLocal. Now that 1.8.3 is released, a module that silently failed to publish locally could resolve from the released artifact of the same version instead — so the check would pass having tested the wrong artifact entirely. Demonstrated rather than assumed, by deleting MockInterceptor 1.8.3 from ~/.m2 and running both shapes: with jitpack.io: PASS x4, "resolves cleanly" <- false green without jitpack.io: FAILED, could not find MockInterceptor:1.8.3 Nothing needed the fallback: the toolbox's own modules come from mavenLocal and every third-party dependency resolves from google or mavenCentral, so the check still passes with it removed. Found via the AssistantHood session withdrawing a cache-provenance assertion of its own. The general shape is the one that keeps recurring in this work: a fallback or cached route lets a check succeed for a reason unrelated to what it claims to measure. Here it was worse than a missing assertion, because a green would have actively certified the released artifact as if it were the build's output. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hole
publishing-check/settings.gradle.ktslistedjitpack.ioalongsidemavenLocal(). The job's entire purpose is to verify what the toolbox just published locally — but with a remote repository in the list, a module that silently failed to publish could resolve from the released artifact of the same version and the check would pass having tested something else.Latent when the job was written (nothing was released at 1.8.3 yet). Live the moment 1.8.3 was tagged.
Demonstrated, not assumed
MockInterceptor 1.8.3deleted from~/.m2, both shapes run:The first is the worse kind of failure: not a missing assertion, but a green actively certifying the released artifact as if it were this build's output.
Nothing needed the fallback — toolbox modules come from
mavenLocal, third-party dependencies fromgoogle/mavenCentral— so the check still passes with it removed, and the negative control from the original commit still behaves (GMM disabled →okhttp-jvm/flexilogger-jvmflagged with the floors green).Provenance
Found because the AssistantHood session withdrew a cache-provenance assertion in its own script —
~/.gradle/caches/modules-2being machine-wide, it cannot attribute a fetch to a project — and flagged that the same ambiguity would apply to any CI reusing it. That prompted checking whether this job had an equivalent flaw. It did, of a different kind.The recurring shape across this release: a fallback, cached or absent state lets a check succeed for a reason unrelated to what it claims to measure. Five instances turned up during 1.8.3, every one found by someone questioning their own evidence rather than by the check failing.
🤖 Generated with Claude Code