actions.lock: list the lock-sync gate, and make the checker require coverage - #108
Merged
Merged
Conversation
…overage
Two defects, one cause: a workflow file that has NO KEY in actions.lock is
refused by GitHub at startup (jobs=0, startup_failure) even when it contains
zero `uses:` refs and therefore has nothing to pin.
1. Add the missing key for the gate this repo already ships:
'.github/workflows/lock-sync-gate.yml': []
MEASURED, single-variable flip on two independent repositories:
* hyperpolymath/verisimdb - 7 consecutive startup_failure -> success
* hyperpolymath/blocky-writer - 2 of 2 startup_failure -> success
Nothing else changed in either case. An empty commit with the lock
untouched still failed; the commit adding this line passed. `gh actions-lock`
already emits this empty-list form for other zero-`uses:` workflows in this
very lockfile (labels.yml), so the spelling is the generator's own
convention - the generator simply omitted this file.
2. Teach scripts/check-lock-sync.sh to catch it (clause 4, COVERAGE).
The gate could not defend the very fix it ships. Clauses 1-3 ask "is every
`uses:` locked under its own workflow path?" GitHub asks a DIFFERENT
question: "is every workflow file represented in the lock?" A workflow with
no `uses:` satisfies clauses 1-3 vacuously and is still refused. Thirteen
repositories passed the gate with exactly this gap present.
Clause 4 diffs the set of files under .github/workflows/ against the set of
lockfile keys and fails on any file with no key, naming it and quoting the
empty-list form. Mutation-tested both ways: deleting the lock-sync-gate key
fails the gate, and deleting the unrelated labels.yml key fails it too;
the unmutated tree passes.
3. Add `workflow_dispatch:` to the gate so it can be exercised on demand.
A startup-failed run cannot be re-run (`gh run rerun` refuses it), which is
what made this defect expensive to diagnose.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
Contributor
|
Warning Review limit reachedNext included review available in 18 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
The lock-sync gate merged into this repository cannot start, and the
checker it ships cannot detect why. Both are fixed here.
A workflow file with no key in
.github/workflows/actions.lockis refusedby GitHub at startup —
jobs=0,startup_failure— even when it containszero
uses:refs and so has nothing to pin.Evidence — single-variable flip, two independent repositories
hyperpolymath/verisimdbstartup_failurehyperpolymath/blocky-writerstartup_failureNothing else changed in either case. A control commit that touched the tree but
not the lock still failed; the commit adding the key passed. This is a state
effect, not a re-indexing side effect of "any lock change".
The spelling is not invented —
gh actions-lockalready emits the empty-listform for other zero-
uses:workflows in this same lockfile (labels.yml). Thegenerator simply omitted this file, which is itself an upstream defect.
The gate could not defend its own fix
This is the guard-asks-a-different-question-than-its-consumer trap:
uses:locked under its own workflow path?A workflow with no
uses:satisfies clauses 1–3 vacuously and is stillrefused. Thirteen repositories passed the gate with exactly this gap present,
so a green gate today is not evidence a lock is complete.
Clause 4 (COVERAGE) diffs the set of files under
.github/workflows/against the set of lockfile keys, fails on any file with no key, names it, and
quotes the empty-list form to add. Remediation step 4 warns that re-running
gh actions-lockmay not add it, because the omission is the tool's own defect.Mutation-tested, both directions
lock-sync-gate.ymlkeylabels.ymlkeyA passing gate proves nothing until it kills a mutant, so both are recorded here.
Also included
workflow_dispatch:on the gate. A startup-failed run cannot be re-run(
gh run rerunrefuses it), which is what made this defect expensive todiagnose; a dispatch handle makes it reproducible on demand.
Scope
The checker is patched in place — each repository's copy has diverged
slightly in comments, and only the clause-4 block, its remediation step and one
success line are added. No existing clause is altered.
Verification
bash -n scripts/check-lock-sync.shcleanjobs > 0(it could not start before)🤖 Generated with Claude Code
https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm