Repository navigation
fix(ci): move the dylint caller grant into the workflow SOT - #1755
Merged
Merged
Conversation
#1754 hand-edited the rendered .github/workflows/ci-full.yml, so the CI Workflow Drift job fails on main (`render_workflows.py --check`: ci-full.yml is out of sync with the SOT). Emit the `contents: read` + `actions: write` grant from ci/render_workflows.py instead, which regenerates the same file. Add a regression test that walks every `uses: ./.github/workflows/*.yml` edge and asserts the callee never requests more than the caller grants. GitHub enforces that at run startup, so the failure mode is the whole release run dying with no job ever starting (release-auto 40425964410).
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
The guard method hit C901 (12 > 10) in `ci/check_python_complexity.py`, which is what failed `linux / Check (ubuntu-latest)` on #1755. Move the walk into module-level helpers; the test method is now three lines.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainis red: the CI Workflow Drift job fails because #1754 hand-edited the rendered.github/workflows/ci-full.yml.ci/render_workflows.py --check(run 40426732896) rejects the committed file, and re-rendering deletes the grant — which would bring back thestartup_failurethat #1754 fixed.Fix: emit the grant from the SOT (
ci/render_workflows.py) so the rendered file matches by construction.ci-full.ymlis byte-identical to what #1754 produced.Guard:
test_called_workflows_fit_inside_their_callers_grantwalks everyuses: ./.github/workflows/*.ymledge, transitively, and asserts a callee never requests more than its caller grants — the exact condition GitHub rejects at run startup. Verified by mutation: deletingrelease-auto'sfull-cigrant fails withwhich is the pre-#1754 state.
python -m unittest ci.test_fractional_workflows ci.test_local_gate: 28 tests OK.render_workflows.py --check: exit 0.