From 3e2f7e49448bb9817ce4ace3da76df69f6f491e1 Mon Sep 17 00:00:00 2001 From: "lightning-it-shared-assets-sync[bot]" <307342877+lightning-it-shared-assets-sync[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 11:39:58 +0000 Subject: [PATCH] chore: sync repository quality assets Shared-Assets-Source-SHA: fe98426a54c0b5719e933a9938e82afb36c4a415 Shared-Assets-Source-Run: 32478223963 Shared-Assets-Source-Attempt: 1 Shared-Assets-Sync-App-ID: 4351516 --- .github/workflows/copilot-review-refresh.yml | 150 +++++++++++-------- .github/workflows/copilot-review.yml | 10 +- 2 files changed, 93 insertions(+), 67 deletions(-) diff --git a/.github/workflows/copilot-review-refresh.yml b/.github/workflows/copilot-review-refresh.yml index 3d55877..f4d12f9 100644 --- a/.github/workflows/copilot-review-refresh.yml +++ b/.github/workflows/copilot-review-refresh.yml @@ -71,7 +71,6 @@ jobs: [[ "${HEAD_SHA}" =~ ^[0-9a-f]{40}$ ]] [[ "${PR_NUMBER}" =~ ^[1-9][0-9]*$ ]] runs_url="repos/${REPOSITORY}/actions/runs" - refresh_url="${GITHUB_SERVER_URL}/${REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" neutral_pages="$(gh api --paginate --slurp \ "repos/${REPOSITORY}/commits/${HEAD_SHA}/check-runs?check_name=Current%20revision%20review&filter=all&per_page=100")" @@ -83,75 +82,98 @@ jobs: ' <<<"${neutral_pages}")" neutral_count="$(jq 'length' <<<"${neutral}")" if [ "${neutral_count}" -gt 1 ]; then - evidence="$(jq -cn --arg base "${BASE_SHA}" --arg head "${HEAD_SHA}" \ - '{schema:4,base_sha:$base,head_sha:$head, - reason:"ambiguous duplicate protected review evidence"}')" - invalidation_failed=0 - while read -r duplicate_check_id; do - if ! [[ "${duplicate_check_id}" =~ ^[1-9][0-9]*$ ]]; then - echo "Invalid duplicate check-run id: ${duplicate_check_id}." >&2 - invalidation_failed=1 - continue - fi - if ! invalidated="$(gh api --method PATCH \ - "repos/${REPOSITORY}/check-runs/${duplicate_check_id}" \ - -f status=completed \ - -f conclusion=failure \ - -f "details_url=${refresh_url}" \ - -f 'output[title]=Current revision review invalidated' \ - -f "output[summary]=${evidence}")"; then - echo "Unable to invalidate duplicate check ${duplicate_check_id}." >&2 + if jq -e \ + --arg repository "${REPOSITORY}" \ + --arg server "${GITHUB_SERVER_URL}" ' + .[0] as $first + | ($first.external_id | type) == "string" + and ($first.external_id | length) > 0 + and ($first.output.title | type) == "string" + and ($first.output.summary | type) == "string" + and all(.[]; + .status == "completed" + and .conclusion == "success" + and .external_id == $first.external_id + and .output.title == $first.output.title + and .output.summary == $first.output.summary + and .details_url == ($server + "/" + $repository + "/runs/" + (.id | tostring))) + ' <<<"${neutral}" >/dev/null; then + echo "Equivalent duplicate protected evidence detected; validating one canonical copy." + neutral="$(jq -c 'sort_by(.id) | [last]' <<<"${neutral}")" + neutral_count=1 + else + evidence="$(jq -cn --arg base "${BASE_SHA}" --arg head "${HEAD_SHA}" \ + '{schema:4,base_sha:$base,head_sha:$head, + reason:"ambiguous duplicate protected review evidence"}')" + invalidation_failed=0 + while read -r duplicate_check_id; do + if ! [[ "${duplicate_check_id}" =~ ^[1-9][0-9]*$ ]]; then + echo "Invalid duplicate check-run id: ${duplicate_check_id}." >&2 + invalidation_failed=1 + continue + fi + duplicate_check_url="${GITHUB_SERVER_URL}/${REPOSITORY}/runs/${duplicate_check_id}" + if ! invalidated="$(gh api --method PATCH \ + "repos/${REPOSITORY}/check-runs/${duplicate_check_id}" \ + -f status=completed \ + -f conclusion=failure \ + -f "details_url=${duplicate_check_url}" \ + -f 'output[title]=Current revision review invalidated' \ + -f "output[summary]=${evidence}")"; then + echo "Unable to invalidate duplicate check ${duplicate_check_id}." >&2 + invalidation_failed=1 + continue + fi + if ! jq -e \ + --arg evidence "${evidence}" \ + --arg head "${HEAD_SHA}" \ + --arg url "${duplicate_check_url}" \ + --argjson check_id "${duplicate_check_id}" ' + .id == $check_id + and .name == "Current revision review" + and .app.id == 15368 + and .app.slug == "github-actions" + and .head_sha == $head + and .status == "completed" + and .conclusion == "failure" + and .details_url == $url + and .output.summary == $evidence + ' <<<"${invalidated}" >/dev/null; then + echo "Duplicate check ${duplicate_check_id} did not confirm invalidation." >&2 + invalidation_failed=1 + fi + done < <(jq -r '.