From 8680f7ad509fd231fdd03d800f41a02ccb911324 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 31 Aug 2026 08:52:08 +0000 Subject: [PATCH] fix(ci): correct required-workflow-bootstrap job scope in strix quick gate test assert_opencode_review_uses_codegraph_and_contextual_orchestrator's awk range `/^ required-workflow-bootstrap:$/,/^[^ ]/` never terminates in this file, since job keys are always 2-space indented and no truly-unindented line exists anywhere in the jobs: section. This silently pulled every job after required-workflow-bootstrap into the "must have no if:" check, tripping on an unrelated, legitimate if: condition on a later job's step and failing this required check on every open .github-repo PR. required-workflow-bootstrap itself has always had zero if: conditions -- only the test's own job-scoping was broken. Replace the range with an explicit state machine that starts at the bootstrap job header and stops at the next 2-space-indented job key. Verified: `bash scripts/ci/test_strix_quick_gate.sh` now passes (previously failed with exactly the false-positive record_failure this fix removes); full suite (2125 passed, 1 skipped, 21 subtests) and `git diff --check` clean. --- CHANGELOG.md | 17 +++++++++++++++++ scripts/ci/test_strix_quick_gate.sh | 6 +++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 39c61c142b..c159c5b737 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,23 @@ this file. The format follows Keep a Changelog, and versioned releases follow Semantic Versioning where the repository publishes a release. ## [Unreleased] +- Fix a broken CI contract test that was blocking every open `.github`-repo + PR: `test_strix_quick_gate.sh`'s + `assert_opencode_review_uses_codegraph_and_contextual_orchestrator` used an + `awk '/^ required-workflow-bootstrap:$/,/^[^ ]/'` range to isolate that + one job's YAML block in `opencode-review.yml`, intending to assert it has + no `if:` condition on any step (a real trust-boundary invariant: this + bootstrap job must never depend on event-payload fields). Because job keys + in that file are always 2-space indented, `/^[^ ]/` (a truly unindented + line) never matches anywhere in the `jobs:` section, so the range never + closed and silently swallowed every job defined after + `required-workflow-bootstrap` too — including the unrelated, + legitimate `if: github.event.action != 'closed'` on a completely different + job's step. `required-workflow-bootstrap` itself has always had zero `if:` + conditions; only the test's own job-scoping was wrong. Replaced the range + with an explicit awk state machine that starts at the bootstrap job header + and stops at the next 2-space-indented job key, so it correctly isolates + only that job's steps. - Harden the review sidecar's per-account catalog cap against silent drift: `contextual_orchestrator_review_launcher.py`'s two `build_zdr_prioritized_catalog` call sites now source their diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 4053f4fd53..1008a03be1 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -522,7 +522,11 @@ assert_opencode_review_uses_codegraph_and_contextual_orchestrator() { assert_file_not_contains "$workflow_file" "Wait for trusted OpenCode approval review" "opencode pull_request bridge was removed to avoid duplicate required-check resource use" assert_file_not_contains "$workflow_file" "Trusted OpenCode requested changes for head" "opencode pull_request bridge no longer reconsumes stale trusted review state" assert_file_not_contains "$workflow_file" "github.event.pull_request.number == 240" "opencode review workflow must not hard-code repository-specific PR bypasses" - if awk '/^ required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then + if awk ' + /^ required-workflow-bootstrap:$/ { in_job = 1; print; next } + in_job && /^ [A-Za-z0-9_-]+:$/ { exit } + in_job { print } + ' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then record_failure "opencode required workflow bootstrap must not depend on required-workflow event payload fields" fi assert_file_contains "$workflow_file" 'github.event.client_payload.target_repository || github.repository' "opencode review scopes concurrency by target repository"