ci: fix paths-filter shallow-clone race and scorecard allowlist#2089
Merged
Conversation
Two infra bugs caused every recent push-to-main to show red. 1. `dorny/paths-filter` races on shallow checkouts. On `push:` events it fetches the base SHA and `main` via two back-to-back `git fetch --depth=1` calls that both rewrite `.git/shallow`; the second loses with `fatal: shallow file has changed since we read it`. Adding `fetch-depth: "0"` to the Detect Changes checkout step in ci.yml, cli.yml, codspeed.yml, and docker.yml puts both refs in the local repo, so paths-filter skips the remote fetches entirely. `lighthouse.yml` runs paths-filter on `pull_request` only and is not affected. 2. `ossf/scorecard-action` enforces a workflow-step allowlist on the job that contains it. Our local retry-wrapped composite `Aureliolo/synthorg/.github/actions/checkout` is not allowlisted, so Scorecard rejected every push with HTTP 400 `job has unallowed step`. Switching the scorecard job to `actions/checkout@<v6-sha>` direct fixes it. The `report-failure` job keeps the retry composite since the allowlist only applies to the job containing scorecard-action. Also found and fixed a latent similar bug in the same sweep: the "Enforce at most one new revision per PR" step in `schema-validate` uses `git diff <base>...HEAD` (three-dot, merge-base form) against a shallow checkout, which is undefined when histories don't intersect. Added `fetch-depth: "0"` on that job's checkout too. Closes nothing -- ad-hoc CI fix.
Contributor
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (30)
🧰 Additional context used📓 Path-based instructions (1)!(src/synthorg/persistence/**)📄 CodeRabbit inference engine (CLAUDE.md)
Files:
🔇 Additional comments (5)
WalkthroughThis PR fixes git checkout depth issues across five GitHub Actions workflows. In Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
coderabbitai
Bot
added
type:infra
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2089 +/- ##
=======================================
Coverage 87.11% 87.11%
=======================================
Files 2251 2251
Lines 130269 130269
=======================================
Hits 113481 113481
Misses 16773 16773
Partials 15 15 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Aureliolo
pushed a commit
that referenced
this pull request
May 24, 2026
<!-- HIGHLIGHTS_START --> ## Highlights > _AI-generated summary (model: `openai/gpt-4.1-mini` via GitHub Models). Commit-based changelog below._ ### What you'll notice - New brownfield codebase intake mode supports merger and acquisition scenarios. - Added deep CEO interview feature to improve project charter creation. - Introduced mission control and flight recorder operator cockpit for better operational oversight. - Research mode added for enhanced exploratory work. - Runtime services now log safety-spine state at boot for clearer diagnostics. ### What's new - Research mode feature enables deeper data exploration. - CEO interview integration helps shape project charters. - Mission control and flight recorder cockpit introduced for operational tracking. ### Under the hood - Improved codebase modularity with module-size gates and lint tightening. - Added __init__.py to 21 test directories for better test discovery. - Promoted six transitive dependencies to direct dependencies for clarity. - Split codespell ignore list into vocabulary and source renames. - Decomposed oversized web utilities, hooks, and libraries for maintainability. - Enhanced CI with Lychee link checker integration and retry logic for cosign signing. - Sharded unit and integration tests and added Postgres service container in CI. - Updated infrastructure and web dependencies; maintained lock files. <!-- HIGHLIGHTS_END --> :robot: I have created a release *beep* *boop* --- ## [0.8.8](v0.8.7...v0.8.8) (2026-05-24) ### Features * brownfield codebase intake (merger/acquisition entry mode) ([#2042](#2042)) ([e287621](e287621)), closes [#1975](#1975) * deep CEO interview to project charter ([#2045](#2045)) ([904f2fb](904f2fb)) * mission control + flight recorder operator cockpit ([#2044](#2044)) ([1c2660b](1c2660b)) * research mode ([#2041](#2041)) ([f81a5ac](f81a5ac)), closes [#1989](#1989) * surface safety-spine state in runtime-services boot log (closes [#2096](#2096)) ([#2097](#2097)) ([f187b31](f187b31)) ### Refactoring * add __init__.py to 21 leaf test directories (INP001) ([#2081](#2081)) ([2592118](2592118)), closes [#2064](#2064) * codebase modularity (1/4) - module-size gates + lint tightening + tools ([#2078](#2078)) ([556fbd9](556fbd9)), closes [#2047](#2047) [#2040](#2040) * promote 6 transitive deps to direct deps ([#2083](#2083)) ([adedc6a](adedc6a)) * split codespell ignore-words-list into vocab + source renames ([#2085](#2085)) ([917d98a](917d98a)), closes [#2074](#2074) * **web:** PR A foundation, decompose oversized utils/hooks/lib ([#2092](#2092)) ([#2098](#2098)) ([aedbba5](aedbba5)) ### CI/CD * exclude slsa.dev from lychee (transient timeout on canonical badge) ([#2090](#2090)) ([346c51d](346c51d)) * fix paths-filter shallow-clone race and scorecard allowlist ([#2089](#2089)) ([7cd7ce8](7cd7ce8)) * refresh .test_durations.{unit,integration} ([#2087](#2087)) ([ddf2d86](ddf2d86)) * retry cosign sign on transient GHCR/Rekor failures ([#2100](#2100)) ([da9422a](da9422a)) * shard test-unit + test-integration, sysmon coverage, Postgres service container ([#2080](#2080)) ([0768787](0768787)) * wire Lychee link-checker (workflow + installer + pre-push hook) ([#2084](#2084)) ([1c0694a](1c0694a)) ### Maintenance * Lock file maintenance ([#2086](#2086)) ([a78810a](a78810a)) * Update Infrastructure dependencies ([#2055](#2055)) ([041ad8b](041ad8b)) * Update Web dependencies ([#2054](#2054)) ([4d57b9a](4d57b9a)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: synthorg-repo-bot[bot] <279117679+synthorg-repo-bot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two infra bugs caused every recent push to
mainto show red. Both are CI-infra failures, not code regressions.Why
1.
dorny/paths-filterraces on shallow checkouts (push events tomain).The action compares the pushed range by fetching
${{ github.event.before }}andmainwith two back-to-backgit fetch --depth=1calls. Both rewrite.git/shallow, and the second loses with:The whole
Detect Changesjob dies, so every downstream job (Lint,Type Check, all the unit / integration test shards, etc.) is skipped andCI Passfails. The race only fires onpush:events because, on PRs,actions/checkouthas already fetched the base and paths-filter's localgit cat-file -echeck short-circuits both fetches.The race is intermittent (depends on git/fs timing on the runner), which is why
codspeed.ymlanddocker.ymlhave the same setup but happened to win recent rolls. Last four commits tomainall lost: 917d98a, adedc6a, 72c6648, 2592118.Fix: add
fetch-depth: "0"to theDetect Changescheckout in every workflow that runs paths-filter on apush:trigger. With both refs already local, paths-filter skips the remote fetches entirely. Workflows touched:ci.yml(was failing)cli.yml(was failing)codspeed.yml(preemptive — same shape, same race waiting to fire)docker.yml(preemptive — same shape)lighthouse.ymlispull_request-only and unaffected; left alone.2.
ossf/scorecard-actionrejects the local retry-wrapped checkout composite.Scorecard enforces a workflow-step allowlist on the job containing it. Our local
Aureliolo/synthorg/.github/actions/checkoutcomposite is not on that allowlist, so every push (and the weekly schedule) returns:Fix: in
scorecard.yml, thescorecardjob switches toactions/checkout@de0fac2…(same v6 SHA pinned inside the composite). Thereport-failurejob keeps the retry-wrapped composite — the allowlist only applies to the job containingscorecard-action.Latent similar bug surfaced during the sweep
The
schema-validatejob's "Enforce at most one new revision per PR" step runs:A...B(three-dot) isgit diff $(git merge-base A B) B, which is undefined when the local clone has no ancestry shared between the two shallow tips. Depending on which commit happened to be the shallow root, the gate would either miss legitimate additions or fire false positives. Addedfetch-depth: "0"on the same checkout and dropped the now-redundant--depth=1from the explicit fetch.Holistic sweep (negative findings)
To make sure this fix is complete, I grepped for the two underlying patterns across
.github/andscripts/:ci.yml:248was buggy.auto-rollover.yml,dev-release.yml,graduate.yml,secret-scan.yml, and thecliperf-regression job (line 207) already setfetch-depth: 0where they need it.ossf/*,step-security/harden-runner,github/codeql-action/init). Only Scorecard restricts caller steps; nothing else uses the local composite under a similar policy.check_cli_bench_regression.sh,check_no_review_origin_in_code.py,check_no_migration_framing.py,compute_release_cadence.py). The only one that needs history ischeck_cli_bench_regression.sh, and its caller already hasfetch-depth: 0.Intentionally NOT doing
dorny/paths-filter— the race is shallow-clone semantics, not a paths-filter bug.fetch-depth: 1default — that's correct for most jobs; only detect-changes-style jobs need the override.actions/checkoutis a clean one-line workflow change.Verification
Passedon the five modified workflows.push:to main and the weekly schedule, so the allowlist fix will be exercised on the first post-merge push.