From 8073a10e93c09b64d099cf1d9cbc19cfb1e0b6d9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 02:29:29 +0900 Subject: [PATCH] test(actions): pin cancellation for the two PR-keyed scans that only had presence #1979 anchored every cancel-in-progress assertion, but two workflows kept a flag no assertion reads. Flipping either to `false` on merged main leaves the suite green: python-security.yml and sast-semgrep.yml, both at 2968 passed / 0 failed. Both appear in `test_pull_request_close_events_cancel_superseded_runs_without_heavy_jobs`, but in the branch that asserts the key is present rather than what it says. That branch is shaped by pr-review-merge-scheduler.yml, whose value is deliberately an expression over `github.event_name`, so the loop cannot assert a constant for everyone in it. Asserting the value pins an existing decision rather than inventing one: both key their group by pull request and both already read `true`, like codeql-pr.yml and security-scan.yml whose values are pinned in `test_required_pull_request_workflows_cancel_superseded_runs`. They are kept out of that loop because its catch-all `else` requires a `github.event_name` discriminator in the group, and these two key on `pull_request.number || github.ref` with no event-name term; adding them would need a branch that asserts nothing. The test now checks that reason itself (`assert "github.event_name" not in group_value`) so the docstring cannot drift from the code. Two corrections landed in this commit, both caught by peer 1: - An earlier draft justified the separate test by claiming these two lack `base.repo.full_name` in the group. They both have it. I had inferred that from a printout truncated to 44 characters instead of reading the group value out. - The fix for that was applied as an *addition*, not a replacement: the old function survived alongside the new one, false docstring included, because `git checkout -- tests/` restored the committed version before I inserted the rewrite. The gate said so and I did not read it -- main is 2968 and this change adds one test, so 2969 is correct and the 2970 I reported was 2968+2. A duplicate is invisible to mutation testing, because either copy catches the mutant. Still deliberately uncontracted: audit-central-ruleset, sbom-generation, scheduled-security-scan, secret-scan. For scheduled-security-scan the correct value is an open question -- its `github.ref`-keyed group with cancellation on produced 228 cancellations and zero completed scans between 2026-09-01 and 09-05 -- so pinning `true` would settle a decision nobody has made. Both gaps were found by mutation, not by reading. A proximity scan over the test sources reported sast-semgrep as contracted, and my own earlier sweep reported it CAUGHT; both were wrong, and flipping the value said so immediately. Mutation evidence on this tree, restored clean after each: python-security.yml false -> CAUGHT (1 failed, this test only) sast-semgrep.yml false -> CAUGHT (1 failed, this test only) Gates: 2969 passed, coverage 100%, interrogate 100%. Co-Authored-By: Claude Opus 5 --- .../test_required_workflow_queue_contract.py | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tests/test_required_workflow_queue_contract.py b/tests/test_required_workflow_queue_contract.py index 8bc0791631..4ab09b1d0c 100644 --- a/tests/test_required_workflow_queue_contract.py +++ b/tests/test_required_workflow_queue_contract.py @@ -905,6 +905,32 @@ def test_strix_draft_transition_cancels_current_scan(tmp_path: Path) -> None: assert "/actions/runs/100/cancel" in calls +def test_pr_keyed_scan_workflows_pin_cancellation_as_a_value() -> None: + """Pin `cancel-in-progress` for the two PR-keyed scans that only had presence. + + Both appear in ``test_pull_request_close_events_cancel_superseded_runs_without_heavy_jobs``, + but in the branch that asserts the key is *present* rather than what it says. + That branch is shaped by ``pr-review-merge-scheduler.yml``, whose value is + deliberately an expression over ``github.event_name``, so the loop cannot + assert a constant for everyone in it. Nothing else read the flag: flipping + either to ``false`` left the whole suite green (2968 passed, 0 failed, + measured 2026-09-06). + + Kept out of ``test_required_pull_request_workflows_cancel_superseded_runs`` + because that loop ends by requiring a ``github.event_name`` discriminator in + the group, and these two key on + ``pull_request.number || github.ref`` with no event-name term. Adding them + there would need a branch that asserts nothing. + """ + for filename in ("python-security.yml", "sast-semgrep.yml"): + workflow = workflow_text(filename) + group_value = workflow_level_concurrency_group(workflow) + + assert workflow_level_cancels_in_progress(workflow) + assert "github.event.pull_request.number" in group_value + assert "github.event_name" not in group_value + + def test_pull_request_close_events_cancel_superseded_runs_without_heavy_jobs() -> None: """Close events should cancel old runs without starting expensive jobs.""" workflows = (