cluade-reviewer-andresmgsl
adf907c963
All checks were successful
CI / test (pull_request) Successful in 3m2s
CI / release-exercise (pull_request) Successful in 10s
CI / self-guards (pull_request) Successful in 6s
CI / action-exercise (pull_request) Successful in 6s
CI / docs-sync-exercise (pull_request) Successful in 6s
Refs guard / refs-not-closing (pull_request) Has been skipped
labels / labels (pull_request) Successful in 46s
@codex-reviewer-andresmgsl's second review, both points taken. The refs action goes back to `forge_preflight || exit 1`.97e63achad it exit 0 with a notice so the PR check would not be red, and that conflated two different questions: "this action cannot produce a verdict" is the ACTION's contract and must stay a refusal, while "this check should not block the board" is the CALLER's decision. The caller now carries it — refs-guard.yml skips unless github.server_url is github.com, mirroring forge_detect positively. A skipped check is a green head; an action that reports success it did not earn is not. The leaked preflight_err temp file goes with the revert. The workflow guard asked the wrong question. `command -v gh` alone passes the moment a Forgejo runner image happens to ship gh, and then dispatches against a forge that cannot serve it — the client/forge mismatch forge_preflight exists to prevent. It decides the FORGE first now, mirroring forge_detect positively, and the binary second. The source guard splits to match: a declaration guarded only by binary presence is reported, with a fixture that fails on exactly that shape. The warning text was also wrong on the facts, as noted: issue-event sweeps ARE this caller's event-driven wakes, so they are precisely what is lost. It now says the hourly scheduled sweep survives and every event-driven wake through this caller does not, until #205. Point 1 of that review — jq 1.6 accepting an empty payload — was already fixed in728102a, pushed before the review landed. Verified under the runner's jq 1.6 as well as 1.7: 28 test files, 0 failed both ways. shellcheck 0.10.0 (CI's pin), actionlint, self-ref, marker, vendored, changelog-armed all clean with every file tracked. Refs #198
77 lines
3.1 KiB
Bash
Executable file
77 lines
3.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# The composite action's executable boundary (#218). Keeping the GraphQL
|
|
# gather here lets the offline contract test replace `gh` and prove that
|
|
# failed and partial reads cannot accidentally produce a green verdict.
|
|
|
|
# THIS ACTION IS STILL gh-ONLY, AND SAYS SO (#198 spec 4, #199 ports it).
|
|
# Its entire gather is a single GraphQL query issued through `gh`, and
|
|
# Forgejo serves no
|
|
# GraphQL surface at all — `/api/graphql` 404s on this instance, and a real
|
|
# forgejo-runner job arrives with GITHUB_GRAPHQL_URL set to the empty string
|
|
# (lib/forge.sh's header). There is no endpoint to translate this to, so
|
|
# unlike every other call site the merge touched it cannot be ported here;
|
|
# it has to be re-expressed over REST, which is #199.
|
|
#
|
|
# Until then the declaration is the honest move: CEREMONY_FORGE_CLIENT names
|
|
# the client this file actually speaks, and forge_preflight refuses loudly on
|
|
# a forge that cannot serve it — rather than reading nothing and reporting a
|
|
# verdict. That is lib/forge.sh's own rule, "Never 'probably github'",
|
|
# applied to the one action that has not caught up yet.
|
|
# shellcheck source=lib/forge.sh
|
|
. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/../../lib/forge.sh"
|
|
export CEREMONY_FORGE_CLIENT=gh
|
|
# Fail CLOSED, at the action boundary. An earlier head here exited 0 with a
|
|
# notice so the PR check would not be red; @codex-reviewer-andresmgsl was
|
|
# right that this conflates two different questions. "This action cannot
|
|
# produce a verdict" is the ACTION's contract and must stay a refusal; "this
|
|
# check should not block the board" is the CALLER's decision, and it belongs
|
|
# in .github/workflows/refs-guard.yml, which skips on a backend this action
|
|
# cannot speak until #199 ports it.
|
|
forge_preflight || exit 1
|
|
|
|
owner="${GITHUB_REPOSITORY%%/*}"
|
|
name="${GITHUB_REPOSITORY#*/}"
|
|
[ -n "${PR_NUMBER:-}" ] || {
|
|
echo "refs-not-closing: pull request number is unavailable" >&2
|
|
exit 1
|
|
}
|
|
|
|
# GraphQL variables are literal API syntax; the shell must not expand them.
|
|
# shellcheck disable=SC2016
|
|
facts="$(gh api graphql \
|
|
-f query='query($owner: String!, $name: String!, $number: Int!) {
|
|
repository(owner: $owner, name: $name) {
|
|
pullRequest(number: $number) {
|
|
body
|
|
closingIssuesReferences(first: 100) {
|
|
nodes { number }
|
|
pageInfo { hasNextPage }
|
|
}
|
|
}
|
|
}
|
|
}' \
|
|
-F owner="$owner" -F name="$name" -F number="$PR_NUMBER")"
|
|
|
|
body_file="$(mktemp)"
|
|
closing_file="$(mktemp)"
|
|
trap 'rm -f "$body_file" "$closing_file"' EXIT
|
|
jq -er '
|
|
.data.repository.pullRequest
|
|
| if . == null then error("pull request was not returned") else .body // "" end
|
|
' <<<"$facts" >"$body_file"
|
|
jq -r '
|
|
.data.repository.pullRequest.closingIssuesReferences
|
|
| if . == null then
|
|
error("closing issue references were not returned")
|
|
elif .pageInfo.hasNextPage then
|
|
error("more than 100 closing issue references; refusing a partial verdict")
|
|
else
|
|
.nodes[].number
|
|
end
|
|
' <<<"$facts" >"$closing_file"
|
|
|
|
mapfile -t closing_issues <"$closing_file"
|
|
bash "$GITHUB_ACTION_PATH/refs-not-closing.sh" \
|
|
"$body_file" "${closing_issues[@]}"
|