Skip to content

chore(deps): update stranske/workflows digest to c2537cc #2472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stranske merged 4 commits into from
Jun 22, 2026
+91 −6
Merged

chore(deps): update stranske/workflows digest to c2537cc #2472

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0842217
chore(deps): update stranske/workflows digest to c2537cc
renovate[bot] Jun 19, 2026
1c6bafa
test: refresh agents-guard drift fingerprint
stranske Jun 22, 2026
8de34ce
Merge branch 'main' into renovate/stranske-workflows-digest
stranske Jun 22, 2026
80f99e9
fix: tolerate stale ledger commits in gate
stranske Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/pr-00-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,6 +392,8 @@ jobs:
- environment-gate
if: ${{ needs.detect.outputs.doc_only != 'true' }}
runs-on: ubuntu-latest
env:
LEDGER_VALIDATE_ALLOW_SHALLOW: "1"
Comment on lines +395 to +396

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in ".github/workflows/pr-00-gate.yml" \
         "templates/consumer-repo/.github/workflows/pr-00-gate.yml"; do
  if [[ ! -f "$f" ]]; then
    echo "MISSING: $f"
    continue
  fi
  echo "=== $f ==="
  rg -n -C2 'ledger-validation|LEDGER_VALIDATE_ALLOW_SHALLOW' "$f" || true
done

Repository: stranske/Workflows

Length of output: 905

🏁 Script executed:

#!/bin/bash
# Get lines around the ledger-validation job in the template to see env section
sed -n '402,425p' templates/consumer-repo/.github/workflows/pr-00-gate.yml

Repository: stranske/Workflows

Length of output: 1005

Add LEDGER_VALIDATE_ALLOW_SHALLOW environment variable to the template's ledger-validation job.

The main gate workflow at .github/workflows/pr-00-gate.yml:395-396 includes LEDGER_VALIDATE_ALLOW_SHALLOW: "1" in the ledger-validation job env, but the distributed template at templates/consumer-repo/.github/workflows/pr-00-gate.yml does not have this setting. Per coding guidelines, workflow changes must be reflected in both locations to prevent fleet drift.

Add the env section to the template's ledger-validation job:

    env:
      LEDGER_VALIDATE_ALLOW_SHALLOW: "1"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-00-gate.yml around lines 395 - 396, The
ledger-validation job in the template workflow at
templates/consumer-repo/.github/workflows/pr-00-gate.yml is missing the
LEDGER_VALIDATE_ALLOW_SHALLOW environment variable that exists in the main
workflow. Locate the ledger-validation job in the template file and add an env
section containing LEDGER_VALIDATE_ALLOW_SHALLOW set to "1" to keep the template
synchronized with the main workflow and prevent fleet drift.

Source: Coding guidelines

steps:
- name: Mint GitHub App Token
id: app_token
Expand Down
4 changes: 2 additions & 2 deletions config/template-drift-allowlist.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,8 @@ reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA
main = .github/workflows/agents-guard.yml
template = templates/consumer-repo/.github/workflows/agents-guard.yml
main_sha256 = 382d27aaaaab05866b77f2b573b36d3e0cf43f3db3185bf93ffd4c44564d8403
template_sha256 = 98e2570a857de11e2f1be9d18b940533b48a3522ff1ee9d52cec2cc9d721f4cc
reason = Intentional divergence re-baselined 2026-06-19: root and consumer guard workflows differ for pinned consumer actions/App-token setup; consumer setup-api-client pins were refreshed to the Workflows v1.15.1 release digest.
template_sha256 = e8a3aa056677c2eea0695c8953d211538e7b238c42f97c2434f19a2a964a42dd
reason = Intentional divergence re-baselined 2026-06-22: root and consumer guard workflows differ for pinned consumer actions/App-token setup; consumer setup-api-client pins were refreshed to the current Workflows main digest c2537cc.

