diff --git a/scripts/relock-standards-pin.sh b/scripts/relock-standards-pin.sh index ecb05431..dd4baa0e 100755 --- a/scripts/relock-standards-pin.sh +++ b/scripts/relock-standards-pin.sh @@ -70,15 +70,12 @@ PIN_RE='hyperpolymath/standards/\.github/workflows/[A-Za-z0-9._-]+\.ya?ml@[0-9a- shopt -s nullglob wfs=("$WF"/*.yml "$WF"/*.yaml) shopt -u nullglob -# standards_pins FILE... — the standards reusable pins that a `uses:` key holds, -# block or flow style (`build: { uses: "…@" }`). Full-line comments are -# skipped: reusables carry commented caller examples (`# uses: …@`) +# standards_pins FILE... — every standards reusable pin in the files, as the +# scan always matched it (block, flow or quoted-key `uses`), except on full-line +# comments: reusables carry commented caller examples (`# uses: …@`) # that no run resolves, and counting them refused every relock of standards' # own callers. -standards_pins() { - grep -hvE '^[[:space:]]*#' "$@" 2>/dev/null \ - | grep -oE "(^|[{,[:space:]])uses:[[:space:]]*['\"]?$PIN_RE" | grep -oE "$PIN_RE" -} +standards_pins() { grep -hvE '^[[:space:]]*#' "$@" 2>/dev/null | grep -oE "$PIN_RE"; } pins=$(standards_pins "${wfs[@]}" | sort -u || true) # A short pin (7+ hex) that prefixes TARGET names TARGET: the applier counts it # FRESH and leaves it as written, and the lock keys it by that short ref in a diff --git a/scripts/tests/relock-standards-pin-test.sh b/scripts/tests/relock-standards-pin-test.sh index 69297451..f0143dd6 100755 --- a/scripts/tests/relock-standards-pin-test.sh +++ b/scripts/tests/relock-standards-pin-test.sh @@ -194,6 +194,13 @@ bash "$RELOCK" --to "$NEW" --standards "$S" "$D" >/dev/null 2>&1 || fail "a flow grep -q "^ - 'hyperpolymath/standards@$NEW'\$" "$D/actions.lock" || fail "flow-style: workflow entry not re-keyed" echo " PASS a flow-style call is counted as a pin" +# A quoted `uses` key is still a pin. +D=$(consumer quoted-key) +printf 'on: push\njobs:\n call:\n "uses": hyperpolymath/standards/.github/workflows/x-reusable.yml@%s\n' "$NEW" > "$D/caller.yml" +bash "$RELOCK" --to "$NEW" --standards "$S" "$D" >/dev/null 2>&1 || fail "a quoted uses key refused the relock" +grep -q "^ - 'hyperpolymath/standards@$NEW'\$" "$D/actions.lock" || fail "quoted key: workflow entry not re-keyed" +echo " PASS a quoted uses key is counted as a pin" + # 3. Refusals leave the lock byte-identical. refuse_case() { # name mutate-command local d; d=$(consumer "$1"); eval "$2"; cp "$d/actions.lock" "$T/before"