fix(templates): repin canary callers to a reachable reviewed contract SHA - #94
fix(templates): repin canary callers to a reachable reviewed contract SHA#94kyle-sexton wants to merge 1 commit into
Conversation
… SHA The seeded callers pinned 169e3a4, the PR #89 branch head that squash merge left unreachable, so GitHub failed reusable-workflow resolution with 'workflow was not found' on the first real dispatch (ci-runner-canary run 29371150550). Repin to main commit c265418, whose canary/HA-proof reusable workflows and runtime scripts are byte identical to the reviewed 169e3a4 content (only test files differ). Part of melodic-software/github-iac#88. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D5wqdo4adEZmWgjpY9ZjVx
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: add99e2617
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| permissions: | ||
| contents: read | ||
| uses: melodic-software/ci-workflows/.github/workflows/local-runner-canary.yml@169e3a4287211a536eddcd3a757dd06132fb556e # reviewed canary contract | ||
| uses: melodic-software/ci-workflows/.github/workflows/local-runner-canary.yml@c2654182bc2d78f7909795df78304d482aa69226 # reviewed canary contract |
There was a problem hiding this comment.
When this caller is repinned to c2654182..., the repo's validation still treats 169e3a4... as the current immutable contract: .github/scripts/local-runner-canary.test.cjs:59/:466 and .github/scripts/production-ha-proof.test.cjs:45/:727 assert the old uses: value, and the selector-contract/selector-conformance jobs in .github/workflows/ci.yml:351-355 and .github/workflows/selector-conformance.yml:76-80 still fetch that old SHA before running node --test. In the CI contexts I checked, this makes the repin fail validation instead of proving the reachable commit, so update the test constants/fetch target alongside this template change.
Useful? React with 👍 / 👎.
1 participant
What
The
templates/ci-runner-canarycallers pinned the canary/HA-proof reusable contract at169e3a4— the PR #89 branch head, which squash-merge left unreachable from every remote ref. GitHub refuses reusable-workflow resolution at unreachable SHAs, so the first-ever governed dispatch failed at startup:Repinned both callers to main commit
c2654182bc2d78f7909795df78304d482aa69226: the reusable workflow YAMLs and their runtime scripts are byte-identical to the reviewed169e3a4content (git diffshows only*.test.cjsdrift).Landmine note (for github-iac#89 L9 scope)
Nothing validates that non-selector contract pins are reachable — this dangling pin survived review, sync, and seeding, and only failed on live dispatch. The pin-metadata/provenance check planned under L9 should include a reachability gate.
Part of melodic-software/github-iac#88.
🤖 Generated with Claude Code
https://claude.ai/code/session_01D5wqdo4adEZmWgjpY9ZjVx