[].id' <<<"${neutral}") + if ! verified_pages="$(gh api --paginate --slurp \ + "repos/${REPOSITORY}/commits/${HEAD_SHA}/check-runs?check_name=Current%20revision%20review&filter=all&per_page=100")"; then + echo "Unable to re-read duplicate protected checks after invalidation." >&2 invalidation_failed=1 - continue - fi - if ! jq -e \ + elif ! jq -e \ --arg evidence "${evidence}" \ --arg head "${HEAD_SHA}" \ - --arg url "${refresh_url}" \ - --argjson check_id "${duplicate_check_id}" ' - .id == $check_id - and .name == "Current revision review" - and .app.id == 15368 - and .app.slug == "github-actions" - and .head_sha == $head - and .status == "completed" - and .conclusion == "failure" - and .details_url == $url - and .output.summary == $evidence - ' <<<"${invalidated}" >/dev/null; then - echo "Duplicate check ${duplicate_check_id} did not confirm invalidation." >&2 + --arg repository "${REPOSITORY}" \ + --arg server "${GITHUB_SERVER_URL}" \ + --argjson expected "${neutral}" ' + [.[].check_runs[]? | + select(.name == "Current revision review") | + select(.app.id == 15368 and .app.slug == "github-actions") | + select(.head_sha == $head)] as $current | + ([$current[].id] | sort) == ([$expected[].id] | sort) + and ($current | length) == ($expected | length) + and all($current[]; + .status == "completed" + and .conclusion == "failure" + and .details_url == ($server + "/" + $repository + "/runs/" + (.id | tostring)) + and .output.summary == $evidence) + ' <<<"${verified_pages}" >/dev/null; then + echo "Not every duplicate protected check is verifiably invalidated." >&2 invalidation_failed=1 fi - done < <(jq -r '.[].id' <<<"${neutral}") - if ! verified_pages="$(gh api --paginate --slurp \ - "repos/${REPOSITORY}/commits/${HEAD_SHA}/check-runs?check_name=Current%20revision%20review&filter=all&per_page=100")"; then - echo "Unable to re-read duplicate protected checks after invalidation." >&2 - invalidation_failed=1 - elif ! jq -e \ - --arg evidence "${evidence}" \ - --arg head "${HEAD_SHA}" \ - --arg url "${refresh_url}" \ - --argjson expected "${neutral}" ' - [.[].check_runs[]? | - select(.name == "Current revision review") | - select(.app.id == 15368 and .app.slug == "github-actions") | - select(.head_sha == $head)] as $current | - ([$current[].id] | sort) == ([$expected[].id] | sort) - and ($current | length) == ($expected | length) - and all($current[]; - .status == "completed" - and .conclusion == "failure" - and .details_url == $url - and .output.summary == $evidence) - ' <<<"${verified_pages}" >/dev/null; then - echo "Not every duplicate protected check is verifiably invalidated." >&2 - invalidation_failed=1 - fi - if [ "${invalidation_failed}" -ne 0 ]; then - echo "Duplicate-check invalidation was incomplete; remaining fail-closed." >&2 + if [ "${invalidation_failed}" -ne 0 ]; then + echo "Duplicate-check invalidation was incomplete; remaining fail-closed." >&2 + fi + echo "Multiple non-equivalent protected Current revision review checks exist for ${HEAD_SHA}." >&2 + exit 1 fi - echo "Multiple protected Current revision review checks exist for ${HEAD_SHA}." >&2 - exit 1 fi if [ "${neutral_count}" -eq 1 ]; then check_id="$(jq -er '.[0].id | select(type == "number" and . > 0)' <<<"${neutral}")" diff --git a/.github/workflows/copilot-review.yml b/.github/workflows/copilot-review.yml index 7109c22..86bc08b 100644 --- a/.github/workflows/copilot-review.yml +++ b/.github/workflows/copilot-review.yml @@ -921,9 +921,13 @@ jobs: review_path="applicable Copilot or governed automation exemption" external_kind="copilot" result_title="Current revision review passed" - if { [ "${author}" = 'lightning-it-release-automation[bot]' ] \ - || { [ "${REPOSITORY}" = "lightning-it/.github" ] \ - && [ "${author}" = 'lightning-it-shared-assets-sync[bot]' ]; }; }; then + if [ "${TRUSTED_KIND}" = ancestry-backmerge ]; then + if [ "${author}" = 'lightning-it-release-automation[bot]' ]; then + : + else + test "${REPOSITORY}" = "lightning-it/.github" + test "${author}" = 'lightning-it-shared-assets-sync[bot]' + fi test "${TRUSTED_KIND}" = ancestry-backmerge test "${base_ref}" = develop [[ "${EVENT_HEAD_REF}" == backmerge/*-main ]]