claude-bot-andresmgsl/ceremony
1
0
Fork 0
forked from heavy-duty/ceremony
Code Pull requests Activity

fix: exercise refs guard action boundary

Browse source
This commit is contained in:
Andriujose 2026-08-03 20:58:56 +00:00
parent 869d05bf85
commit 022d1fcda6
4 changed files with 126 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
actions/refs-not-closing/action.yml
View file

@ -13,48 +13,4 @@ runs:
env:
GH_TOKEN: ${{ github.token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
run: |
set -euo pipefail
owner="${GITHUB_REPOSITORY%%/*}"
name="${GITHUB_REPOSITORY#*/}"
[ -n "$PR_NUMBER" ] || {
echo "refs-not-closing: pull request number is unavailable" >&2
exit 1
}
facts="$(gh api graphql \
-f query='query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
body
closingIssuesReferences(first: 100) {
nodes { number }
pageInfo { hasNextPage }
}
}
}
}' \
-F owner="$owner" -F name="$name" -F number="$PR_NUMBER")"
body_file="$(mktemp)"
closing_file="$(mktemp)"
trap 'rm -f "$body_file" "$closing_file"' EXIT
jq -er '
.data.repository.pullRequest
| if . == null then error("pull request was not returned") else .body // "" end
' <<<"$facts" >"$body_file"
jq -r '
.data.repository.pullRequest.closingIssuesReferences
| if . == null then
error("closing issue references were not returned")
elif .pageInfo.hasNextPage then
error("more than 100 closing issue references; refusing a partial verdict")
else
.nodes[].number
end
' <<<"$facts" >"$closing_file"
mapfile -t closing_issues <"$closing_file"
bash "$GITHUB_ACTION_PATH/refs-not-closing.sh" \
"$body_file" "${closing_issues[@]}"
run: bash "$GITHUB_ACTION_PATH/run.sh"

18
actions/refs-not-closing/refs-not-closing.sh
View file

@ -36,7 +36,7 @@ mapfile -t refs_targets < <(
awk '
{
rest = tolower($0)
while (match(rest, /(^|[^[:alnum:]_])refs?[[:space:]]+#[0-9]+/)) {
while (match(rest, /(^|[^[:alnum:]_])refs?[[:space:]]*:?[[:space:]]*[[]?#[0-9]+/)) {
token = substr(rest, RSTART, RLENGTH)
sub(/^.*#/, "", token)
print token + 0
@ -61,16 +61,24 @@ fi
sentence_for_issue() {
local issue="$1" mode="$2"
awk -v issue="$issue" -v mode="$mode" '
/^[[:space:]]*$/ {
if (paragraph != "") {
text = text paragraph "\n\n"
paragraph = ""
}
next
}
{
text = text separator $0
separator = "\n"
if (paragraph != "") paragraph = paragraph " "
paragraph = paragraph $0
}
END {
count = split(text, sentence, /[.!?][[:space:]]+|\n+/)
text = text paragraph
count = split(text, sentence, /[.!?][[:space:]]+|\n\n+/)
if (mode == "closing") {
needle = "(^|[^[:alnum:]_])(close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved)[[:space:]]+#[[:space:]]*" issue "([^0-9]|$)"
} else {
needle = "(^|[^[:alnum:]_])refs?[[:space:]]+#[[:space:]]*" issue "([^0-9]|$)"
needle = "(^|[^[:alnum:]_])refs?[[:space:]]*:?[[:space:]]*\\[?#[[:space:]]*" issue "([^0-9]|$)"
}
for (i = 1; i <= count; i++) {
lower = tolower(sentence[i])

49
actions/refs-not-closing/run.sh Executable file
View file

@ -0,0 +1,49 @@
#!/usr/bin/env bash
set -euo pipefail
# The composite action's executable boundary (#218). Keeping the GraphQL
# gather here lets the offline contract test replace `gh` and prove that
# failed and partial reads cannot accidentally produce a green verdict.
owner="${GITHUB_REPOSITORY%%/*}"
name="${GITHUB_REPOSITORY#*/}"
[ -n "${PR_NUMBER:-}" ] || {
echo "refs-not-closing: pull request number is unavailable" >&2
exit 1
}
facts="$(gh api graphql \
-f query='query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
body
closingIssuesReferences(first: 100) {
nodes { number }
pageInfo { hasNextPage }
}
}
}
}' \
-F owner="$owner" -F name="$name" -F number="$PR_NUMBER")"
body_file="$(mktemp)"
closing_file="$(mktemp)"
trap 'rm -f "$body_file" "$closing_file"' EXIT
jq -er '
.data.repository.pullRequest
| if . == null then error("pull request was not returned") else .body // "" end
' <<<"$facts" >"$body_file"
jq -r '
.data.repository.pullRequest.closingIssuesReferences
| if . == null then
error("closing issue references were not returned")
elif .pageInfo.hasNextPage then
error("more than 100 closing issue references; refusing a partial verdict")
else
.nodes[].number
end
' <<<"$facts" >"$closing_file"
mapfile -t closing_issues <"$closing_file"
bash "$GITHUB_ACTION_PATH/refs-not-closing.sh" \
"$body_file" "${closing_issues[@]}"