[pair.11]
main = .github/workflows/agents-issue-optimizer.yml
Expand Down
7 changes: 5 additions & 2 deletions scripts/ledger_validate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -574,8 +574,11 @@ def main(argv: list[str] | None = None) -> int:

ledgers = find_ledgers(args.paths)

# Pre-fetch all unique commits in bulk to avoid O(tasks) individual fetches.
_prefetch_commits(ledgers)
# Pre-fetch all unique commits in bulk when commit reachability is a hard
# requirement. PR/manual Gate runs can tolerate unreachable historical
# commits, so fetching every stale SHA only slows the job and adds noise.
if not _allow_missing_commit():
_prefetch_commits(ledgers)

results: dict[str, list[str]] = {}
for path in ledgers:
Expand Down
4 changes: 2 additions & 2 deletions templates/consumer-repo/.github/workflows/agents-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ jobs:
github.event_name == 'pull_request_target' &&
steps.eligibility.outputs.should-run == 'true' &&
steps.api_client_base.outputs.available != 'true'
uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1
uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1
with:
secrets: ${{ toJSON(secrets) }}
github_token: ${{ github.token }}
Expand Down Expand Up @@ -180,7 +180,7 @@ jobs:
steps.eligibility.outputs.should-run == 'true' &&
github.event_name == 'pull_request' &&
steps.api_client_head.outputs.available != 'true'
uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1
uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1
with:
secrets: ${{ toJSON(secrets) }}
github_token: ${{ github.token }}
Expand Down
76 changes: 76 additions & 0 deletions tests/scripts/test_ledger_validate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -609,6 +609,82 @@ def test_main_reports_validated_ledgers(tmp_path: Path, monkeypatch, capsys) ->
assert f"Validated {ledger_path}" in capsys.readouterr().out


def test_main_skips_prefetch_when_missing_commits_allowed(
tmp_path: Path, monkeypatch, capsys
) -> None:
ledger_validate = _load_module(monkeypatch, tmp_path)
ledger_path = tmp_path / "ledger.yml"
ledger_path.write_text(
yaml.safe_dump(
{
"version": 1,
"issue": 1,
"base": "main",
"branch": "feature",
"tasks": [
{
"id": "task-1",
"title": "Done",
"status": "done",
"commit": "abcdef1",
},
],
}
),
encoding="utf-8",
)

monkeypatch.setenv("LEDGER_VALIDATE_ALLOW_SHALLOW", "1")
monkeypatch.setattr(ledger_validate, "find_ledgers", lambda paths: [ledger_path])
monkeypatch.setattr(
ledger_validate,
"_prefetch_commits",
lambda ledgers: pytest.fail("prefetch should not run in allowed-missing mode"),
)

def raise_commit_files(_commit):
raise ledger_validate.LedgerError("missing")

monkeypatch.setattr(ledger_validate, "_commit_files", raise_commit_files)

exit_code = ledger_validate.main([])

assert exit_code == 0
assert f"Validated {ledger_path}" in capsys.readouterr().out


def test_main_prefetches_when_missing_commits_are_strict(tmp_path: Path, monkeypatch) -> None:
ledger_validate = _load_module(monkeypatch, tmp_path)
ledger_path = tmp_path / "ledger.yml"
ledger_path.write_text(
yaml.safe_dump(
{
"version": 1,
"issue": 1,
"base": "main",
"branch": "feature",
"tasks": [
{"id": "task-1", "title": "Ok", "status": "todo"},
],
}
),
encoding="utf-8",
)

prefetch_calls: list[list[Path]] = []

monkeypatch.setenv("LEDGER_VALIDATE_STRICT", "1")
monkeypatch.setattr(ledger_validate, "find_ledgers", lambda paths: [ledger_path])
monkeypatch.setattr(
ledger_validate,
"_prefetch_commits",
lambda ledgers: prefetch_calls.append(list(ledgers)),
)

assert ledger_validate.main([]) == 0
assert prefetch_calls == [[ledger_path]]


def test_main_reports_no_ledgers(tmp_path: Path, monkeypatch, capsys) -> None:
ledger_validate = _load_module(monkeypatch, tmp_path)
monkeypatch.setattr(ledger_validate, "find_ledgers", lambda paths: [])
Expand Down
4 changes: 4 additions & 0 deletions tests/workflows/test_workflow_agents_consolidation.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -987,6 +987,10 @@ def test_gate_workflow_uses_fork_head_for_script_tests_and_ledger():
), "github-scripts-tests checkout must use the contributor head commit"

ledger_job = jobs.get("ledger-validation") or {}
ledger_env = ledger_job.get("env") or {}
assert (
ledger_env.get("LEDGER_VALIDATE_ALLOW_SHALLOW") == "1"
), "Ledger validation must tolerate unreachable historical commits in PR/manual Gate runs"
ledger_steps = ledger_job.get("steps") or []
assert ledger_steps, "ledger-validation job must define steps"
ledger_checkout = next(
Expand Down
Loading