actions.lock: list the lock-sync gate, and make the checker require coverage - #95
Merged
Merged
Conversation
…overage
Two defects, one cause: a workflow file that has NO KEY in actions.lock is
refused by GitHub at startup (jobs=0, startup_failure) even when it contains
zero `uses:` refs and therefore has nothing to pin.
1. Add the missing key for the gate this repo already ships:
'.github/workflows/lock-sync-gate.yml': []
MEASURED, single-variable flip on two independent repositories:
* hyperpolymath/verisimdb - 7 consecutive startup_failure -> success
* hyperpolymath/blocky-writer - 2 of 2 startup_failure -> success
Nothing else changed in either case. An empty commit with the lock
untouched still failed; the commit adding this line passed. `gh actions-lock`
already emits this empty-list form for other zero-`uses:` workflows in this
very lockfile (labels.yml), so the spelling is the generator's own
convention - the generator simply omitted this file.
2. Teach scripts/check-lock-sync.sh to catch it (clause 4, COVERAGE).
The gate could not defend the very fix it ships. Clauses 1-3 ask "is every
`uses:` locked under its own workflow path?" GitHub asks a DIFFERENT
question: "is every workflow file represented in the lock?" A workflow with
no `uses:` satisfies clauses 1-3 vacuously and is still refused. Thirteen
repositories passed the gate with exactly this gap present.
Clause 4 diffs the set of files under .github/workflows/ against the set of
lockfile keys and fails on any file with no key, naming it and quoting the
empty-list form. Mutation-tested both ways: deleting the lock-sync-gate key
fails the gate, and deleting the unrelated labels.yml key fails it too;
the unmutated tree passes.
3. Add `workflow_dispatch:` to the gate so it can be exercised on demand.
A startup-failed run cannot be re-run (`gh run rerun` refuses it), which is
what made this defect expensive to diagnose.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (12)
|
| Layer / File(s) | Summary |
|---|---|
Workflow coverage validation scripts/check-lock-sync.sh |
The script detects unlisted workflows, reports their paths, exits with status 1, and provides repair guidance for zero-uses workflows. |
Manual gate execution .github/workflows/lock-sync-gate.yml |
The workflow adds the workflow_dispatch trigger. |
Priority: ⬇️ Low
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Merge Risk: ⚪ Minimal · up to 6a491
The lock synchronisation gate covers the intended workflows and can be run manually, with no established merge-blocking risk.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly identifies the lockfile entry and the checker coverage requirement, which are the main changes in the pull request. |
| Description check | ✅ Passed | The description directly explains the missing lockfile coverage, the new coverage clause, the workflow dispatch support, and the verification results. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
📝 Generate docstrings
- 🤖 Coding Agent task started for docstring generation.
- Create a new PR
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks each workflow path
Empty lists now count in the math
The gate can run by hand
Missing keys are clearly planned
Lock sync stays on track
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
✅ Coding Agent task started: View task and status The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.
⏭️ 1 check(s) skipped — already failing on `main` (not caused by this PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
The lock-sync gate merged into this repository cannot start, and the
checker it ships cannot detect why. Both are fixed here.
A workflow file with no key in
.github/workflows/actions.lockis refusedby GitHub at startup —
jobs=0,startup_failure— even when it containszero
uses:refs and so has nothing to pin.Evidence — single-variable flip, two independent repositories
hyperpolymath/verisimdbstartup_failurehyperpolymath/blocky-writerstartup_failureNothing else changed in either case. A control commit that touched the tree but
not the lock still failed; the commit adding the key passed. This is a state
effect, not a re-indexing side effect of "any lock change".
The spelling is not invented —
gh actions-lockalready emits the empty-listform for other zero-
uses:workflows in this same lockfile (labels.yml). Thegenerator simply omitted this file, which is itself an upstream defect.
The gate could not defend its own fix
This is the guard-asks-a-different-question-than-its-consumer trap:
uses:locked under its own workflow path?A workflow with no
uses:satisfies clauses 1–3 vacuously and is stillrefused. Thirteen repositories passed the gate with exactly this gap present,
so a green gate today is not evidence a lock is complete.
Clause 4 (COVERAGE) diffs the set of files under
.github/workflows/against the set of lockfile keys, fails on any file with no key, names it, and
quotes the empty-list form to add. Remediation step 4 warns that re-running
gh actions-lockmay not add it, because the omission is the tool's own defect.Mutation-tested, both directions
lock-sync-gate.ymlkeylabels.ymlkeyA passing gate proves nothing until it kills a mutant, so both are recorded here.
Also included
workflow_dispatch:on the gate. A startup-failed run cannot be re-run(
gh run rerunrefuses it), which is what made this defect expensive todiagnose; a dispatch handle makes it reproducible on demand.
Scope
The checker is patched in place — each repository's copy has diverged
slightly in comments, and only the clause-4 block, its remediation step and one
success line are added. No existing clause is altered.
Verification
bash -n scripts/check-lock-sync.shcleanjobs > 0(it could not start before)🤖 Generated with Claude Code
https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm