Fail Closed at Release and Audit Boundaries - #844
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens “fail closed” behavior at two boundaries: release publishing (must not proceed after failed validation) and audit path discovery (must not treat API execution failures as ordinary “path missing” results). It updates the spec/audit contract plus adds regression tests to prevent these guardrails from regressing.
Changes:
- Require
publish-release.yml’spublishjob to gate on both plan output andneeds.validate.result == 'success'. - Extend the workflow interface contract/self-tests to assert the validation-success gate is present.
- Add regression tests covering the release gate and the audit probe behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
spec/files.json |
Extends the publish-release workflow interface contract to require the validation-success gate token. |
spec/audit.py |
Updates self-tests to validate the stronger publish gate and adds a regression case for the fail-open scenario. |
scripts/tests/test_release_guards.py |
Adds tests that assert the publish gate and audit probe behavior stay fail-closed. |
AUDIT.md |
Changes audit path discovery to fail loudly on gh api errors (but currently breaks nested path detection for .github/workflows). |
.github/workflows/publish-release.yml |
Fixes the publish job to require successful validation in addition to the plan output. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
ptr727
marked this pull request as ready for review
August 19, 2026 16:28
Merged
ptr727
added a commit
that referenced
this pull request
Aug 19, 2026
## Summary - Promote fail-closed release validation and audit path discovery. - Promote explicit Bash labels for executable audit commands. - Promote the canonical PyPI artifact-name regression guard. - Promote the executable Python entry point for the release-guard test. - Promote the internally consistent missing-job audit fixture. ## Source - #844 (`a08713a`) - #847 (`af2c8ff`) - #848 (`1cd5b84`) - #849 (`87c3960`) - #850 (`9b6c01f`) - #851 (`bb4d603`) ## Validation - 730 Python tests - audit self-tests and spec validation - ruff, mypy, and coverage - actionlint, markdownlint, EditorConfig, CSpell, ShellCheck, and PSScriptAnalyzer - Copilot full-diff review on each feature pull request Closes #842 Closes #843 Closes #845
ptr727
added a commit
that referenced
this pull request
Aug 26, 2026
…1014) ## Summary The intent-staleness advisory (`check_intent_staleness`/`hub_last_change` in `spec/audit.py`) compared two dates and read no content at all: a downstream copy's last commit against the hub canonical's last commit. The verbatim engine already normalizes three classes of governed drift before hashing (`spec/fidelity-model.md` "Normalization"): line endings, a `uses: <action>@<sha>` pin with its trailing version comment, and a job's `needs:` list. The intent advisory applied none of that, so a Dependabot pin bump on a workflow file's hub canonical marked every downstream carrier as "possibly trailing" at once, for a class of drift the fidelity model already treats as governed per-repo churn rather than a deviation. ## Fix `hub_last_change()` now walks the canonical's full git history and returns the newest revision whose normalized content differs from its predecessor's (`_last_effective_change`), falling back to the file's creation revision if every bump back to it was normalized-only. `git_file_history()` and `hub_last_change()` now share one cached history walk (`_git_revisions`) instead of two separate `git log` calls. Verified live against the two files named in the issue: `publish-release.yml` now dates from a real job-condition change (#844) instead of the pin-only Dependabot bump (#612) the issue measured, and `validate-task.yml` picks up its most recent real change. Added self-test coverage for `_last_effective_change` (pin-only chain back to creation, a real change under a later pin bump, a single-revision file, and unreadable history treated as effective rather than silently skipped). Updated the `fidelity-model.md` "intent" description and the `check_intent_staleness`/`hub_last_change` docstrings to state the normalization explicitly. ## Validation - `python3 spec/audit.py --selftest` (includes the new `_last_effective_change` cases) - `ruff check` / `ruff format --check` / `mypy` on `spec/audit.py` - `python3 scripts/prose_lint.py` - `python3 scripts/repo_gate.py` - `python3 scripts/host_gate.py` - Live-checked `hub_last_change()` against `publish-release.yml` and `validate-task.yml`, confirming the returned commit is a real content change, not the Dependabot pin bump. Fixes #735. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved intent-staleness detection by ignoring changes limited to line endings, dependency action pins, or workflow job-order metadata. * Dependabot-only workflow pin updates no longer incorrectly mark related items as outdated. * Added more reliable handling for missing, unreadable, empty, or newly created revision history. * **Documentation** * Updated fidelity guidance to reflect the refined change-detection rules. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ptr727-codegen[bot] <275599072+ptr727-codegen[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: OpenAI Codex <codex@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root Cause
A job-level condition replaced GitHub Actions' implicit success gate. The audit helper also redirected API errors into an ordinary absent-path result.
Validation
Closes #842
Closes #843