73
test/refs-not-closing.test.sh
View file

@ -10,6 +10,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
SCRIPT="$ROOT/actions/refs-not-closing/refs-not-closing.sh"
ACTION="$ROOT/actions/refs-not-closing/action.yml"
ENTRYPOINT="$ROOT/actions/refs-not-closing/run.sh"
WORKFLOW="$ROOT/.github/workflows/refs-guard.yml"
TMP="$(mktemp -d)"
@ -46,7 +47,8 @@ check "failure offers number-first rewrite" 1 "#N is" guard prose 5
check "failure offers number-free rewrite" 1 "closes the issue" guard prose 5
body code-span 'Refs #5' '' "The body must not contain \`Closes #5\` anywhere."
check "backticked closing keyword still fails" 1 "Closes #5" guard code-span 5
check "backticked closing keyword is reported as the match" 1 \
"matched: Closes #5" guard code-span 5
check "backtick failure explains that code spans do not protect" 1 \
"Backticks do not protect" guard code-span 5
@ -68,6 +70,19 @@ body multiple 'Refs #5 and Refs #7.' 'Triage closes #5 and fixes #7 by hand.'
check "failure names every intersecting issue" 1 \
"scheduled to close: #5 #7" guard multiple 5 7
body soft-wrap 'Refs #5' '' 'Triage closes' '#5 by hand after the live proof.'
check "soft-wrapped closing prose is reported as one sentence" 1 \
"sentence: Triage closes #5 by hand after the live proof" \
guard soft-wrap 5
body refs-colon 'Refs: #5' '' 'Triage closes #5 after proof.'
check "Refs colon form is protected" 1 "matched: closes #5" \
guard refs-colon 5
body refs-link 'Refs [#5](https://example.test/issues/5)' '' \
'Triage closes #5 after proof.'
check "linked Refs form is protected" 1 "matched: closes #5" \
guard refs-link 5
for number in 207 191 190 176 165 164; do
body "incident-$number" "Refs #$number"
check "#$number incident replays green" 0 "no Refs target" \
@ -79,24 +94,62 @@ check "missing body is a loud failure" 1 "missing or unreadable" \
check "invalid closing set is a loud failure" 1 "invalid closing issue" \
guard ref-5 nope
# The action owns the network boundary. These structural assertions keep a
# future edit from suppressing a failed/partial GraphQL read or splitting the
# one authoritative query into several drifting reads.
# The action owns the network boundary. Drive its executable entrypoint with
# a fake `gh` so failures are behavioral assertions, not YAML text guesses.
mkdir -p "$TMP/bin"
cat >"$TMP/bin/gh" <<'EOF'
#!/usr/bin/env bash
set -u
case "${FAKE_GH_MODE:-success}" in
failure)
echo "fake GraphQL read failed" >&2
exit 42
;;
partial)
has_next=true
;;
success)
has_next=false
;;
*)
echo "unknown fake mode: ${FAKE_GH_MODE:-}" >&2
exit 2
;;
esac
printf '{"data":{"repository":{"pullRequest":{"body":"Refs #5","closingIssuesReferences":{"nodes":[],"pageInfo":{"hasNextPage":%s}}}}}}\n' "$has_next"
EOF
chmod +x "$TMP/bin/gh"
action_boundary() {
local mode="$1"
env PATH="$TMP/bin:$PATH" FAKE_GH_MODE="$mode" \
GITHUB_REPOSITORY="heavy-duty/ceremony" PR_NUMBER=268 \
GITHUB_ACTION_PATH="$ROOT/actions/refs-not-closing" \
bash "$ENTRYPOINT"
}
check "action boundary fails when GraphQL read fails" 42 \
"fake GraphQL read failed" action_boundary failure
check "action boundary refuses a partial closing-reference page" 5 \
"refusing a partial verdict" action_boundary partial
check "action boundary accepts a complete GraphQL read" 0 \
"no Refs target" action_boundary success
one_graphql_read() {
[ "$(grep -c "gh api graphql" "$ACTION")" -eq 1 ]
[ "$(grep -c "gh api graphql" "$ENTRYPOINT")" -eq 1 ]
printf '1\n'
}
check "action performs exactly one GraphQL read" 0 "1" \
one_graphql_read
check "action refuses a partial closing-reference page" 0 "hasNextPage" \
grep -F "hasNextPage" "$ACTION"
check "action does not suppress GraphQL failure" 1 "" \
grep -E 'gh api graphql.*(\|\| true|\| true)' "$ACTION"
check "composite delegates to the tested entrypoint" 0 "run.sh" \
grep -F 'run: bash "$GITHUB_ACTION_PATH/run.sh"' "$ACTION"
check "workflow wakes on body edits" 0 "types: [opened, edited, reopened, synchronize]" \
grep -F "types: [opened, edited, reopened, synchronize]" "$WORKFLOW"
check "workflow is pull_request-only" 1 "" grep -E '^ (push|pull_request_target|workflow_dispatch):' "$WORKFLOW"
check "workflow is pull_request-only" 1 "" \
grep -E '^ (push|pull_request_target|workflow_dispatch|schedule|issue_comment):' \
"$WORKFLOW"
check "workflow grants read-only pull request access" 0 "pull-requests: read" \
grep -F "pull-requests: read" "$WORKFLOW"