From c05b83454a95fd9ef9c8269a26f5d94bd5619010 Mon Sep 17 00:00:00 2001
From: Kevin Longe <273747162+kvlonge@users.noreply.github.com>
Date: Thu, 5 Nov 2026 08:58:57 +0000
Subject: [PATCH] ci: fail on unread control-store state, unconstructed
 variants and new duplicates

XSB076 and XSB077 move from warn to select, so fensu check fails on them; check-ci ran fensu check
without --warn, so in warn mode they were never evaluated. Their reasoned allowlists and exceptions
stay, and stale or malformed entries remain faults. check-dupes-new now fails on new duplicated
code and fails when its base is missing instead of skipping. Verify fetches the base on every
event, origin/main for a manual run.
---
 .github/workflows/verify.yml |  7 +++----
 Makefile                     | 14 +++++---------
 fensu.toml                   |  3 +--
 3 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 4b74a19ae4..9396640457 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -279,11 +279,10 @@ jobs:
         run: uv python install 3.12
       - name: Install dependencies
         run: uv sync --locked --all-groups --all-extras
-      - name: Fetch pull request base for the new-duplicate check
-        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
-        run: git fetch --no-tags --depth=1 origin "$BASE_SHA"
+      - name: Fetch the base for the new-duplicate check
+        run: git fetch --no-tags --depth=1 origin "$BASE_REF"
         env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || 'main:refs/remotes/origin/main' }}
       - name: Run static checks
         run: make check-ci
         env:
diff --git a/Makefile b/Makefile
index f1bc9ed265..1ec05742cd 100644
--- a/Makefile
+++ b/Makefile
@@ -562,20 +562,16 @@ dupes:
 	uv run fensu dupes
 
 
-# Warn mode: report new duplicated code since DUPES_BASE without failing the build.
+# Fails on duplicated code new since DUPES_BASE. A missing base fails too, so the check cannot
+# silently disappear.
 DUPES_BASE ?= origin/main
 
 check-dupes-new:
 	@if ! git rev-parse --verify --quiet "$(DUPES_BASE)^{commit}" >/dev/null; then \
-		echo "warning: skipped new-duplicate check: base $(DUPES_BASE) is not available"; \
-		exit 0; \
+		echo "error: new-duplicate check needs base $(DUPES_BASE); fetch it or set DUPES_BASE" >&2; \
+		exit 2; \
 	fi; \
-	uv run fensu dupes --since "$(DUPES_BASE)" --fail-on-new; rc=$$?; \
-	if [ $$rc -eq 1 ]; then \
-		echo "warning: new duplicated code above (warn mode: this check does not fail yet)"; \
-	elif [ $$rc -ne 0 ]; then \
-		exit $$rc; \
-	fi
+	uv run fensu dupes --since "$(DUPES_BASE)" --fail-on-new
 
 
 check:
diff --git a/fensu.toml b/fensu.toml
index 1c38e596d6..36f7e53a9d 100644
--- a/fensu.toml
+++ b/fensu.toml
@@ -1540,8 +1540,7 @@ rule_modules = [
     "scripts.fensu_policy.rules.native_boundary",
     "scripts.fensu_policy.rules.unused_state",
 ]
-select = ["FPRS", "XSB072", "XSB073", "XSB075"]
-warn = ["XSB076", "XSB077"]
+select = ["FPRS", "XSB072", "XSB073", "XSB075", "XSB076", "XSB077"]
 
 [targets.rust.rule_options.XSB076]
 schema_paths = ["crates/sqlbuild-orchestration/src/store"]