From 828b7bf62d6f237d0357d291773618404111f97d Mon Sep 17 00:00:00 2001 From: Claude Code Date: Sun, 2 Aug 2026 12:42:07 +0000 Subject: [PATCH] Fix three defects found while cross-checking the documentation **`PrepareJob.yml`: submodules were never detected.** The check tested for a file named `.gitsubmodules`; Git's file is `.gitmodules`. `has_submodules` was therefore always `'false'` and `git_submodule_count`, `git_submodule_names` and `git_submodule_paths` kept their initial empty values for every repository. The block already had the correct name in a local variable one line below, which is now used for the test as well. Verified against a scratch repository with two submodules: ``` has_submodules=true count=2 names=libA:libB paths=deps/libA:deps/libB ``` and `has_submodules=false` once the file is removed. **`CleanupArtifacts.yml`: an unknown artifact ID raised `NameError`.** Both compute steps call `printf(...)` in their `case _:` fallback, but the step runs `shell: python`, where `printf` is not a function. An `artifact-json-ids` entry that is not a key of the JSON dictionary - a typo, or a key removed from `Parameters.yml` while a consumer still lists it - aborted the step with `NameError: name 'printf' is not defined` instead of reporting the name. That is precisely the case the branch exists for. Reproduced against the previous revision (exit code 1, `NameError`) and against this one: ``` Name 'typo_key' not found in JSON dictionary. Artifact to delete: pyX-UnitTestReportSummary-XML-* pyX-Packages ``` `_Checking_CleanupArtifacts.yml` now passes an `unknown_key` entry, so the branch is exercised by the verification pipeline. **`CheckCodeQuality.yml`: the security scan could be skipped silently.** The `Bandit` step was guarded by `if: inputs.artifact != ''`, although the step writes its report to a fixed path and never used that parameter. An empty artifact name skipped the scan while the job still reported success. The guard is removed; the scan now runs whenever the job runs. Co-Authored-By: Patrick Lehmann --- .github/workflows/CheckCodeQuality.yml | 1 - .github/workflows/CleanupArtifacts.yml | 4 ++-- .github/workflows/PrepareJob.yml | 4 ++-- .github/workflows/_Checking_CleanupArtifacts.yml | 2 ++ 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/CheckCodeQuality.yml b/.github/workflows/CheckCodeQuality.yml index 0a3ab484..3ec10a84 100644 --- a/.github/workflows/CheckCodeQuality.yml +++ b/.github/workflows/CheckCodeQuality.yml @@ -86,7 +86,6 @@ jobs: - name: 👮 Bandit id: bandit - if: inputs.artifact != '' run: | set +e diff --git a/.github/workflows/CleanupArtifacts.yml b/.github/workflows/CleanupArtifacts.yml index 988a781e..84fcc872 100644 --- a/.github/workflows/CleanupArtifacts.yml +++ b/.github/workflows/CleanupArtifacts.yml @@ -96,7 +96,7 @@ jobs: case [prefix, key, postfix] if key in artifactNames: artifacts.append(f"{prefix}{artifactNames[key]}{postfix}") case _: - printf(f"Name '{name}' not found in JSON dictionary.") + print(f"Name '{name}' not found in JSON dictionary.") print("Artifact to delete:") for name in artifacts: @@ -143,7 +143,7 @@ jobs: case [prefix, key, postfix] if key in artifactNames: artifacts.append(f"{prefix}{artifactNames[key]}{postfix}") case _: - printf(f"Name '{name}' not found in JSON dictionary.") + print(f"Name '{name}' not found in JSON dictionary.") print("Artifact to delete:") for name in artifacts: diff --git a/.github/workflows/PrepareJob.yml b/.github/workflows/PrepareJob.yml index 6cd1fd07..6ea6eecc 100644 --- a/.github/workflows/PrepareJob.yml +++ b/.github/workflows/PrepareJob.yml @@ -366,9 +366,9 @@ jobs: fi # Submodules - if [[ -f .gitsubmodules ]]; then + git_modules_file=.gitmodules # $(git rev-parse --show-toplevel)/.gitmodules + if [[ -f "${git_modules_file}" ]]; then has_submodules="true" - git_modules_file=.gitmodules # $(git rev-parse --show-toplevel)/.gitmodules git_submodule_count="$(grep -Po '(?<=\[submodule \")(.*)(?=\"\])' "${git_modules_file}" | wc -l)" git_submodule_names="$(grep -Po '(?<=\[submodule \")(.*)(?=\"\])' "${git_modules_file}" | paste -sd ':' -)" git_submodule_paths="$(git config --file "${git_modules_file}" --null --name-only --get-regexp '\.path$' | xargs -0 -n1 git config --file "${git_modules_file}" --get | paste -sd ':' -)" diff --git a/.github/workflows/_Checking_CleanupArtifacts.yml b/.github/workflows/_Checking_CleanupArtifacts.yml index f599c84f..5fedf489 100644 --- a/.github/workflows/_Checking_CleanupArtifacts.yml +++ b/.github/workflows/_Checking_CleanupArtifacts.yml @@ -58,8 +58,10 @@ jobs: - Package with: json: ${{ needs.Params.outputs.artifact_names }} + # Deliberate added 'unknown_key' for exception testing. artifact-json-ids: >- unittesting_xml:-* + unknown_key # The package artifact is kept on tagged runs, so 'PublishOnPyPI.yml' can still consume it. json2: ${{ needs.Params.outputs.artifact_names }} condition2: ${{ ! startsWith(github.ref, 'refs/tags') }}