From af24213b83f5c45fee24ab1451bfe3e4cd673292 Mon Sep 17 00:00:00 2001
From: Nazz <nazim.mj@gmail.com>
Date: Sat, 25 Jul 2026 12:52:59 -0500
Subject: [PATCH] ci: fix sealed-runtime provenance tests by fetching full
 history; harden workflow

The first CI run on main failed 7 provenance/replay tests with
'fatal: ambiguous argument 8488cb3^{tree}: unknown revision'.

Root cause: actions/checkout defaults to a shallow single-branch clone.
The replay and provenance suites verify the sealed exam runtime by reading
its exact Git objects at commit 8488cb3, which is reachable only through
the full ref graph. Reproduced locally: 'git clone --depth 1 --single-branch'
yields 1 commit, main only, and the frozen commit is unreachable.

Fixes it with fetch-depth: 0 and a comment explaining why it is load-bearing,
so it does not get optimised away later.

Also hardens the workflow while here:
- permissions: contents: read (least privilege)
- node matrix 18/20/22, proving the engines.node >= 18 claim in package.json
  rather than asserting it
- runs npm run bench alongside npm test

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d7aa077..ef4938c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,12 +2,21 @@
 #
 # CONTRIBUTING.md states: "There is no hidden CI magic yet: the suite you run
 # locally is the gate." This workflow runs that exact same gate on GitHub's
-# Linux runner (ubuntu-latest) so every push/PR proves the suite is green
-# before review — no behavior change, no new dependencies, no core code touched.
+# Linux runner so every push/PR proves the suite is green before review.
 #
-# Note: the exam/replay/label-corpus suites require Linux (/proc/self/fd +
-# O_NOFOLLOW) and are exercised on the same Linux host class here, so CI
-# reflects what contributors already run locally on supported platforms.
+# Two constraints this file has to respect:
+#
+#   1. fetch-depth: 0 is LOAD-BEARING. The replay/provenance suites verify the
+#      sealed exam runtime by reading its exact Git objects at commit 8488cb3
+#      (see docs/EXAM.md). That commit is reachable only through the full ref
+#      graph. actions/checkout defaults to a shallow, single-branch clone, which
+#      resolves to one commit with no other refs, so `git rev-parse 8488cb3^{tree}`
+#      fails and 7 provenance tests fail with "unknown revision". Do not
+#      "optimise" this back to a shallow clone.
+#
+#   2. The corpus labeling harness (scripts/label-corpus.js) hard-requires Linux
+#      (/proc/self/fd + O_NOFOLLOW), so the matrix stays on ubuntu-latest. The
+#      router, the Claude Code hooks and `npm run bench` are platform-independent.
 
 name: CI
 
@@ -16,18 +25,29 @@ on:
     branches: [main]
   pull_request:
 
+# Least privilege: this workflow only ever reads the repository.
+permissions:
+  contents: read
+
 jobs:
   test:
-    name: npm test
+    name: npm test (node ${{ matrix.node }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # package.json declares engines.node >= 18. Prove it rather than assert it.
+        node: [18, 20, 22]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # required: sealed-runtime provenance tests read Git objects at 8488cb3
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: ${{ matrix.node }}
           cache: npm
 
       - name: Install dependencies
@@ -35,3 +55,6 @@ jobs:
 
       - name: Run test suite
         run: npm test
+
+      - name: Run frozen benchmark
+        run: npm run bench