Skip to content

fix(ci): trailer-verify binds to the PR tip, not any ancestor (#2399) #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
forkwright merged 1 commit into from
Jul 25, 2026
Merged

fix(ci): trailer-verify binds to the PR tip, not any ancestor (#2399) #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 13 additions & 16 deletions .github/workflows/gate-attestation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,22 +38,19 @@ jobs:

- name: Verify Gate-Passed trailer
if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'release-please[bot]' && !startsWith(github.head_ref, 'release-please--branches--') }}
# WHY (#2399): bind to the PR TIP, not "any PR commit". The old loop
# passed if any ancestor carried a Gate-Passed trailer, so an un-stamped
# tip could ride an earlier commit's attestation — a false green on the
# actually-merged tree.
env:
# WHY: head.sha reaches the script via env, not shell interpolation
# (expression-injection rule). It is server-populated + content-addressed.
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
commits=$(git log --format="%H" "origin/${{ github.base_ref }}..HEAD")
if [ -z "$commits" ]; then
echo "ERROR: No commits found in PR"
exit 1
fi
found=false
for sha in $commits; do
body=$(git log -1 --format="%b" "$sha")
if echo "$body" | grep -q "^Gate-Passed:"; then
echo "Found gate attestation: $(echo "$body" | grep '^Gate-Passed:' | head -1)"
found=true
break
fi
done
if [ "$found" = false ]; then
echo "ERROR: No Gate-Passed trailer found in any PR commit."
body=$(git log -1 --format="%b" "$PR_HEAD_SHA")
if echo "$body" | grep -q "^Gate-Passed:"; then
echo "Found gate attestation on PR tip: $(echo "$body" | grep '^Gate-Passed:' | head -1)"
else
echo "ERROR: PR tip carries no Gate-Passed trailer (ancestors' trailers do not count — #2399)."
exit 1
fi
27 changes: 13 additions & 14 deletions .github/workflows/hybrid-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,22 +210,21 @@ jobs:
# are the changesets MOST in need of a compile). A trailer NOT
# found is a normal outcome routed to full-gate-build — this step
# never exits 1.
# WHY (#2399): bind to the PR TIP, not "any PR commit" — an un-stamped
# tip must not ride an ancestor's trailer to skip full-gate-build.
env:
# WHY: head.sha reaches the script via env, not shell interpolation.
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
commits=$(git log --format="%H" "origin/${{ github.base_ref }}..HEAD")
found=false
for sha in $commits; do
body=$(git log -1 --format="%b" "$sha")
if echo "$body" | grep -q "^Gate-Passed:"; then
echo "Found gate attestation: $(echo "$body" | grep '^Gate-Passed:' | head -1)"
found=true
break
fi
done

echo "found=$found" >> "$GITHUB_OUTPUT"
if [ "$found" = false ]; then
echo "No Gate-Passed trailer found; routing to full-gate-build."
body=$(git log -1 --format="%b" "$PR_HEAD_SHA")
if echo "$body" | grep -q "^Gate-Passed:"; then
echo "Found gate attestation on PR tip: $(echo "$body" | grep '^Gate-Passed:' | head -1)"
found=true
else
found=false
echo "PR tip carries no Gate-Passed trailer (ancestors do not count — #2399); routing to full-gate-build."
fi
echo "found=$found" >> "$GITHUB_OUTPUT"

full-gate-build:
name: full-gate-build
Expand Down