Repository navigation
test(deonboard): pin the de-onboard script to the lockfile schemas it is tested on - #53
Merged
Merged
Conversation
… is tested on
gh-actions-lock v0.2.0 upgrades actions.lock from schema v0.0.2 to v0.0.3
on its next relock. Only a hand check showed that
scripts/deonboard-estate-audit.sh still worked on v0.0.3. This makes the
check permanent.
- scripts/deonboard-estate-audit.sh fails closed (exit 3, lock untouched)
on any schema not in known_versions ("v0.0.2 v0.0.3"), so a future
schema is a loud error rather than a silent edit across the estate.
- tests/deonboard-lock-schemas.sh needs one fixture per known version.
It de-onboards every fixture and requires: pure removals, the version
line kept, every reference resolving, no orphans, idempotence, and the
same keys pruned in every schema. Negative controls: an untested schema
is refused, and a mutant that skips the prune fails the orphan check.
- tests/fixtures/actions-lock/: marches' pre-de-onboard lock (e2f71fe)
as v0.0.2 verbatim, as v0.0.3 the way gh-actions-lock writes it on
github.com, and as v0.0.3 with the optional per-dependency hostname.
- Runs in "Composite shell contract", which now also triggers on
scripts/**. No new uses:, so actions.lock is unchanged.
Schema facts come from github/actions-lockfile's own JSON schemas: v0.0.3
differs from v0.0.2 only in the version const and an optional
per-dependency hostname, omitted for home-host pins. All three fixtures
parse with the canonical parser (github.com/github/actions-lockfile/go
v0.0.6, the one gh-actions-lock v0.2.0 uses), before and after
de-onboarding. That parser rejects v0.0.2 with hostname, an unknown field,
and a future version.
Verified: deonboard-lock-schemas.sh PASS=33 FAIL=0; it fails on a mutant
with no version guard (2 FAIL) and on one claiming v0.0.4 without a
fixture (1 FAIL); composite-shell-contract PASS=28; lock-transitive-closure
PASS=8; actionlint shows no new findings on code-hygiene-self-test.yml.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 16 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
marked this pull request as ready for review
October 14, 2026 13:42
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
hyperpolymath
added a commit
that referenced
this pull request
Oct 19, 2026
… the schema guard and the case fix (#56) ## What was wrong `scripts/deonboard-workflow.sh` (#54) is a copy of the estate-audit de-onboard script, taken before #52 and #53 landed. It has neither fix: 1. **No schema guard.** It accepts any `actions.lock` schema. On a `v9.9.9` lock it exits 0 and edits the lock. #53's fail-closed guard (exit 3) lives only in `deonboard-estate-audit.sh`. 2. **Case-sensitive prune.** It compares dependency keys byte for byte. Take a lock where the `hyperpolymath/standards` record reaches `swatinem/rust-cache@6323deb…` but the record key is `Swatinem/rust-cache@6323deb…`. The script prunes that record and leaves a dangling edge, which startup-fails the run. This is the januskey shape #52 fixed, but only in the estate-audit copy. **Who was exposed:** `rollout_language_gates.sh` de-onboards every Rust CI, Creusot, SPARK and miniKanren caller through `deonboard-workflow.sh`. Rust CI callers are exactly the repositories whose locks carry the `standards` → `rust-cache` edge. As far as this session knows, no rollout has run since #54 merged, so this is a latent defect rather than a broken estate. That is ASSUMED: I have no rollout logs. The `deonboard-workflow.sh` header and README line 273 on main already said the estate-audit script "now delegates" to it. It did not; it was a second copy. ## The change - **`scripts/deonboard-workflow.sh`** is now the one implementation. It carries #53's `known_versions` guard and #52's `lower_repo` prune, with their comments carried over verbatim. - **`scripts/deonboard-estate-audit.sh`** is now just a usage check and one `exec …/deonboard-workflow.sh "$repo" .github/workflows/main-estate-audit.yml`. `rollout_estate.sh`, the templates and the README keep working through it unchanged. - **`tests/deonboard-lock-schemas.sh`**: - It reads `known_versions` from the generic script. - Every fixture and the v9.9.9 control run through both entry points. - The