Fail Loudly on Audit Declaration Reads - #847
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request hardens the audit declaration probe documented in AUDIT.md so that failures in the GitHub Contents API read and Base64 decoding cannot be masked by later pipeline stages, and adds a regression test to ensure the probe fails loudly at those boundaries.
Changes:
- Split the Dependabot Contents API read from Base64 decoding, and fail immediately when either step fails.
- Update the release-guard regression test to execute the updated probe and assert API and decode failures surface as non-zero exits.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| scripts/tests/test_release_guards.py | Updates the regression test to run the revised probe and cover API-failure and decode-failure exit behavior. |
| AUDIT.md | Refactors the documented Dependabot declaration probe to separate gh api and base64 -d, failing loudly on either boundary. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
ptr727
marked this pull request as ready for review
August 19, 2026 17:04
Merged
ptr727
added a commit
that referenced
this pull request
Aug 19, 2026
## Summary - Promote fail-closed release validation and audit path discovery. - Promote explicit Bash labels for executable audit commands. - Promote the canonical PyPI artifact-name regression guard. - Promote the executable Python entry point for the release-guard test. - Promote the internally consistent missing-job audit fixture. ## Source - #844 (`a08713a`) - #847 (`af2c8ff`) - #848 (`1cd5b84`) - #849 (`87c3960`) - #850 (`9b6c01f`) - #851 (`bb4d603`) ## Validation - 730 Python tests - audit self-tests and spec validation - ruff, mypy, and coverage - actionlint, markdownlint, EditorConfig, CSpell, ShellCheck, and PSScriptAnalyzer - Copilot full-diff review on each feature pull request Closes #842 Closes #843 Closes #845
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root Cause
The declaration pipeline ran without
pipefail, so a later successful command could mask an earlier API or decode failure.Validation
Follow-up to #843 and the Copilot finding on #846.