Skip to content

fix(ci): governance-enforce gate can pass having scanned nothing #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yakimoto wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(ci): governance-enforce gate can pass having scanned nothing #39

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e5e1636
fix(ci): enforce gate scanned a partial range and could pass having r…
yakimoto Aug 6, 2026
5e2d08e
fix(ci): require governance >=0.4.6 so the empty-tree fallback cannot…
yakimoto Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions .github/workflows/governance-enforce.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ name: governance-enforce

on:
pull_request:
merge_group:
push:
branches: [main, master]

Expand Down Expand Up @@ -35,15 +36,24 @@ jobs:
run: |
mkdir -p "$RUNNER_TEMP/gov" && cd "$RUNNER_TEMP/gov"
printf '@wave-av:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' > .npmrc
npm install @wave-av/governance@^0.4.4 --no-save --no-audit --no-fund
# Floor 0.4.6: earlier 0.4.x diffed `<base>...HEAD` (three-dot needs a COMMIT base) inside
# a fail-open catch, so the empty-tree fallback below scanned 0 files and passed. 0.4.6
# diffs `<base> HEAD` (two-arg form accepts a tree) and fails closed on git errors.
npm install @wave-av/governance@^0.4.6 --no-save --no-audit --no-fund
- name: A_BLOCK enforce (secrets + hardcoded paths on the diff)
env:
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
MERGE_BASE_SHA: ${{ github.event.merge_group.base_sha }}
PUSH_BEFORE_SHA: ${{ github.event.before }}
run: |
BASE="${PR_BASE_SHA:-$PUSH_BEFORE_SHA}"
BASE="${PR_BASE_SHA:-${MERGE_BASE_SHA:-$PUSH_BEFORE_SHA}}"
Comment on lines +46 to +49

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 merge_group base_sha resolvability under the checked-out ref

For merge_group events, checkout runs against the gh-readonly-queue/... ref with fetch-depth: 0, so github.event.merge_group.base_sha should be an ancestor and resolvable by git diff. Worth confirming once in a real merge-queue run: with 0.4.6 now failing closed on git errors, an unresolvable base would hard-fail the required check and stall the queue rather than silently passing.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
BASE=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
# Indeterminate base (first push / force-push). Do NOT silently scan a partial range —
# HEAD~1 would skip earlier commits in a multi-commit push and let a violation through
# (a config-no-silent-noop hole). Diff the full tree against git's empty-tree object so
# every introduced file is scanned; loud, never a silent empty/partial pass.
BASE=$(git hash-object -t tree /dev/null)
echo "::warning::indeterminate diff base; scanning full tree (empty-tree base) so no commit is skipped"
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.
fi
echo "diffing against $BASE"
node "$RUNNER_TEMP/gov/node_modules/@wave-av/governance/bin/enforce.mjs" --changed "$BASE"
Loading