Skip to content

Fix compiler integration fixtures for action pin linting - #71692

Merged
pelikhan merged 1 commit into
mainfrom
pelikhan-bookish-invention
Oct 24, 2026
Merged

pelikhan merged 1 commit into
mainfrom
pelikhan-bookish-invention

Conversation

@pelikhan

Copy link
Copy Markdown
Collaborator

Default compile linting now correctly rejects mutable action references, causing compiler action-reference and safe-update integration tests to fail on synthetic @v9.9.9 and @v1 fixtures.

  • Opt tests that intentionally exercise synthetic action tags into --allow-action-refs, and verify that omitting the opt-in rejects compilation without emitting a lock file.
  • SHA-pin the custom safe-update action fixture, verify its manifest baseline, and confirm that unchanged recompilation does not request another security review.

Production validation is unchanged. The admission-output needs-consistency warnings were advisory, not the cause of these failures.

Validation

  • Reproduced all four reported failures before the changes.
  • Focused compiler tests and all TestSafeUpdate.* integration tests passed.
  • make fmt and make agent-report-progress passed, including Go lint, impacted tests, and all 348 workflow drift checks.
  • Used an immutable SHA build version for local integration validation to match CI semantics.
Opt synthetic action-tag tests into mutable refs while verifying default rejection. Pin the custom safe-update fixture and verify its manifest baseline and unchanged recompilation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@pelikhan
pelikhan marked this pull request as ready for review October 24, 2026 18:34
Copilot AI max review requested due to automatic review settings October 24, 2026 18:34
@pelikhan
pelikhan merged commit 45143cf into main Oct 24, 2026
33 of 46 checks passed
@pelikhan
pelikhan deleted the pelikhan-bookish-invention branch October 24, 2026 18:34
@github-actions

github-actions Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

@github-actions

github-actions Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · ~6 AIC · ⌖ ~6 AIC · ⊞ 14.8K · ◷

Generated by Ponytail Reviewer for #71692

@github-actions

github-actions Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · sonnet50 · ~13 AIC · ⌖ ~16 AIC · ◇ ~5 AIC · ⊞ 12.7K · ◷

🧪 Test quality analysis by Test Quality Sentinel

@github-actions

github-actions Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

@github-actions

github-actions Bot commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Design Decision Gate 🏗️

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Design Decision Gate 🏗️ · opus55 · ~11 AIC · ⌖ ~32 AIC · ◇ ~15 AIC · ⊞ 1.9K · ◷

🏗️ ADR gate enforced by Design Decision Gate 🏗️

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The test-only changes preserve production validation, with no blocking issues identified.

1 open issue
What changed in this PR

Updates gh-aw compiler integration fixtures to satisfy action-pin linting while preserving production validation.

Changes:

  • Opt synthetic action-tag tests into --allow-action-refs and verify rejection without a lock file when omitted.
  • SHA-pin the safe-update fixture and verify its manifest baseline and unchanged recompilation behavior.
File Description
pkg/​cli/​compile_safe_update_integration_test.go Pins the custom action and checks baseline persistence across recompilation.
pkg/​cli/​compile_integration_test.go Adds explicit action-reference opt-ins and rejection coverage.

Review effort: Max

lockFilePath := filepath.Join(setup.workflowsDir, "test-actions-repo.lock.yml")
if tt.wantError {
if err == nil {
t.Fatal("Compile should reject a mutable action tag without --allow-action-refs")
@github-actions

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.93.4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants