Skip to content

fix(ci): governance-enforce gate can pass having scanned nothing #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yakimoto wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(ci): governance-enforce gate can pass having scanned nothing #39

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b1958cf
fix(ci): enforce gate scanned a partial range and could pass having r…
yakimoto Aug 6, 2026
aac2627
fix(ci): floor governance enforcer at 0.4.6 so the empty-tree base ca…
yakimoto Aug 6, 2026
defc1a5
fix(ci): guard the diff base for resolvability so a force-push falls …
yakimoto Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions .github/workflows/governance-enforce.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ name: governance-enforce

on:
pull_request:
merge_group:

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 merge_group trigger added only to this workflow

merge_group is added here but no other workflow in .github/workflows/ (_checks.yml, foundation-gate.yml, go-lint.yml, public-repo-guard.yml) listens for it. If a merge queue is enabled and those checks are also required, merge-queue entries will stall waiting for checks that never report. Either the queue isn't enabled yet (in which case this is a no-op) or the other required workflows need the same trigger.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

push:
branches: [main, master]

Expand Down Expand Up @@ -35,15 +36,29 @@ jobs:
run: |
mkdir -p "$RUNNER_TEMP/gov" && cd "$RUNNER_TEMP/gov"
printf '@wave-av:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' > .npmrc
npm install @wave-av/governance@^0.4.4 --no-save --no-audit --no-fund
# Floor is 0.4.6, not 0.4.4: the published 0.4.4/0.4.5 diff lister fails OPEN (any git
# error, including a tree-object base, yields "0 changed file(s) scanned" and exit 0).
# 0.4.6 diffs two-dot (`git diff <base> HEAD`, which accepts the empty-tree object the
# indeterminate-base fallback supplies) and fails closed on any git listing error.
npm install @wave-av/governance@^0.4.6 --no-save --no-audit --no-fund
- name: A_BLOCK enforce (secrets + hardcoded paths on the diff)
env:
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
MERGE_BASE_SHA: ${{ github.event.merge_group.base_sha }}
PUSH_BEFORE_SHA: ${{ github.event.before }}
run: |
BASE="${PR_BASE_SHA:-$PUSH_BEFORE_SHA}"
if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
BASE=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
BASE="${PR_BASE_SHA:-${MERGE_BASE_SHA:-$PUSH_BEFORE_SHA}}"
if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ] \
|| ! git cat-file -e "$BASE^{commit}" 2>/dev/null; then
# Indeterminate base: first push (before-SHA is all zeros) or force-push (before-SHA is
# the orphaned old tip, which the clone cannot resolve — hence the cat-file guard; the
# fail-closed enforcer would otherwise hard-fail on a raw git error). Do NOT silently
# scan a partial range — HEAD~1 would skip earlier commits in a multi-commit push and
# let a violation through (a config-no-silent-noop hole). Diff the full tree against
# git's empty-tree object so every introduced file is scanned; loud, never a silent
# empty/partial pass.
BASE=$(git hash-object -t tree /dev/null)
echo "::warning::indeterminate diff base; scanning full tree (empty-tree base) so no commit is skipped"
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.
Comment on lines +53 to +61

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Empty-tree fallback turns the diff-scoped gate into a whole-repo scan

The fallback replaces an unresolvable/zero base with git's empty-tree object, so the enforcer diffs the entire tree and scans every tracked file. That contradicts the workflow header's stated design (.github/workflows/governance-enforce.yml:3-6: "Diff-scoped: blocks NEW violations without failing on legacy debt"). The fallback is reachable on first pushes and force-pushes to main/master, where any pre-existing (legacy) secret-pattern or hardcoded-path finding anywhere in the repo will now hard-fail the required enforce check on the default branch rather than on a PR. The trade-off is deliberate per the inline comment, but it's worth confirming the repo is currently clean under a full-tree scan so a force-push doesn't permanently red the branch.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

fi
echo "diffing against $BASE"
node "$RUNNER_TEMP/gov/node_modules/@wave-av/governance/bin/enforce.mjs" --changed "$BASE"
Loading