Skip to content

fix: fetch native gate comparison revisions #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kazukinakai merged 6 commits into from
Jul 24, 2026
Merged

fix: fetch native gate comparison revisions #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
13d2252
fix: fetch gate comparison revisions before source checkout
kazukinakai Jul 24, 2026
aaea857
security: pin gate caller to comparison fetch fix
kazukinakai Jul 24, 2026
c088ff9
fix: mark container workspace safe for revision fetch
kazukinakai Jul 24, 2026
e56b795
security: pin caller to container-safe fetch fix
kazukinakai Jul 24, 2026
0a4e9e2
fix: trust exact workspace inside gate container
kazukinakai Jul 24, 2026
1c50cf3
security: pin caller to container trust fix
kazukinakai Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/org-quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ permissions:
jobs:
quality-gate:
name: quality-gate
uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@16a8f9b0b224c8e1483afac86ea9a00636d777d0
uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b
with:
source-ref: 16a8f9b0b224c8e1483afac86ea9a00636d777d0
source-ref: 0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b
linux-runs-on: ${{ github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
swift-runs-on: macos-latest
13 changes: 13 additions & 0 deletions .github/workflows/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,19 @@ jobs:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
fetch-depth: 0
- name: Fetch gate comparison revisions
shell: bash
env:
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
HEAD_SHA: ${{ github.sha }}
run: |
set -euo pipefail
if [[ ! "$BASE_SHA" =~ ^[0-9a-f]{40}$ || ! "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
echo 'Unable to resolve gate comparison revisions.' >&2
exit 1
fi
git config --global --add safe.directory "$GITHUB_WORKSPACE"
git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
- name: Check out quality gate implementation
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
Expand Down
12 changes: 12 additions & 0 deletions tests/test_workflow_wiring.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@ def test_quality_gate_resolves_source_once_and_never_checks_out_main(self) -> No
self.assertIn("source_sha", source)
self.assertRegex(source, r"ref:\s*\$\{\{[^}]*source_sha[^}]*\}\}")

def test_comparison_revisions_are_fetched_before_source_checkout(self) -> None:
source = QUALITY_GATE.read_text()
fetch_index = source.index("name: Fetch gate comparison revisions")
source_checkout_index = source.index("name: Check out quality gate implementation")

self.assertLess(fetch_index, source_checkout_index)
self.assertIn(
'git config --global --add safe.directory "$GITHUB_WORKSPACE"',
source,
)
self.assertIn('git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"', source)

def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None:
source = ORG_CALLER.read_text()
self.assertRegex(source, r"(?m)^\s*actions:\s*read\s*$")
Expand Down