Repository navigation
Call label-correspondence at the governance pin, and test that it stays there - #2076
Open
realmarcin wants to merge 3 commits into
Open
realmarcin wants to merge 3 commits into
realmarcin wants to merge 3 commits into
Conversation
…ys there The workflow says to keep its claw ref at scripts/.vendored_canon_ref, but it called the reusable workflow at c8b8f89ecf while the pin is 76c1ebeea3 (#2067). Nothing enforced the rule, and it had already drifted once. The reusable workflow is byte-identical at both commits and checks out only this repository, so the move changes no behaviour. tests/test_label_correspondence_pin.py now fails when the ref and the pin differ. It fails on the previous ref and passes on the pin. claw's pin-coupling already reports this file on a re-pin, so the re-pin commit changes both. Fixes #2067. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The review of #2076 found that the test's regex matched only an unquoted `uses:` line with no trailing comment (#2077). A quoted or commented second call at a stale ref passed, and quoting or commenting the one correct call failed with "found []". The test now parses the workflow. It collects every job- and step-level `uses` that names culturebotai-claw, requires each to be at the pin, and requires exactly one label-correspondence call. Seven cases drive each distinction: - a quoted good call; - a commented good call; - a quoted stale second call; - a commented stale second call; - a stale step-level claw action; - no call at all; - the plain good call. The real-file test still fails on the previous ref, quoted or not. Fixes #2077. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The second review of #2076 found that the pin test matched the owner and repository literally (#2078). GitHub resolves them case-insensitively, so a stale call written as `culturebotai/culturebotai-claw/...@<old>` would run but escaped both the pin check and the duplicate count. The owner and repository are now compared in one case. The path and ref stay exact, since git paths are case-sensitive. Messages still show each call as written. Two new cases cover this: a differently-cased stale second call is reported, and a differently-cased correct call is accepted. Comparing case-sensitively fails both. Fixes #2078. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
.github/workflows/label-correspondence.yamlsays: "Keep this at the same immutable CLAW revision asscripts/.vendored_canon_ref." It called the reusable workflow atc8b8f89e, while the pin is76c1ebee. Nothing enforced the rule, and it had already drifted once (#2067).What changes
76c1ebeea3fc7f80bf1abe044688f298f390cfac.tests/test_label_correspondence_pin.pyparses the workflow as YAML. It fails when any job- or step-levelusesnaming culturebotai-claw is not atscripts/.vendored_canon_ref, or when the label-correspondence call is not there exactly once. After review it no longer uses a regex, so quoting or commenting a call cannot hide a stale ref (The label-correspondence pin test misses a quoted or commented call #2077). The owner and repository are compared case-insensitively, as GitHub resolves them (The label-correspondence pin test misses a claw call written with different owner casing #2078). claw'skg-microbe-governance pin-couplingalready names this file on a re-pin, so the re-pin commit changes both.Why the move changes no behaviour
In claw,
.github/workflows/label-correspondence-reusable.yamlis byte-identical atc8b8f89eand76c1ebee. Its only checkout isactions/checkoutof this repository, so no other claw content is read at the new ref.Verification
just pr-sanityreports 0 findings, which includes the 40-character-SHA rule foruses:.tests/test_merge_queue_workflows.py,test_audit_required_workflows.py,test_vendored_sync_workflow.pyandtest_workflow_dependency_paths.pyall pass.label-correspondenceruns on it at the new ref. That run is the end-to-end check.Fixes #2067. Fixes #2077. Fixes #2078. Raised in the adversarial review of the CultureBotAI/culturebotai-claw#729 re-pin PRs.
🤖 Generated with Claude Code