From 5bae9f0c280ed09ecec90755d5b05f1ba0ff21af Mon Sep 17 00:00:00 2001
From: Binay <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 15:35:09 -0400
Subject: [PATCH] fix(ci): weekly self-scan installs the checkout, not a stale
 v0.5.4 tag

The `Signetry auto-fix` workflow installed signetry-core from
`git+https://github.com/Signetry/core@v0.5.4`. That tag predates the
umbra -> signetry rename, so its metadata still declares
`name = "umbra-core"`, and pip refused the requested `signetry-core`:

    Requested umbra-core from git+.../core@v0.5.4 has inconsistent name:
    expected 'signetry-core', but metadata has 'umbra-core'
    ERROR: No matching distribution found for signetry-core (unavailable)

Every scheduled run since the rename failed at the install step, so the
scan, the leak check and the PR step were all skipped.

This is the signetry-core repo, so install the checkout (`pip install .`):
the weekly self-scan should exercise the code on main, and a hard-coded
tag drifts behind it by construction. Downstream consumers still install
by tag (see Signetry/autofix-demo, already on v0.7.0).

Also make the artifact path deterministic. `path: ${{ env.OUT }}/...` only
resolves after the scan step exports OUT, so a failure before that point
made it upload from `/scan-and-fixes.json`.

Verified locally on 3.13: `pip install .` yields signetry-core 0.7.0 with a
working `signetry` entry point, and `signetry --json scan .` exits 0 with
9 findings.
---
 .github/workflows/signetry-autofix.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/signetry-autofix.yml b/.github/workflows/signetry-autofix.yml
index 61b6151..1bb31d4 100644
--- a/.github/workflows/signetry-autofix.yml
+++ b/.github/workflows/signetry-autofix.yml
@@ -66,9 +66,13 @@ jobs:
           python-version: "3.12"
 
       - name: Install Signetry
-        # signetry-core is source-available (All Rights Reserved) and not on PyPI —
-        # install it from the source repo by tag.
-        run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.5.4"
+        # This IS the signetry-core repo, so install the checkout rather than a
+        # published tag: the weekly self-scan must exercise the code on main, and a
+        # hard-coded tag silently drifts behind it (the v0.5.4 pin here outlived the
+        # umbra -> signetry rename and broke the run, because that tag's metadata
+        # still declared name = "umbra-core"). Downstream repos install by tag —
+        # see .github/workflows in Signetry/autofix-demo for that shape.
+        run: pip install .
 
       - name: Install the executor CLI
         env:
@@ -252,5 +256,7 @@ jobs:
         if: always()
         with:
           name: signetry-autofix
-          path: ${{ env.OUT }}/scan-and-fixes.json
+          # Deterministic path, not ${{ env.OUT }}: env.OUT is only set once the scan
+          # step runs, so an earlier failure made this resolve to "/scan-and-fixes.json".
+          path: ${{ runner.temp }}/signetry/scan-and-fixes.json
           if-no-files-found: ignore