Repository navigation
fix(ci): restore canonical standards closure evidence after fleet owner migration - #639
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
SITREP after latest-head CI, 2026-11-01:
|
|
Follow-up on current head after the prepared-migration preflight failure: The bounded secret-scanner replacement is already applied in the live caller and lockfile, while the prepared patch series still targets the older layout. The old preflight attempted to reapply its obsolete patches and gave FINDINGS, even though the intended caller, pinned dependency and scanner were present. Signed commit Planted controls: isolated WSL positive applied state exits |
|
|
Latest-head CI verification: Gitbot Fleet PR #639 commit |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 25f6d242b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if [ -f "$TMP/tree/.github/workflows/secret-scanner.yml" ] && | ||
| grep -Fq "uses: $CALLEE" "$TMP/tree/.github/workflows/secret-scanner.yml"; then | ||
| already_applied=1 |
There was a problem hiding this comment.
When the checkout already contains the migrated caller, this branch skips all patch application, but scripts/tests/secret-scanner-migration-test.sh still mutates those patches to test unsafe configurations and later applies them to its copied tree. Running that dedicated test now produces three false passes (fast-pr, secret inheritance, and permissions are not rejected) before aborting when the already-applied patches fail, so the migration contract suite can no longer complete. Update the test fixture to start from the prepared pre-migration state, or otherwise let it explicitly exercise the patch path.
Useful? React with 👍 / 👎.
## Problem The shared Idris dependent scanner test fixture no longer initializes `Mock.responses`. Rust rejects the integration test with E0063 at `tests/scan_tests.rs:352`, so all-target compilation and the following tests cannot run. The same defect is present on current main and blocks dependency PRs #633–#637. Actual failure: [job 124701176251](https://github.com/hyperpolymath/gitbot-fleet/actions/runs/41256667603/job/124701176251), with the same current-main failure in job 124813337915. ## Change Initialize the existing response override map with `BTreeMap::new()` in `ready_mock`. This is one source line; the real transport, assertions, dependency locks and vendored bot sources are unchanged. ## Verification The source and exact Git blob were inspected, and the one-line diff was read back. No local Rust execution is claimed. The existing `idris-dependents` hosted matrix must qualify this revision using its locked all-target build, tests, Clippy and formatting gates. The older E2E closure defect has a separate fix already on main (#639). Echidnabot's vendored source pin, existing governance/security findings and dependency updates need their own verified dispositions; this PR does not suppress them. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Tests** * Updated automated test setup to allow tests to provide custom mock responses while retaining the existing default mock behavior. This change affects test coverage and does not alter functionality available in the application. <!-- end of auto-generated comment: release notes by coderabbit.ai --> ## Hosted follow-up The da53 hosted locked build passed the original missing-field failure, then the existing edge-case suite exposed two stale assertions in job126927683205/run41931039453. Current412bcad784dd16193475a09ecfa614147dc6fa51 keeps hard-error rejection by using HTTP500 for that fixture (404 is intentionally recorded as a skipped URL), and includes the already public skippedUrls field in the exact JSON assertion. Existing scan_tests already exercises both raw paths for skipped404/410/451 and hard401/403/422/429/500/503; production behavior is unchanged. Current412 requires its own full hosted result. Separate governance failures—canonical action allowlist, retained Python audit/test implementations and the older scanner/native-lock contract—remain open and are not waived by this test repair. The vendored Echidnabot dependency PR also needs its upstream source closure resolved independently.
Immediate cause
PR #638 changed the canonical standards workflow owner and
actions.locktometadatastician/standards, but was merged while its latest-head E2E lock-closure gate was red. The pre-existing review receipts inscripts/lib/lock-closure-receipts.tsvstill saidhyperpolymath/standards. The E2E failure also reported a distinctNOT-RUN CLOSURE-NO-RECEIPTforhyperpolymath/cicd-suite@4404c3c....Fix
uses:edge.hyperpolymath/cicd-suite@4404c3c0474e17753fe7689f3485c02890aac113from the actual pinned.github/workflows/secret-scanner-reusable.ymlsource, which names onlyactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1(twice; receipt deduplicates it). This is not fabricated evidence.Local evidence
After applying this single receipt file to the canary tree,
bash scripts/tests/lock-closure-test.shin a trusted scratch directory: 47 passed, 0 failed. The prior state was 45 passed, 2 failed. This fixes the exact observed Gate failure on #638.Signed GitHub-verified commit
72111863642438f3eb3d94e2e47f967d0cbe8bb7.Draft until final hosted CI succeeds. No estate-wide rollout, notification archive operations, or merges are done by this PR.
Summary by CodeRabbit