Fix/782 orphan pin ancestry - #834
Merged
Merged
Conversation
…#782) reachable != consumable. A reusable-workflow pin can name a REAL commit object that GitHub still refuses to run: the resolver needs the commit to be reachable from the repo's DEFAULT BRANCH. Estate census 2026-09 (435 repos x 4 reusable workflows): four such SHAs — 7fdc270 (squash-merge orphan, PR head discarded at squash), 892497f (deleted unmerged branch), 4696052 (alive on a remote branch, not an ancestor of main), 5b1d002 (not an object) — account for 61 dead workflow-run rows with ZERO alive rows, and this gate's existence predicate passed the first three. Changes: - Reusable-workflow pins (.github/workflows/*.yml@sha) now get a second, server-side probe after the commits-200: compare/<default>...<sha>. behind|identical => ancestor => consumable; ahead|diverged => NOT an ancestor => determinate negative, new failure class NOT-ANCESTOR with a remedy block ('repin to the merge commit, never a PR head'). An indeterminate probe (default-branch fetch, compare 4xx/5xx) is UNVERIFIED-loud, exactly like every other indeterminate answer. - Ordinary action pins are deliberately NOT probed: actions are fetched by object id at run time and non-default-branch commits are a working pattern there. A suite case asserts the compare endpoint is never even hit for an action-only fixture. - api() now also captures the response body (needed for default_branch and compare status). The newline test that isolates the code from the body is a BUILTIN — a printf | grep -q pipeline lets grep exit on the first match and kills printf with SIGPIPE under pipefail for any body over the 64 KB pipe buffer, smuggling the entire blob into $HTTP (caught live against the 146 KB codeql-action compare body; the gate silently soft-passed a real reusable pin). - Regression suite, stub-driven and offline: the four witness SHAs with their measured compare verdicts, probe semantics (behind/identical pass; diverged/ahead fail; compare-403 and default-branch-404 are loud-indeterminate, never verdicts), action-pin overreach guard, and three >64 KB SIGPIPE differential cases. 30 cases, all green; the piped-vs-builtin differential confirms the SIGPIPE tests bite. Out of scope per the issue's own disposition: the 61-row repin is owner-ordered; the pin-writer (apply-workflow-pins-remote.sh) already enforces the mirror-image rule (compare/<sha>...main must be identical|ahead) so the generator half needs no change. Refs #782
Contributor
|
Warning Review limit reachedNext included review available in 15 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers