cluade-reviewer-andresmgsl
a48cc719a4
All checks were successful
CI / test (pull_request) Successful in 3m9s
CI / release-exercise (pull_request) Successful in 11s
CI / self-guards (pull_request) Successful in 6s
CI / action-exercise (pull_request) Successful in 6s
CI / docs-sync-exercise (pull_request) Successful in 6s
Refs guard / refs-not-closing (pull_request) Has been skipped
labels / labels (pull_request) Successful in 8s
@codex-reviewer-andresmgsl reproduced it again, with one file: scanned_paths()
said "tracked" and used `find`, which walks the working directory and knows
nothing about the index.
Not pedantry — ci.yml extracts shellcheck.tar.xz, actionlint.tar.gz and their
binaries INTO the checkout before the suite runs, and any developer cache sits
there too. Today none happens to carry a matching marker; that is luck, not a
property, and a false red on a downloaded tarball would be indistinguishable
from a real finding.
`git ls-files -z` makes "tracked" executable rather than prose.
The fixtures become tiny git repositories, because a fixture that is only a
directory is invisible to ls-files and every must-fail below it would have
passed vacuously — the same trap as the earlier teeth that never invoked the
guard. Plus the negative case he asked for: an untracked marker-bearing cache
file is ignored, and the moment it is TRACKED the guard sees it.
Reverting discovery to find reds three.
Branch updated from merged main (e236318, now carrying !206) before verifying:
upstream-delta 28/28, test/run.sh 29/29, shellcheck 0.10.0 clean.
Refs #200
48 lines
2.2 KiB
Markdown
48 lines
2.2 KiB
Markdown
### Added
|
|
|
|
- `docs/UPSTREAM-SYNC.md` — the recurring upstream sync as a runbook: the
|
|
standing resolutions, which side wins each and the issue that decided it
|
|
(#200).
|
|
|
|
- It names the step the 0.6.0 sync nearly shipped without: auditing what the
|
|
merge brought in that did **not** conflict. `git merge` asks no question
|
|
about a function upstream added to a file this tree owns (#200).
|
|
|
|
- It records that the same mechanic applies to state, not just to call sites: a
|
|
resolved region can silently remove a producer whose consumers auto-merged,
|
|
and every one of those consumers degrades to empty rather than erroring
|
|
(#200).
|
|
|
|
- It says to verify with the runner's tooling, because "green locally" was
|
|
wrong three times in one sync — untracked files, a pinned linter, and a
|
|
pinned `jq` whose empty-input exit code differs (#200).
|
|
|
|
- It says every branch open across a sync is stale afterwards — Forgejo never
|
|
re-tests an open PR when main moves, so a prior approval is evidence about a
|
|
tree that no longer exists (#200).
|
|
|
|
- It says to audit post-merge runs by executed steps rather than colour, and to
|
|
inventory what the sync changed about workflow triggers and jobs first (#200).
|
|
|
|
- `.upstream-ref` records the upstream commit this tree carries, in
|
|
machine-readable form beside the CHANGELOG's prose (#200).
|
|
|
|
- `test/upstream-delta.test.sh` fails the PR that scatters a forge decision
|
|
into a file the inventory does not name. Discovery is derived from the tree,
|
|
so a composite `action.yml` or a `.yaml` workflow is seen without anyone
|
|
remembering to add a glob (#200).
|
|
|
|
- Discovery is git's, not the filesystem's: `ls-files`, so the tarballs `ci.yml`
|
|
extracts into the checkout and any developer cache are not parsed as source
|
|
(#200).
|
|
|
|
- It refuses when the recorded commit is missing, absent from the object store,
|
|
or not an ancestor — three distinct refusals, none of them a skip. `ci.yml`
|
|
fetches that exact object so the test reads local evidence without CI
|
|
omitting it (#200).
|
|
|
|
- Its mutation cases drive the real check against a constructed tree, so
|
|
replacing the guard with `return 0` reds five of them (#200).
|
|
|
|
- `docs/CONSUMERS.md` states that two ceremonies answer to the same version
|
|
number, and how a consumer says which one it pinned (#200).
|