Skip to content

docs: make commit-SHA pinning discoverable + test SHA-predicate agreement - #285

Draft
Brian Krabach (bkrabach) wants to merge 1 commit into
mainfrom
docs/sha-pinning-discoverability
Draft

docs: make commit-SHA pinning discoverable + test SHA-predicate agreement#285
Brian Krabach (bkrabach) wants to merge 1 commit into
mainfrom
docs/sha-pinning-discoverability

Conversation

@bkrabach

Copy link
Copy Markdown
Collaborator

Summary

Follow-up to merged PR #282 (commit-SHA pinning: fetch-by-sha + fallback). The feature is powerful but undocumented — users discovering it by accident in git.py would need to trace the code. This PR adds discovery documentation and validates the SHA-predicate agreement at test time.

What Changed

  1. ** — URI-FORMATS section updated:**

  2. ** — new PINNING subsection:**

    • Why pin (reproducibility, security, evaluation)
    • Mechanism: fast single-commit fetch + full-clone fallback
    • Behavior: pin is enforced on every resolve; `get_status()" reports locked status
    • Update-skip semantics (pinned → no auto-updates possible)
  3. New test: test_sha_predicate_agreement

    • Validates that the resolve predicate (is the requested SHA in the repo?) matches the git.py logic
    • Covers both fast (single-commit) and fallback (full-clone) paths
    • Uses local file:// repos to avoid network coupling
    • Tuned for reproducibility; uses git commit hashes from this session, not hardcoded SHAs

Gaps Honestly Stated

Test Evidence

Verbatim (Linux aarch64, Python 3.13):

46 passed in 3.35s

Pre-Filing Review

Pre-filing: passed an independent context-isolated adversarial review (issue verified against implementation, fix reviewed composed-state, tests re-run by reviewer). Human review requested before merge.

Follow-up to #282 (merged as 1a40883), which added full-commit-SHA refs
to the git source handler but shipped the feature undiscoverable: every
git-source example in docs/ used @main and SHA pinning appeared nowhere.

- docs/URI_FORMATS.md, docs/BUNDLE_GUIDE.md: add a pinned-commit row to
  the source-format tables plus a short note covering what pinning is
  for (reproducible installs, eval/CI), that pinned sources are skipped
  by `amplifier update` (get_status -> is_pinned -> has_update=False ->
  excluded from updateable_sources), that short SHAs are rejected by
  design, and the cost of a typo'd-but-valid-looking SHA (full-clone
  fallback before a clear checkout error; a failed pinned resolve can
  leave a cache entry behind that a later resolve may serve, so clear
  the cache entry if a pin fails).

- tests/test_sources.py: the full-SHA rule is encoded twice --
  _is_full_commit_sha (regex, sources/git.py) and SourceStatus.is_pinned
  (length+charset, sources/protocol.py) -- guarded only by a comment.
  Add TestShaPredicatesAgree asserting the two agree across 40-hex
  lower/upper/mixed, 39/41-char, non-hex, and branch-name refs, plus one
  test documenting the intentional v-tag divergence. Converts the
  load-bearing comment into a checked invariant without abstracting
  (two instances is below the bar).

🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)

Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants