Skip to content

chore(actions): correct SHA pin version comments to the real tags - #30

Merged
bbasketballer75 merged 2 commits into
mainfrom
chore/normalize-action-pin-comments
Aug 4, 2026
Merged

chore(actions): correct SHA pin version comments to the real tags#30
bbasketballer75 merged 2 commits into
mainfrom
chore/normalize-action-pin-comments

Conversation

@bbasketballer75

@bbasketballer75 bbasketballer75 commented Aug 3, 2026

Copy link
Copy Markdown
Owner

What

Comment-only. Corrects the # vX labels beside three SHA-pinned actions so they match the tag the SHA actually points at.

Action SHA Comment said Actually is
actions/setup-python 5fda3b95a4ea… # v5 v7.0.0
actions/upload-artifact 043fb46d1a93… # v7 v7.0.1
actions/download-artifact d3f86a106a… # v4 v4.3.0

Every version was resolved against the GitHub tags API, not inferred.

Why

In this repo the pin comment is the human audit trail — it's the only way a reader knows what a 40-character hash means. lint.yml claimed # v5 while pinning v7.0.0, two majors off. That was already stale before #29: dependabot rewrites the SHA but never the comment, so the error survived the bump.

The other two are the same SHA carrying different labels in different files (# v7 in ci.yml, # v7.0.1 in tests.yml), which makes identical pins look divergent.

Safety

  • No SHA changed. Verified by diffing the changed lines and confirming all three hashes appear byte-identical on both - and + sides.
  • All 7 workflow files still parse as YAML.
  • No behavior change of any kind.

Deliberately not included

The upload/download-artifact version drift — tests.yml pairs upload v7.0.1 with download v8.0.1; docker.yml and js-autofix.yml pair v7.0.1 with v4.3.0.

Those work today. upload-artifact@v7 only breaks a v4 download when archive: false is set (v7's new direct-upload mode skips zipping), and no workflow here sets it. The v3→v4 backend split is the only genuine incompatibility, and everything is on v4+.

Normalizing download-artifact to v8 is a real behavior change — v8 errors on hash mismatch instead of warning, and no longer auto-unzips non-zipped files — so it belongs in its own reviewed PR rather than riding along with a comment fix.

Worth knowing: js-autofix.yml genuinely couples the two (job build uploads js-fix-patch, job apply-patch downloads it by name), so if anyone ever adds archive: false there, the v4 download breaks. That's the case to watch.

🤖 Generated with Claude Code

@bbasketballer75 @claude
chore(actions): correct SHA pin version comments to the real tags
569e371 
In this repo the `# vX` comment beside a SHA pin is the human audit trail --
it is the only way a reader knows what version a 40-char hash represents.
Three of them were wrong or imprecise. Resolved every pinned SHA against the
GitHub tags API and rewrote the comments to match.

  actions/setup-python@5fda3b95a4ea...     # v5      -> # v7.0.0   (WRONG)
  actions/upload-artifact@043fb46d1a93...  # v7      -> # v7.0.1   (imprecise)
  actions/download-artifact@d3f86a106a...  # v4      -> # v4.3.0   (imprecise)

The setup-python comment was the actual defect: it read `# v5` while pinning
v7.0.0 -- two majors off. It was already stale before the dependabot bump in
#29; dependabot rewrites the SHA but never the comment, so the error survived.
The other two are the same SHA carrying different labels in different files
(`# v7` in ci.yml, `# v7.0.1` in tests.yml), which makes the pins look like
they diverge when they do not.

Comment-only. Every SHA is byte-identical before and after -- verified by
diffing the changed lines and confirming all three hashes appear unchanged on
both sides. All 7 workflow files still parse as YAML. No behavior change.

Not included, deliberately: the upload/download-artifact *version* drift
(tests.yml pairs upload v7.0.1 with download v8.0.1; docker.yml and
js-autofix.yml pair v7.0.1 with v4.3.0). Those combinations work today --
upload-artifact v7 only breaks a v4 download when `archive: false` is set,
which no workflow here does, and the v3->v4 backend split is the only true
incompatibility. Normalizing download-artifact to v8 is a real behavior change
(v8 errors on hash mismatch and no longer auto-unzips non-zipped files), so it
belongs in its own reviewed PR rather than riding along with a comment fix.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings August 3, 2026 19:05
Copilot AI reviewed Aug 3, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates only the inline # vX.Y.Z audit comments next to SHA-pinned GitHub Actions in multiple workflows, so the human-readable tag labels match the actual tags those SHAs correspond to.