prune-skipping mutant is applied to the generic script and must be killed through the wrapper as well, which fails if the wrapper ever stops delegating. - The optional argument is now a scripts directory. - **`tests/deonboard-estate-audit.sh`** (#52): - Both entry points run the same checks. - The two entry points must produce byte-identical locks. - The `| lower_repo` mutant is applied to the generic script and must be killed through both. - **CI** (`code-hygiene-self-test.yml`): - `tests/deonboard-estate-audit.sh` was never run in CI. It now runs in the Composite shell contract job. - The workflow also triggers on `scripts/deonboard-workflow.sh`. - No `uses:` added. - **Docs:** README and ARCHITECTURE now describe the delegation as it is. - **Ported from #55:** `3325927` is #55's repin, cherry-picked with `-x`; the diff is byte-identical. - **Why:** main's `lock-transitive-closure` failure would otherwise stop the Composite shell contract job before the de-onboard steps run. - **If #55 merges first:** this commit becomes a no-op. ## Evidence (TESTED) I copied the new suites into a tree of `origin/main` (`9a947fa`) and ran them against main's scripts. `tests/deonboard-estate-audit.sh`: PASS=14 FAIL=4 - `FAIL pruned Swatinem/rust-cache, which the standards record still reaches` - `FAIL dangling edge(s): Swatinem/rust-cache@6323deb` - `FAIL the entry points disagree: …` - `FAIL mutant is identical to the script: the case-folding the test exists for is gone` `tests/deonboard-lock-schemas.sh`: PASS=57 FAIL=4 - `FAIL script declares no known_versions` - `FAIL exit 0 on schema v9.9.9 (want 3)` - `FAIL lock modified despite refusal` - `FAIL orphan check passed a mutant that does not prune` (main's wrapper does not delegate) On this branch: | Check | Result | | --- | --- | | `tests/deonboard-estate-audit.sh` | PASS=19 FAIL=0 | | `tests/deonboard-lock-schemas.sh` | PASS=63 FAIL=0 | | `tests/lock-transitive-closure.sh` | PASS=31 FAIL=0 | | `tests/composite-shell-contract.sh` | PASS=28 FAIL=0 | | `bash -n` | clean | | `shellcheck -S warning` | clean (default severity: same SC2015/SC2016 counts as main) | | `actionlint` | no new findings (the 8 `"$/actions/…"` findings in the hygiene self-test are also on main) | 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #50.
Why
gh-actions-lock v0.2.0 upgrades
actions.lockfrom schema v0.0.2 to v0.0.3 on its next relock; marches' first Actions lock run loggedUpgraded lockfile schema v0.0.2 → v0.0.3.scripts/deonboard-estate-audit.shedits those lockfiles. Until now, only a hand check showed it still works on v0.0.3. This PR makes that check permanent, so a future v0.0.4 is caught automatically.What v0.0.3 changes
github/actions-lockfile's own JSON schemas (
schema/lockfile-v0.0.2.jsonvslockfile-v0.0.3.json) differ in only two places:versionconst;hostname, which is omitted for home-host pins and so never written on github.com.workflows,dependencies,ref,commit,owner_id,repo_idandusesare unchanged.Changes
scripts/deonboard-estate-audit.shfails closed:exit 3, lock untouched, on any schema not inknown_versions="v0.0.2 v0.0.3". A repository where the audit isn't onboarded still gets a no-op, because the check comes right before the first write.tests/deonboard-lock-schemas.shv9.9.9) is refused with the lock untouched, and a mutant that skips the prune fails the orphan check.tests/fixtures/actions-lock/holds marches' lock from before de-onboarding (e2f71fe) in three forms:hostnameon two dependencies, one that gets pruned and one that is kept.Composite shell contract, which now also triggers onscripts/**. There is no newuses:, soactions.lockis unchanged.Verification
tests/deonboard-lock-schemas.sh: PASS=33 FAIL=0.github.com/github/actions-lockfile/gov0.0.6, the one gh-actions-lock v0.2.0 uses. That parser rejects v0.0.2 withhostname, an unknown field, and a future version, so it is a real check. CI doesn't run it, because it would need Go; the test covers the structural properties in bash.composite-shell-contract.sh: PASS=28.lock-transitive-closure.sh: PASS=8.code-hygiene-self-test.yml; the 5$/actionsfindings are already on main.🤖 Generated with Claude Code
https://claude.ai/code/session_01VTeVWDEJgdYKsUNr4uhnXX
Generated by Claude Code