Repository navigation
Keep reusable workflow operands verifiable by the canonical auditor - #147
Merged
Merged
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary by CodeRabbit
WalkthroughThe sync and closeout workflows update release-version validation and path-handling shell forms. New and updated tests cover workflow operands, path rules, version resolution, and merge-driver omission behavior. Documentation and tracker records describe the reported findings and verification. ChangesReusable workflow shell compatibility
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Bug fix Possibly related PRs
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the main change: keeping reusable workflow operands verifiable by the canonical auditor. |
| Description check | |
The description directly explains the workflow changes, verification goals, tests, compatibility results, and auditor findings addressed by the pull request. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (5 skipped: 5 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (5 skipped: 5 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Reviewer's GuideThe PR rewrites dynamic shell handling in both reusable workflows into auditor-verifiable operand boundaries, preserving release resolution and publication safety while adding focused adversarial coverage, documenting exact-overlay verification, and testing artifact-time launcher omission behavior. Sequence diagram for verifiable reusable workflow inputssequenceDiagram
participant Workflow as ReusableWorkflow
participant Shell as WorkflowShell
participant Git as GitRemote
participant Auditor as CanonicalAuditor
Workflow->>Git: git ls-remote
Git-->>Shell: remote_tags
Shell->>Shell: printf
Shell->>Shell: grep -zEq
alt valid release tag
Shell->>Shell: declare
Shell->>Shell: grep -zEq
Shell->>Workflow: PM_GITHUB_VERSION
else malformed or multiline tag/version
Shell-->>Workflow: reject input
end
Auditor->>Workflow: verify literal command operands
Flow diagram for literal publication scope enforcementflowchart TD
A[Build sync_scope with printf and mapfile] --> B[Read changed paths]
B --> C{check_sync_path}
C -->|runtime exclusion| D[Reject path]
C -->|tracker path or CHANGELOG.md| E[Continue publication]
C -->|other path| D
E --> F{Changed tracker item file}
F -->|toon path| G[Generate item links]
F -->|other allowed path| H[No item link generated]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Owner
Author
|
@coderabbitai full review Please review head 25835e4, including outside-diff findings. |
|
Owner
Author
|
@coderabbitai full review Please review head 25835e4, including outside-diff findings. |
✅ Action performedFull review finished. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
This was referenced Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot PR #135 fails
this repository's own workflows pass the gate: the updated canonical pm-ops auditor reports 38 unresolved executable positions in the reusable workflows. The coverage-error lines elsewhere in that job are expected gate self-test output.Express dynamic workflow data as operands to literal commands so its executable boundary is provable:
declare.grep, rejecting multiline inputs while retaining numeric suffixes and annotated-tag behavior.printf/mapfile, and classify paths with conditional tests and explicit continuations.The shared auditor remains the resolved package export, with every finding enforced. The publication scope and safety properties are exercised with real workflow shell, literal tracker names, runtime exclusions, malformed tags, multiline versions, and tag text that must remain data.
The overlay also exposed an untested artifact-time branch in its refreshed canonical prepare launcher. Added pack/publish omission-path tests that preserve Git config and attributes and pass against both canonical launcher generations. Focused launcher coverage is 100/100/100/100 with 10/10 tests.
Validation: Under the exact complete #135 overlay,
npm run release:checkandbun run release:checkwith isolated CI identity each pass 766/766 tests, zero failures/skips, with all 13 authored modules at exactly 100% statements, branches, functions and lines. Restored the original dependency pins and launcher, installed withnpm ci, and passed 64/64 focused baseline compatibility tests. Linked pm commands pass 56/56; final strict pm health, changelog and privacy checks pass.Applied the exact full #135 diff over this fix, including both dependency updates and the merge-driver launcher refresh, then installed it with
npm ci. The applied diff is byte-identical to the PR diff (SHA-256c72710900b72ae73365b959aaf184821d1d49417f64434509a0f120d31af3aea). Under that overlay, restoring only the original workflow shell reproduces all 38 findings and fails the repository regression; restoring the fix passes 1/1 with zero skips. Focused release-tag tests pass 42/42 and literal-scope tests pass 4/4. Dependency changes are temporary proof inputs and are excluded from this PR.The design and verification notes describe the operand-boundary property. Import fidelity PR #142 remains separate.
PM: pm-github-7c95.
Summary by Sourcery
Harden reusable workflows so every dynamic value remains verifiable as literal operand data by the canonical auditor.
Bug Fixes:
Enhancements:
Documentation:
Tests:
Chores:
Summary by cubic
Reworks the reusable workflow shell so the canonical auditor can prove every dynamic value is operand text, clearing the 38 unresolved executable positions the updated pm-ops auditor reports under Dependabot PR #135. No auditor finding is pinned, filtered, or exempted.
declare, and rejects multiline versions as NUL-delimited wholegrepvalues.printf/mapfileand classifies paths with conditional tests instead of dynamiccasearms.The dependency changes from the overlay are temporary proof inputs and are excluded from this PR.
Written for commit 6a96a3b. Summary will update on new commits.
CI receipt at
25835e48e31246a3f4b1e48db7bf362e5d453a67: requiredtest (22)andtest (26)pass, including native Bun acceptance; CodeQL and Semgrep pass. Skipped/neutral reviewer checks are not treated as approval.