fix(ci): propagate-hooks discovery — credential, error honesty, canary, compact JSON - #824
Merged
Merged
Conversation
…y, compact JSON (closes #807) The discovery step failed in a way that looked like 'nothing to do': 1. Root cause 1: the .githooks contents probe ran 'gh api' with NO token in scope (the file's only token sat on a different step). Tokenless calls failed, 2>/dev/null hid the error, and jq -e read the error object as 'not an array' — so every repo classified hookless and REPOS_WITH_HOOKS was permanently empty. → Step now carries env: GH_TOKEN: secrets.HYPATIA_SCAN_PAT, the estate's read-only cross-repo PAT (same credential governance and allowlist-preflight reusables use for live repo reads), with the scope stated in a comment per the issue's acceptance criterion. 2. Root cause 2: printf '%s\n' on an EMPTY bash array prints one empty line, so REPOS_JSON became [""], and writing that multiline value to $GITHUB_OUTPUT crashed the job ('Invalid format'). An empty list now serializes explicitly to [] and all JSON is compact single-line, including the target-repo branch (jq -cn). 3. Error-honesty + canary: probe errors are now a third outcome — reported and fatal-on-any — and a canary asserts hyperpolymath/standards (which owns 14 hooks) always classifies as having hooks. Zero-propagation can never fake-green again.
Contributor
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # governance-reusable.yml and allowlist-preflight-reusable.yml use | ||
| # for live repo reads. Without a token every probe fails silently | ||
| # and every repo is misclassified as hookless. | ||
| GH_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #807.
Re-verified at HEAD
33ec4a7(2026-09-17) before fixinggh api /repos/$ORG/$REPO_NAME/contents/.githooks | jq -e …— noGH_TOKEN/env:anywhere in the file except L155 (a different step's push credential). Tokenless probe →2>/dev/null→jq -ereads the error object → every repo "hookless".printf '%s\n' "${REPOS_WITH_HOOKS[@]}"on the empty array → one empty line →jq→[""]→ multiline$GITHUB_OUTPUT→Invalid format ' ""'. Defect 2 was the only reason defect 1 was visible.Fix
env: GH_TOKEN+ scope in a commentGH_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT }}— the estate's read-only cross-repo contents credential (same onegovernance-reusable.yml/allowlist-preflight-reusable.ymluse), scope documented in a comment[]; non-empty →jq -R . | jq -cs .; also fixed the same latent bug on thetarget-repobranch (jq -npretty-prints multiline → would have broken$GITHUB_OUTPUTidentically)hyperpolymath/standardsowns 14 hooks — if it classifies hookless, discovery is broken and the job exits 1 instead of "propagating" nowhereValidation
yaml.safe_loadparses;bash -non the extracted step block passes[], one repo →["hyperpolymath/standards"], two →["a/b","c/d"]— all compact single-line