Changes:

  • Update actions/setup-python pinned-SHA comment from # v5 to # v7.0.0 in lint.yml.
  • Update actions/upload-artifact pinned-SHA comment to # v7.0.1 where it previously said # v7.
  • Update actions/download-artifact pinned-SHA comment to # v4.3.0 where it previously said # v4.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file
File Description
.github/workflows/skills-index.yml Updates actions/upload-artifact SHA pin comment to # v7.0.1 for consistent audit labeling.
.github/workflows/osv-scanner.yml Updates actions/download-artifact SHA pin comment to # v4.3.0 for accurate audit labeling.
.github/workflows/lockfile-diff.yml Updates actions/upload-artifact SHA pin comment to # v7.0.1 for accurate audit labeling.
.github/workflows/lint.yml Updates actions/setup-python SHA pin comment to # v7.0.0 to match the pinned SHA.
.github/workflows/js-autofix.yml Updates actions/download-artifact SHA pin comment to # v4.3.0 for accurate audit labeling.
.github/workflows/docker.yml Updates upload/download artifact action SHA pin comments to # v7.0.1 / # v4.3.0 for consistent audit labeling.
.github/workflows/ci.yml Updates actions/upload-artifact SHA pin comments to # v7.0.1 for consistent audit labeling.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@bbasketballer75

bbasketballer75 commented Aug 4, 2026

Copy link
Copy Markdown
Owner Author

Triage of the three failing checks. None are caused by this PR, which only edits inline # vX.Y.Z audit comments next to SHA pins — it changes no executable line.

1. Python tests / Run tests slice 8/8 — root-caused and fixed upstream.

Failure was assert adapter.send.call_count == 2 → assert 1 == 2 in tests/gateway/test_stream_consumer_fresh_final.py:79.

stream_consumer.py:1718 measures preview age with time.monotonic() - self._message_created_ts, and monotonic()'s epoch is arbitrary (on Linux, boot). The test sets _message_created_ts = 0.0 meaning "long ago", but that actually means "monotonic() seconds ago" — so on a freshly-booted runner the age falls under the 60s threshold, fresh-final never fires, and only one send happens.

That explains the intermittency: it passed on #26/#27/#28/#29 and failed on #25 and here. I originally called it a flake and re-ran it; that was the wrong call — it's deterministic given a low-uptime runner. Reproduced it exactly by patching time.monotonic to 12.0: the old code fails at line 79, the fix passes.

Fixed in NousResearch#78107. It will keep failing here until that lands or this branch picks it up.

2. Review label gate — needs the ci-reviewed label. This PR touches .github/workflows/**, so the gate fails by design until a maintainer applies it. Working as intended.

3. All required checks pass — aggregate; needs: includes review-labels, so it's downstream of #2.

Copilot's review generated no comments — it's an accurate summary of the pin-comment updates, with nothing to act on.

So: one real upstream bug (fixed), one gate awaiting a human label, one downstream aggregate.

🤖 Generated with Claude Code

@bbasketballer75 bbasketballer75 mentioned this pull request Aug 4, 2026
Merged
bbasketballer75 added a commit that referenced this pull request Aug 4, 2026
@bbasketballer75 @claude
test(stream-consumer): fix monotonic-epoch flake blocking fork CI
314eb41 
Backport of the fix proposed upstream in NousResearch#78107,
applied here so this fork's CI stops failing slice 8/8 on every PR while that
one is in review.

`stream_consumer.py:1718` computes preview age as
`time.monotonic() - self._message_created_ts`. monotonic()'s epoch is
arbitrary (on Linux, boot), so setting `_message_created_ts = 0.0` does not
mean "long ago" — it means "monotonic() seconds ago". On a freshly-booted
runner that is a handful of seconds, so the age falls under the 60s threshold,
fresh-final never fires, and `adapter.send.call_count` is 1 instead of 2.

That is why it is intermittent: it passed on #26/#27/#28/#29 and failed on
#25 and #30, purely as a function of runner uptime.

Fixed by anchoring to the same clock the production code reads. No assertion
weakened, no production code changed.

Verified: 10/10 in the file; and with time.monotonic patched to 12.0 to
simulate a host booted 12 seconds ago, the test passes where the old form
fails at line 79 — the exact CI failure.

Touches only tests/, so it does not trip the ci-reviewed workflow gate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@bbasketballer75 bbasketballer75 added the ci-reviewed CI-sensitive changes reviewed label Aug 4, 2026
@bbasketballer75
bbasketballer75 merged commit cfa4b25 into main Aug 4, 2026
55 checks passed
@bbasketballer75
bbasketballer75 deleted the chore/normalize-action-pin-comments branch August 4, 2026 03:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

ci-reviewed CI-sensitive changes reviewed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bbasketballer75