fix(lint): opt in to recoverable workflow-file fixes - #1162
Conversation
✅MegaLinter analysis: Success
See detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
Validation at c7e6404: 20 real-Git patch scenarios pass across both lint workflows, including complete patch replay, additions, deletions, mixed edits, and renames. Signing, strict read-only behavior, mode handling, and credential-boundary regressions pass locally and the relevant GitHub CI jobs pass. Self-review of correctness, simplification, and the permission boundary found no remaining issue in this diff. The local actionlint and Zizmor diagnostics were compared against the unmodified base: 3 existing actionlint compatibility diagnostics and 70 existing low-severity self-repository advisories, with no new findings. GitHub's workflow vulnerability and CodeQL checks passed. CI finished with the macOS setup-ksail-cli job failing on generated Homebrew casks with Missing URL for Intel macOS; the aggregate required check consequently failed. Tracked in #1166 with source and job evidence. This is a deterministic tap-loading error, so it was not blindly rerun. Draft retained and external review deferred until CI is green. Permission rationale: workflow-file writes require separate authority (GitHub documentation); this repair leaves the signer contents-only and offers a complete recoverable patch instead. |
The installer prerequisite #1167 is merged at 9661529. Updated this draft to include that exact repaired base; current head is 2556fcb. All 20 workflow-patch fixtures pass on this updated head. The fixes also compose cleanly with the other Actions drafts. Fresh GitHub CI is running with no observed failures so far. This remains a draft until full current-head CI and a fresh substantive review pass; the old macOS failure is superseded by this new run. |
Validation at 09c05cb against base 065a725: The full current-head CI is green. Re-ran 28 real-Git patch fixtures, including binary payloads and executable mode changes alone and mixed with workflow edits. Replay clones transfer only committed objects, so the artifact must supply the complete result. Removing binary export independently from each production workflow fails with the expected patch-application error. ShellCheck, the combined three-draft CI wiring guard, and patch/trigger regressions pass. The manual artifact path was exercised by applying patches to fresh repositories and comparing resulting Git trees. Self-review found no remaining correctness, simplification, or credential-boundary finding. @coderabbitai full review |
|
|
|
Warning Review limit reachedNext included review available in 39 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Validation at 8c2ebe9 against base d36022b: The full current-head CI is green. Re-ran 28 real-Git patch fixtures, including binary payloads and executable mode changes alone and mixed with workflow edits. Replay clones transfer only committed objects, so the artifact must supply the complete result. Removing binary export independently from each production workflow fails with the expected patch-application error. ShellCheck, the combined three-draft CI wiring guard, and patch/trigger regressions pass. The manual artifact path was exercised by applying patches to fresh repositories and comparing resulting Git trees. Self-review found no remaining correctness, simplification, or credential-boundary finding. @coderabbitai full review |
|
|
cr:no-gate@8c2ebe9 — the current round's CodeRabbit invocation reply explicitly reports Review rate limited after the 16:52:52Z request. Full CI run 34046359052 succeeded at this same head; all eight workflows are terminal, with 116 successful and 86 skipped checks. The current-head 28-case patch recovery and credential/signature checks passed locally and in GitHub CI. @codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8c2ebe979e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
devantler
changed the title
Validation at f31c289 against base d36022b: full current-head CI is green. Both previous Codex findings are fixed with replies and resolved threads. Manual routing and recovery now require the default-off manual-workflow-fixes option; rollout/removal is tracked in #1186. Both states are instantiated in hosted CI. RED reproduced loss of recovery after a lint failure. GREEN covers 3,456 status/input/authority cases and rejects 12 targeted gate mutations. Both production exporters replay 56 real Git fixtures in clean clones, including binary payloads, executable-bit changes, additions, deletions, renames, and mixed fixes. Removing binary payload export fails replay. Signed-fix, credential-boundary, and Go-maintenance regressions pass. The two remaining Actions drafts also pass their combined wiring/recovery/signing contract tests. ShellCheck passes with the existing literal-expression exception; actionlint has only the same three base-version compatibility diagnostics. Zizmor reports only the existing same-repository-call advisory category, including the two added safe CI invocations. No write credential or signer permission was added. Self-review found no remaining correctness, security, or simplification finding. @coderabbitai full review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="devantler-tech/actions"
pr="1162"
echo "== PR metadata =="
gh pr view "$pr" --repo "$repo" --json number,title,baseRefOid,headRefOid,files,commits \
--jq '{number,title,baseRefOid,headRefOid,files:[.files[].path],commits:[.commits[].oid]}'
echo
echo "== Changed-file status =="
gh api "repos/$repo/pulls/$pr/files?per_page=100" --paginate \
--jq '.[] | [.status, .filename, .previous_filename // ""] | `@tsv`'
echo
echo "== Pull request diff =="
gh pr diff "$pr" --repo "$repo" --patch
echo
echo "== Repository workflow and shell file map =="
fd -t f -e yml -e yaml -e sh .github . 2>/dev/null | sort | sed -n '1,300p'
echo
echo "== AST outlines for changed source candidates =="
changed_files="$(gh api "repos/$repo/pulls/$pr/files?per_page=100" --paginate --jq '.[].filename')"
while IFS= read -r file; do
case "$file" in
*.sh|*.bash|*.yml|*.yaml)
if [ -f "$file" ]; then
echo "--- $file ---"
ast-grep outline "$file" --items all 2>&1 || true
fi
;;
esac
done <<< "$changed_files"Length of output: 56767 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== lint workflow: inputs, lint job, and downstream fix consumer =="
nl -ba .github/workflows/lint.yaml | sed -n '1,210p'
rg -n -C 5 'fixes-created|fixes-artifact|apply-signed-fixes|manual-workflow-fixes|upload-artifact' \
.github/workflows/lint.yaml .github/workflows/ci.yaml .github/workflows/validate-go-project.yaml
echo
echo "== Validate Go workflow: inputs, lint job, and signed-fix consumers =="
nl -ba .github/workflows/validate-go-project.yaml | sed -n '1,105p'
nl -ba .github/workflows/validate-go-project.yaml | sed -n '555,745p'
rg -n -C 8 'uses: .*apply-signed-fixes|fixes-created|fixes-artifact|needs\.lint' \
.github/workflows/validate-go-project.yaml .github/workflows/ci.yaml
echo
echo "== All reusable-workflow callers and manual flag occurrences =="
rg -n -C 4 'uses:\s+\./\.github/workflows/(lint|validate-go-project)\.yaml|manual-workflow-fixes' \
-g '*.yml' -g '*.yaml' .
