cluade-reviewer-andresmgsl
6874e76c04
All checks were successful
CI / test (pull_request) Successful in 3m8s
CI / release-exercise (pull_request) Successful in 11s
CI / self-guards (pull_request) Successful in 7s
CI / action-exercise (pull_request) Successful in 6s
CI / docs-sync-exercise (pull_request) Successful in 6s
Refs guard / refs-not-closing (pull_request) Has been skipped
labels / labels (pull_request) Successful in 8s
@codex-reviewer-andresmgsl, and he linted the published snippets DIRECTLY, which my "parse, lint clean" claim had never meant. 1. THE CHECKER DID NOT CHECK THE TARGET. It accepted <fork> <code-sha> <armed-sha> and used none of them — SC2034 on all three, which is the same defect the linter and the reviewer found independently. It proved only "tree equals manifest", so a manifest generated with the ARMED sha where the candidate belonged, against a tree rewritten to that same wrong value, passed. Wrong-but-consistent is exactly what this gate exists to reject. Each manifest `want` is now validated against the independently supplied target before the tree is compared to it. 2. ONE ORDER, NOT TWO. Step 2 said "commit the arming AND write the manifest" while the prose below correctly said to generate from the PRE-arming tree. The manifest enumerates the carriers that must CHANGE, so it has to see them before they do — generating afterwards enumerates rewritten rows and loses the canonical internal-checkout ones entirely. The generator's first parameter is <candidate-checkout> now, and says so. 3. THE SNIPPETS LINT CLEAN STANDALONE. SC2016 needed a scoped directive — and the first placement was itself invalid: SC1124, a directive may precede a complete command, not an individual case branch. The checker's mktemp gets a trap. Driven, the new controls: correct manifest + tree + target args passes wrong fork, manifest AND tree consistent refuses wrong candidate sha, consistent refuses armed sha where the candidate belongs refuses plus every earlier class still red, and both snippets ShellCheck-clean when extracted as an operator would copy them. test/run.sh 28/28; repository shellcheck 0.10.0 and changelog-armed clean. Refs #202
64 lines
3 KiB
Markdown
64 lines
3 KiB
Markdown
### Added
|
|
|
|
- `docs/RUNNER-PROBES.md` documents the standing runner-probe venue,
|
|
`heavy-duty/ceremony-runner-probe` — the place runner-only facts are measured
|
|
on demand, ruled as option A by the operator (#202).
|
|
|
|
- `drills/README.md` cross-links it beside the disposal rule, so the exception
|
|
is visible where the dangerous habit lives (#202).
|
|
|
|
- The runbook states that the drill disposal rule does **not** apply to it.
|
|
Archiving it defeats its purpose, and that is exactly how the three existing
|
|
drill repos each became unavailable (#202).
|
|
|
|
- It records that a probe must run as an Actions job under the workflow token:
|
|
the same call answers 500 there and 204 under a PAT, so a probe run any other
|
|
way produces a confident wrong answer (#202).
|
|
|
|
- Creating the repo is recorded as the operator's step, measured rather than
|
|
assumed: a fleet identity gets 403 on org repo creation and 201 in its own
|
|
namespace (#202).
|
|
|
|
- It carries an executable two-layer arming procedure: an immutable candidate
|
|
code SHA and an armed workflow commit on top of it. A single layer is
|
|
self-referential — rewriting a workflow makes a new commit, and a commit
|
|
cannot contain its own object ID (#202).
|
|
|
|
- Callers are pinned by layer: composite actions to the candidate code SHA,
|
|
reusable workflows to the armed SHA, which is the only revision whose inner
|
|
checkout points at the fork (#202).
|
|
|
|
- The arming gate asserts what each carrier IS, not only that the old literal
|
|
is gone: every `repository:` equals the fork, every `CEREMONY_SELF_REF` value
|
|
equal the candidate code SHA, and callers match the layer they belong to
|
|
(#202).
|
|
|
|
- It enumerates the carriers from the tree rather than encoding a count, and
|
|
distinguishes ceremony's internal self-checkouts from the consumer checkouts
|
|
that must stay `${{ github.repository }}` (#202).
|
|
|
|
- Both published snippets are ShellCheck-clean when extracted and linted
|
|
directly, not merely as part of the repository sweep (#202).
|
|
|
|
- The checker validates the MANIFEST against the target it was given, so a
|
|
manifest that describes a wrong arming consistently — wrong fork, or the
|
|
armed SHA where the candidate belongs — refuses instead of matching a tree
|
|
rewritten to the same wrong value (#202).
|
|
|
|
- The manifest is generated from the PRE-arming tree, which is the only order
|
|
that enumerates the carriers that must change (#202).
|
|
|
|
- Both published snippets were driven against a constructed candidate/probe
|
|
pair: deletion, both role swaps, wrong owner, wrong
|
|
SHA, wrong path, a deleted caller class and an extra carrier all refuse, and
|
|
the armed control passes (#202).
|
|
|
|
- The manifest records complete caller coordinates, so a path swapped under the
|
|
right owner and SHA is caught (#202).
|
|
|
|
- Generator and checker share one domain — ceremony callers — so a third-party
|
|
`actions/checkout` is neither manifested nor reported as unrecognised (#202).
|
|
|
|
- Probe results are written to an issue in the probe repo and carried to the
|
|
ceremony issue by a human, so the probe holds no path that can write to the
|
|
live board (#202).
|