From b62e75f3dd28788b0a37aef2e9532451359f24b0 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 31 Aug 2026 19:40:32 +0000 Subject: [PATCH] fix(ci): correct required-workflow-bootstrap job-scope check boundary scripts/ci/test_strix_quick_gate.sh's awk range for the required-workflow-bootstrap job used /^[^ ]/ as its end pattern, which only matches a fully-unindented line, so it never stopped at the next 2-space-indented job header and instead swept every later job in opencode-review.yml (coverage-source-tree, coverage-evidence, opencode-review-target) into the check. This was latent until #1497 ("require substantive agent verdicts") added a genuine step-level `if: github.event.action != 'closed'` inside opencode-review-target, which the over-broad range then misattributed to required-workflow-bootstrap (which has no `if:` at all and was always compliant) -- failing exact-head-path-policy on every open PR in this repository, confirmed reproducing on a clean origin/main checkout. Corrected the range to exit as soon as it reaches the next 2-space-indented job header. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KPmJErfkcHer4UVEgrQxUX --- CHANGELOG.md | 12 ++++++++++++ scripts/ci/test_strix_quick_gate.sh | 6 +++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 39c61c142b..d8df722fa8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,18 @@ this file. The format follows Keep a Changelog, and versioned releases follow Semantic Versioning where the repository publishes a release. ## [Unreleased] +- Fix `scripts/ci/test_strix_quick_gate.sh`'s `required-workflow-bootstrap` job-scope + check: its `awk` range used `/^[^ ]/` as the end pattern, which only matches a + fully-unindented line and so never stopped at the next 2-space-indented job + header — it silently swept every later job in `opencode-review.yml` + (`coverage-source-tree`, `coverage-evidence`, `opencode-review-target`) into + the check. That was latent until `#1497` ("require substantive agent + verdicts") added a genuine step-level `if: github.event.action != 'closed'` + inside `opencode-review-target`, which the over-broad range then + misattributed to `required-workflow-bootstrap` (which has no `if:` at all + and was always compliant), failing `exact-head-path-policy` on every open + PR in this repository. The corrected range now exits as soon as it reaches + the next 2-space-indented job header. - Harden the review sidecar's per-account catalog cap against silent drift: `contextual_orchestrator_review_launcher.py`'s two `build_zdr_prioritized_catalog` call sites now source their diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index 4053f4fd53..15217731da 100644 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -522,7 +522,11 @@ assert_opencode_review_uses_codegraph_and_contextual_orchestrator() { assert_file_not_contains "$workflow_file" "Wait for trusted OpenCode approval review" "opencode pull_request bridge was removed to avoid duplicate required-check resource use" assert_file_not_contains "$workflow_file" "Trusted OpenCode requested changes for head" "opencode pull_request bridge no longer reconsumes stale trusted review state" assert_file_not_contains "$workflow_file" "github.event.pull_request.number == 240" "opencode review workflow must not hard-code repository-specific PR bypasses" - if awk '/^ required-workflow-bootstrap:$/,/^[^ ]/' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then + if awk ' + /^ required-workflow-bootstrap:$/ { found=1; print; next } + found && /^ [A-Za-z0-9_-]+:$/ { exit } + found { print } + ' "$bootstrap_file" | grep -q '^[[:space:]]*if:'; then record_failure "opencode required workflow bootstrap must not depend on required-workflow event payload fields" fi assert_file_contains "$workflow_file" 'github.event.client_payload.target_repository || github.repository' "opencode review scopes concurrency by target repository"