fix(ci): pin cicd-suite lock at 0c1bc9f — the cure never reached a consumer - #35
Merged
Merged
Conversation
…g old gates fa71ac2 (#32) cured the composite `-e` kill and 0c1bc9f (#34) restored the lockfile's composite-reached pins. Both are green here. Both were inert for every downstream consumer, and nothing was red to say so. pons-asinorum's estate audit still died at Required Files Gate, 82ms, silently, skipping 25 downstream gates — after being repointed at 0c1bc9f. The reason is that the reusable invokes its composites by BRANCH ref: uses: hyperpolymath/cicd-suite/actions/required-files-check@main A branch ref is trusted from the lockfile, and the runner executes THE COMMIT THE LOCKFILE NAMES, not the branch tip. The lock pinned cicd-suite@main at 9adb390 — four commits back, with 0 of the three `-e` guards. So no SHA a consumer chooses for the reusable can reach a cured composite; the lock's `@main` entry is the real gate, and re-pinning it is the actual delivery step. This bumps that pin to 0c1bc9f (an ancestor-clean fast-forward, transitive `uses:` unchanged). It carries three composites the old pin lacked: actions/linguist-check/action.yml (#31) actions/required-files-check/action.yml (#32) actions/spdx-license-check/action.yml (#32) The house pattern is a follow-up "pin cicd-suite lock at <sha>" commit — f8c8f4a, 4f9a7a4, 373714a all do exactly this. #31, #32 and #34 never got one. Rather than rely on remembering, lock-transitive-closure.sh now asserts it: for any self-referencing branch pin, the actions/ tree at the locked commit must equal HEAD's, and it names the drifted files when it does not. `shell-contract` gains `fetch-depth: 0` so the locked commit is present to compare against. Non-vacuity, twice over. The assertion was written BEFORE the bump and caught this defect live, naming all three files. And its first draft printed its header while checking nothing — a sed without lazy-quantifier support left ".git" on the repo name so no key matched — so the block now carries its own non-vacuity counter. A header is not a check. Local: lock-transitive-closure PASS=9 FAIL=0; composite-shell-contract PASS=7 FAIL=0 with its mutant killed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The cure was green here and inert everywhere else
fa71ac2(#32) cured the composite-ekill.0c1bc9f(#34) restored thelockfile pins #28 dropped. Both merged green. Neither reached a single
consumer, and nothing was red to say so.
pons-asinorum was repointed at
0c1bc9f(pons#26) and its estate audit stilldied at
Required Files Gate— 82 ms, silent, exit 1, 25 downstream gatesskipped. Identical to before the cure.
Why
The reusable invokes its gates by branch ref:
A branch ref is trusted from the lockfile, and the runner executes the commit
the lockfile names — not the branch tip. This lock pinned
cicd-suite@mainat9adb3908, four commits back:0c1bc9ffa71ac2-ecure (3 + 1 guards)6ff60573b4afaf9adb3908has 0 of those guards. So no SHA a consumer picks for thereusable can reach a cured composite. The lock's
@mainentry is the realgate, and re-pinning it is the actual delivery step — the one #31, #32 and #34
all skipped.
What this does
dependencies['hyperpolymath/cicd-suite@main'].committo0c1bc9f.Ancestor-clean fast-forward (
9adb3908is an ancestor of0c1bc9f); thetransitive
uses:list is unchanged, sodependencies:needs no other churn.tests/lock-transitive-closure.shgains a third assertion: for any self-referencing branch pin, the
actions/tree at the locked commit must equal
HEAD's. On drift it names the files.shell-contractgainsfetch-depth: 0so the locked commit is present tocompare against.
The house pattern for this is a follow-up "pin cicd-suite lock at
<sha>"commit —
f8c8f4a,4f9a7a4,373714aall do exactly this. It has beencarried by memory, and memory dropped it three times running. Now it is a test.
Non-vacuity — twice
The assertion was written before the bump and caught the live defect, naming
all three drifted composites:
And its first draft printed its header while checking nothing — an ERE
sedhas no lazy quantifiers, so
.gitstayed on the repo name and no dependency keyever matched. A header is not a check, so the block now carries its own
non-vacuity counter, separate from block 1's.
Local
Acceptance
Composite shell contractgreen with the new assertion passing — and thenpons#26's audit re-measured. Per the standing owner ruling, the gates that have
been skipped rather than passing may now surface new findings; those become
issues with acceptance criteria, not blockers on this PR.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f