From 0842217aef4e6e4eafd843d43df7bdfde4f9fe62 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 19 Jun 2026 17:55:33 +0000 Subject: [PATCH 1/3] chore(deps): update stranske/workflows digest to c2537cc --- templates/consumer-repo/.github/workflows/agents-guard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/consumer-repo/.github/workflows/agents-guard.yml b/templates/consumer-repo/.github/workflows/agents-guard.yml index a58c5ccaf..7035b86ec 100644 --- a/templates/consumer-repo/.github/workflows/agents-guard.yml +++ b/templates/consumer-repo/.github/workflows/agents-guard.yml @@ -111,7 +111,7 @@ jobs: github.event_name == 'pull_request_target' && steps.eligibility.outputs.should-run == 'true' && steps.api_client_base.outputs.available != 'true' - uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1 + uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1 with: secrets: ${{ toJSON(secrets) }} github_token: ${{ github.token }} @@ -180,7 +180,7 @@ jobs: steps.eligibility.outputs.should-run == 'true' && github.event_name == 'pull_request' && steps.api_client_head.outputs.available != 'true' - uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1 + uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1 with: secrets: ${{ toJSON(secrets) }} github_token: ${{ github.token }} From 1c6bafa13452ad3b3d96d8c786a64dae91d0fa8c Mon Sep 17 00:00:00 2001 From: stranske Date: Sun, 21 Jun 2026 23:50:00 -0500 Subject: [PATCH 2/3] test: refresh agents-guard drift fingerprint --- config/template-drift-allowlist.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/template-drift-allowlist.txt b/config/template-drift-allowlist.txt index 857011ebb..8ec7389e7 100644 --- a/config/template-drift-allowlist.txt +++ b/config/template-drift-allowlist.txt @@ -82,8 +82,8 @@ reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA main = .github/workflows/agents-guard.yml template = templates/consumer-repo/.github/workflows/agents-guard.yml main_sha256 = 382d27aaaaab05866b77f2b573b36d3e0cf43f3db3185bf93ffd4c44564d8403 -template_sha256 = 98e2570a857de11e2f1be9d18b940533b48a3522ff1ee9d52cec2cc9d721f4cc -reason = Intentional divergence re-baselined 2026-06-19: root and consumer guard workflows differ for pinned consumer actions/App-token setup; consumer setup-api-client pins were refreshed to the Workflows v1.15.1 release digest. +template_sha256 = e8a3aa056677c2eea0695c8953d211538e7b238c42f97c2434f19a2a964a42dd +reason = Intentional divergence re-baselined 2026-06-22: root and consumer guard workflows differ for pinned consumer actions/App-token setup; consumer setup-api-client pins were refreshed to the current Workflows main digest c2537cc. [pair.11] main = .github/workflows/agents-issue-optimizer.yml From 80f99e92b2f0c457841e11e77653acf13a349d1d Mon Sep 17 00:00:00 2001 From: Tim Stranske Date: Mon, 22 Jun 2026 00:28:49 -0500 Subject: [PATCH 3/3] fix: tolerate stale ledger commits in gate --- .github/workflows/pr-00-gate.yml | 2 + scripts/ledger_validate.py | 7 +- tests/scripts/test_ledger_validate.py | 76 +++++++++++++++++++ .../test_workflow_agents_consolidation.py | 4 + 4 files changed, 87 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-00-gate.yml b/.github/workflows/pr-00-gate.yml index 3d7fe57fb..ad9c63c29 100644 --- a/.github/workflows/pr-00-gate.yml +++ b/.github/workflows/pr-00-gate.yml @@ -392,6 +392,8 @@ jobs: - environment-gate if: ${{ needs.detect.outputs.doc_only != 'true' }} runs-on: ubuntu-latest + env: + LEDGER_VALIDATE_ALLOW_SHALLOW: "1" steps: - name: Mint GitHub App Token id: app_token diff --git a/scripts/ledger_validate.py b/scripts/ledger_validate.py index 67a45a36c..5161d6bbc 100755 --- a/scripts/ledger_validate.py +++ b/scripts/ledger_validate.py @@ -574,8 +574,11 @@ def main(argv: list[str] | None = None) -> int: ledgers = find_ledgers(args.paths) - # Pre-fetch all unique commits in bulk to avoid O(tasks) individual fetches. - _prefetch_commits(ledgers) + # Pre-fetch all unique commits in bulk when commit reachability is a hard + # requirement. PR/manual Gate runs can tolerate unreachable historical + # commits, so fetching every stale SHA only slows the job and adds noise. + if not _allow_missing_commit(): + _prefetch_commits(ledgers) results: dict[str, list[str]] = {} for path in ledgers: diff --git a/tests/scripts/test_ledger_validate.py b/tests/scripts/test_ledger_validate.py index 44043d511..fc6ac4826 100644 --- a/tests/scripts/test_ledger_validate.py +++ b/tests/scripts/test_ledger_validate.py @@ -609,6 +609,82 @@ def test_main_reports_validated_ledgers(tmp_path: Path, monkeypatch, capsys) -> assert f"Validated {ledger_path}" in capsys.readouterr().out +def test_main_skips_prefetch_when_missing_commits_allowed( + tmp_path: Path, monkeypatch, capsys +) -> None: + ledger_validate = _load_module(monkeypatch, tmp_path) + ledger_path = tmp_path / "ledger.yml" + ledger_path.write_text( + yaml.safe_dump( + { + "version": 1, + "issue": 1, + "base": "main", + "branch": "feature", + "tasks": [ + { + "id": "task-1", + "title": "Done", + "status": "done", + "commit": "abcdef1", + }, + ], + } + ), + encoding="utf-8", + ) + + monkeypatch.setenv("LEDGER_VALIDATE_ALLOW_SHALLOW", "1") + monkeypatch.setattr(ledger_validate, "find_ledgers", lambda paths: [ledger_path]) + monkeypatch.setattr( + ledger_validate, + "_prefetch_commits", + lambda ledgers: pytest.fail("prefetch should not run in allowed-missing mode"), + ) + + def raise_commit_files(_commit): + raise ledger_validate.LedgerError("missing") + + monkeypatch.setattr(ledger_validate, "_commit_files", raise_commit_files) + + exit_code = ledger_validate.main([]) + + assert exit_code == 0 + assert f"Validated {ledger_path}" in capsys.readouterr().out + + +def test_main_prefetches_when_missing_commits_are_strict(tmp_path: Path, monkeypatch) -> None: + ledger_validate = _load_module(monkeypatch, tmp_path) + ledger_path = tmp_path / "ledger.yml" + ledger_path.write_text( + yaml.safe_dump( + { + "version": 1, + "issue": 1, + "base": "main", + "branch": "feature", + "tasks": [ + {"id": "task-1", "title": "Ok", "status": "todo"}, + ], + } + ), + encoding="utf-8", + ) + + prefetch_calls: list[list[Path]] = [] + + monkeypatch.setenv("LEDGER_VALIDATE_STRICT", "1") + monkeypatch.setattr(ledger_validate, "find_ledgers", lambda paths: [ledger_path]) + monkeypatch.setattr( + ledger_validate, + "_prefetch_commits", + lambda ledgers: prefetch_calls.append(list(ledgers)), + ) + + assert ledger_validate.main([]) == 0 + assert prefetch_calls == [[ledger_path]] + + def test_main_reports_no_ledgers(tmp_path: Path, monkeypatch, capsys) -> None: ledger_validate = _load_module(monkeypatch, tmp_path) monkeypatch.setattr(ledger_validate, "find_ledgers", lambda paths: []) diff --git a/tests/workflows/test_workflow_agents_consolidation.py b/tests/workflows/test_workflow_agents_consolidation.py index 1d87988c2..3a8e2c8a5 100644 --- a/tests/workflows/test_workflow_agents_consolidation.py +++ b/tests/workflows/test_workflow_agents_consolidation.py @@ -987,6 +987,10 @@ def test_gate_workflow_uses_fork_head_for_script_tests_and_ledger(): ), "github-scripts-tests checkout must use the contributor head commit" ledger_job = jobs.get("ledger-validation") or {} + ledger_env = ledger_job.get("env") or {} + assert ( + ledger_env.get("LEDGER_VALIDATE_ALLOW_SHALLOW") == "1" + ), "Ledger validation must tolerate unreachable historical commits in PR/manual Gate runs" ledger_steps = ledger_job.get("steps") or [] assert ledger_steps, "ledger-validation job must define steps" ledger_checkout = next(