fix(ci): lock the standards-pipeline reusable ref and close the lock - #104
Merged
Merged
Conversation
The lock-sync gate added in #101 went red on `main` within five minutes of merging. It was right: commit b506eed ("ci: standards ci-pipeline dry-run caller"), which landed at 12:29Z, added .github/workflows/standards-pipeline.yml pinning hyperpolymath/standards@2eb9bb19 and left that ref out of the lockfile. This is the job-level reusable-workflow class that `gh actions-lock` v0.1.6 will not backfill (upstream #129): the workflows: entry for the new file was written as an empty list. standards-pipeline.yml triggers on pull_request only, so no run has been startup-killed yet -- the next PR would have been the first. Changes: - workflows: record the standards@2eb9bb19 ref under standards-pipeline.yml - dependencies: add records for standards@2eb9bb19 (4 nested refs) and the three edges that closed over: haskell-actions/setup, standards@571cc734, oven-sh/setup-bun. Verified transitively closed. - scripts/check-lock-sync.sh: fold case on the owner/repo segment only. GitHub resolves owner/repo case-insensitively in actions.lock (measured), so a case-sensitive comparison reported false desyncs. - lock-sync-gate.yml: drop the stamp `gh actions-lock` prepended above the SPDX line, which the estate `head -1` SPDX check would otherwise fail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (38)
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe lock-sync script now compares action owner and repository names without case sensitivity while preserving ref case and report display. Workflow discovery is deterministic. The gate workflow no longer contains the actions-lock management comment. ChangesLock-sync gate
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~15 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The checker now normalizes action owner and repository casing while preserving ref sensitivity; no concrete production or merge-blocking risk remains identified. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each action name, Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
14 tasks
Contributor
|
Open the task to resolve the delivery issue or retry. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gate earned its keep
The lock-sync gate added in #101 went red on
mainwithin five minutes of merging. It was right.Commit
b506eeda("ci: standards ci-pipeline dry-run caller", 12:29Z) added.github/workflows/standards-pipeline.ymlpinninghyperpolymath/standards@2eb9bb19…and did not add that ref to.github/workflows/actions.lock. #101 merged at 12:34Z and the gate caught it on the next push.This is the job-level reusable-workflow class that
gh actions-lockv0.1.6 will not backfill (upstream #129) — it wrote theworkflows:entry for the new file as an empty list[].Not yet fatal, but it would have been
standards-pipeline.ymltriggers onpull_requestandworkflow_dispatchonly — nopush— so nothing has been startup-killed yet. The next pull request would have been the first. GitHub rejects such a run before any job is created:jobs=0, and the only diagnostic is "This run likely failed because of a workflow file issue."Changes
actions.lockstandards@2eb9bb19understandards-pipeline.yml; add dependency records for it (4 nested refs) plus the 3 edges that closed over —haskell-actions/setup,standards@571cc734,oven-sh/setup-bunscripts/check-lock-sync.shlock-sync-gate.yml# This workflow is managed by gh actions-lock.stamp the tool prepends above line 1, which displaces the SPDX header and fails the estatehead -1checkDisclosure: one case normalisation
Swatinem/rust-cache@6323deb1…is rewritten toswatinem/rust-cache@6323deb1…in both the top-level dependency key and the nested reference, so the lock stays transitively closed. GitHub resolvesowner/repocase-insensitively inactions.lock(measured on a same-commit control), andgh actions-lock --verify-localaccepts the result. Flagging it because it is a line this PR did not otherwise need to touch.Verification
gh actions-lock --verify-local— cleanscripts/check-lock-sync.sh— passes all three clauses (per-path coverage, no orphan records, transitive closure)uses: $/…local-action rewritemain🤖 Generated with Claude Code
https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm