fix(guardrails): test-windows-secrets fails on main on the allowed-roots link case #10276

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 26, 2026
2. github-actions commented on Oct 26, 2026

   

   github-actionsBot

   on Oct 26, 2026 – with GitHub Actions

   Last edited by melodic-automation-lanes

   Contributor

   More actions

   Proposed work class: work-class: scoped
   Basis: automated intake triage; the lanes App applied this class.

   Size: Small
   Complexity: Medium
   Uncertainty: Knowable
   Flags: none
   Blocked by: none

   Understood: the Windows secrets test job fails on main with one case ("allowed roots: through a link outside D that lands under D", expected exit 0, got 2). The failure appeared between the last passing run and the two failing runs, and it carries into every PR's run. The suspected cause is a recent guardrails change (#9981 or #10019), and nobody has verified it. The fix is to find the regression, using the Windows run logs and the commit range, and make the job pass again. I found no likely duplicates among the open issues.

   _{Automated triage, applied by the lanes App.}
3. github-actions

   added

   priority: criticalProduction broken, data loss, active exploit, or release blocker.Production broken, data loss, active exploit, or release blocker.

   and removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 26, 2026
4. github-actions

   added the

   Bug

   issue type on Oct 26, 2026
5. melodic-automation-lanes

   added

   status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

   work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

   admission-deferred

   on Oct 26, 2026
6. melodic-software-github-iac

   removed

   admission-deferred

   on Oct 26, 2026
7. melodic-automation-lanes

   added

   agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   and removed

   agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

   on Oct 28, 2026
8. melodic-automation-lanes commented on Oct 29, 2026

   

   melodic-automation-lanesBot

   on Oct 29, 2026

   Contributor

   More actions

   The work-resolve-issue lane stopped partway through this issue and needs a person.

   Why, in the run's own words:

   Nothing to change. The failing case is already fixed on main by 300e58f (＃10280, 2026-10-26, "fix(guardrails): resolve only the existing ancestor through cygpath for an allowed-roots link"). test-windows-secrets has passed on every scheduled main run since b59666b (runs 40360157201, 40481545922, 40540682796, 40663903199, 40725629371). This run made no change. The issue's done-when item is already met, so a person should close the issue as resolved by ＃10280.

   What the run says it did not do:

   • This run did not execute secret-pattern-detection.test.sh: the test is Windows-only and this lane cannot run it. Evidence that it passes comes from main's scheduled pr-test-windows runs.
   • Tidy, review, build/test and class-audit steps were skipped because there is no diff.
   • The issue was not closed: this lane cannot close issues. It needs a person to close it as resolved by ＃10280.

   Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40790265869

   To retry, remove needs-human and add agent-ready again.
9. kyle-sexton commented on Oct 29, 2026

   

   kyle-sexton

   on Oct 29, 2026

   MemberAuthor

   More actions

   Re-triage: closing. The only done-when item, "test-windows-secrets passes on main", is met.

   • The fix is #10280 (merge 300e58f5a6, 2026-10-26, "fix(guardrails): resolve only the existing ancestor through cygpath for an allowed-roots link"), which fixes the failing allowed-roots link case.
   • Every scheduled pr-test-windows run on main since then has passed: 40360157201, 40481545922, 40540682796, 40663903199 and 40725629371. In the newest run, job test-windows-secrets concluded success.
   • The work-resolve-issue lane reached the same result in run 40790265869 and asked a person to close this issue as resolved by fix(guardrails): resolve only the existing ancestor through cygpath for an allowed-roots link #10280. needs-human is on this issue only because the lane cannot close issues. It is not an intent or security hold.
10. kyle-sexton

    closed this as completedon Oct 29, 2026