echo
echo "== Recovery-gate test script =="
nl -ba .github/tests/test-lint-recovery-gates.sh | sed -n '1,180p'
echo
echo "== Patch-export test script =="
nl -ba .github/tests/test-lint-workflow-fixes.sh | sed -n '1,180p'
echo
echo "== Existing signer contract test relevant sections =="
nl -ba .github/tests/test-validate-go-signed-fixes-contract.sh | sed -n '1,180p'
echo
echo "== Action upload configuration references =="
rg -n -C 4 'actions/upload-artifact@|path:|if-no-files-found|retention-days' \
.github/workflows/lint.yaml .github/workflows/validate-go-project.yamlLength of output: 1931 🏁 Script executed: #!/bin/bash
set -euo pipefail
numbered() {
awk -v start="$2" -v end="$3" 'NR >= start && NR <= end { printf "%6d %s\n", NR, $0 }' "$1"
}
echo "== lint workflow: inputs, lint job, and downstream fix consumer =="
numbered .github/workflows/lint.yaml 1 210
rg -n -C 5 'fixes-created|fixes-artifact|apply-signed-fixes|manual-workflow-fixes|upload-artifact' \
.github/workflows/lint.yaml .github/workflows/ci.yaml .github/workflows/validate-go-project.yaml || true
echo
echo "== Validate Go workflow: inputs, lint job, and signed-fix consumers =="
numbered .github/workflows/validate-go-project.yaml 1 105
numbered .github/workflows/validate-go-project.yaml 555 745
rg -n -C 8 'uses: .*apply-signed-fixes|fixes-created|fixes-artifact|needs\.lint' \
.github/workflows/validate-go-project.yaml .github/workflows/ci.yaml || true
echo
echo "== All reusable-workflow callers and manual flag occurrences =="
rg -n -C 4 'uses:\s+\./\.github/workflows/(lint|validate-go-project)\.yaml|manual-workflow-fixes' \
-g '*.yml' -g '*.yaml' . || true
echo
echo "== Recovery-gate test script =="
numbered .github/tests/test-lint-recovery-gates.sh 1 180
echo
echo "== Patch-export test script =="
numbered .github/tests/test-lint-workflow-fixes.sh 1 180
echo
echo "== Existing signer contract test relevant sections =="
numbered .github/tests/test-validate-go-signed-fixes-contract.sh 1 180
echo
echo "== Action upload configuration references =="
rg -n -C 4 'actions/upload-artifact@|path:|if-no-files-found|retention-days' \
.github/workflows/lint.yaml .github/workflows/validate-go-project.yaml || trueLength of output: 148633 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="devantler-tech/actions"
pr="1162"
base="d36022bf2f4e01d16e8f8b540231e9338252bc1d"
echo "== Current PR check status =="
gh pr checks "$pr" --repo "$repo" --required=false || true
echo
echo "== Workflow YAML parse results =="
for file in .github/workflows/ci.yaml .github/workflows/lint.yaml .github/workflows/validate-go-project.yaml; do
printf '%s: ' "$file"
yq -e '.' "$file" >/dev/null
echo "valid"
done
echo
echo "== Diff whitespace check =="
git diff --check "$base"...HEAD
echo
echo "== Head and base verification =="
printf 'HEAD: '
git rev-parse HEAD
printf 'Merge base: '
git merge-base "$base" HEAD
echo
echo "== Changed-file modes =="
git diff --summary "$base"...HEADLength of output: 33066
I verified the workflow recovery gates, artifact routing, signer boundary, and regression coverage. The exporters retain complete binary patches. Opted-in workflow-file patches do not reach the automatic signer. Failed lint runs can upload an opted-in recovery patch. Cancelled runs do not recover patches.
You are interacting with an AI system. |
Ready at f31c289 against base d36022b: all 120 applicable checks passed (99 intentional skips). CodeRabbit completed a substantive full review of this exact head in #1162 (comment), with no blocking issue or actionable finding. Both earlier Codex findings have concrete fixes, regression coverage, replies, and resolved threads. User-path validation replayed all 56 complete patch fixtures in clean clones. The 3,456 status/authority cases, 12 gate mutations, both hosted flag-state calls, and existing signing/credential regressions passed. Full CI: https://github.com/devantler-tech/actions/actions/runs/34048298168 . The recovery option remains default-off with consumer rollout/removal tracked in #1186. Self-review is complete. Promoting for final merge preflight. |
1 participant
Formatter changes to GitHub workflow files cannot be committed by the contents-only signer, leaving contributors without a usable fix. Both lint workflows now offer a default-off
manual-workflow-fixesoption that retains the complete patch for manual application, including when linting also reports an unfixable error. Related edits and renames stay together, ordinary fixes retain their existing route, and lint failures still block the run. Consumer rollout and flag removal are tracked in #1186.Fixes #703