From bf3a360bf7a7edd064119b7517d0d19d07828db2 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:52:06 +0000 Subject: [PATCH] fix(lock): keep relock-standards-pin's original pin match, minus comment lines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Root-cause fix for two Codex findings on #1317. Each narrowing of the pin scan (`^\s*uses:`, then `uses:` after `{`, `,` or space) dropped a YAML form main's unanchored scan found: first one-line flow calls, then quoted keys (`"uses": …@`). The only line that needed excluding was a full-line comment, so standards_pins is now main's match with those lines removed, and nothing else changed. New test case for a quoted key; each earlier version fails the case it missed. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01N6my4F3ohjwFReLW8cYYqC --- scripts/relock-standards-pin.sh | 11 ++++------- scripts/tests/relock-standards-pin-test.sh | 7 +++++++ 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/scripts/relock-standards-pin.sh b/scripts/relock-standards-pin.sh index ecb05431..dd4baa0e 100755 --- a/scripts/relock-standards-pin.sh +++ b/scripts/relock-standards-pin.sh @@ -70,15 +70,12 @@ PIN_RE='hyperpolymath/standards/\.github/workflows/[A-Za-z0-9._-]+\.ya?ml@[0-9a- shopt -s nullglob wfs=("$WF"/*.yml "$WF"/*.yaml) shopt -u nullglob -# standards_pins FILE... — the standards reusable pins that a `uses:` key holds, -# block or flow style (`build: { uses: "…@" }`). Full-line comments are -# skipped: reusables carry commented caller examples (`# uses: …@`) +# standards_pins FILE... — every standards reusable pin in the files, as the +# scan always matched it (block, flow or quoted-key `uses`), except on full-line +# comments: reusables carry commented caller examples (`# uses: …@`) # that no run resolves, and counting them refused every relock of standards' # own callers. -standards_pins() { - grep -hvE '^[[:space:]]*#' "$@" 2>/dev/null \ - | grep -oE "(^|[{,[:space:]])uses:[[:space:]]*['\"]?$PIN_RE" | grep -oE "$PIN_RE" -} +standards_pins() { grep -hvE '^[[:space:]]*#' "$@" 2>/dev/null | grep -oE "$PIN_RE"; } pins=$(standards_pins "${wfs[@]}" | sort -u || true) # A short pin (7+ hex) that prefixes TARGET names TARGET: the applier counts it # FRESH and leaves it as written, and the lock keys it by that short ref in a diff --git a/scripts/tests/relock-standards-pin-test.sh b/scripts/tests/relock-standards-pin-test.sh index 69297451..f0143dd6 100755 --- a/scripts/tests/relock-standards-pin-test.sh +++ b/scripts/tests/relock-standards-pin-test.sh @@ -194,6 +194,13 @@ bash "$RELOCK" --to "$NEW" --standards "$S" "$D" >/dev/null 2>&1 || fail "a flow grep -q "^ - 'hyperpolymath/standards@$NEW'\$" "$D/actions.lock" || fail "flow-style: workflow entry not re-keyed" echo " PASS a flow-style call is counted as a pin" +# A quoted `uses` key is still a pin. +D=$(consumer quoted-key) +printf 'on: push\njobs:\n call:\n "uses": hyperpolymath/standards/.github/workflows/x-reusable.yml@%s\n' "$NEW" > "$D/caller.yml" +bash "$RELOCK" --to "$NEW" --standards "$S" "$D" >/dev/null 2>&1 || fail "a quoted uses key refused the relock" +grep -q "^ - 'hyperpolymath/standards@$NEW'\$" "$D/actions.lock" || fail "quoted key: workflow entry not re-keyed" +echo " PASS a quoted uses key is counted as a pin" + # 3. Refusals leave the lock byte-identical. refuse_case() { # name mutate-command local d; d=$(consumer "$1"); eval "$2"; cp "$d/actions.lock" "$T/before"