Repository navigation
doctor: resolve mediated pins and stop judging changelog history (#310) - #316
Merged
Merged
Conversation
Two release-gate false findings from products adopting the gate:
- A workflow install step that indirects through a variable
(`rivet.git#${{ env.RIVET_PIN }}`, `${RIVET_PIN}`, `$env:RIVET_PIN`)
read as an empty ref, because the ref position stopped at the dollar
sign. The pin regex now matches the mediation forms, resolves the name
against the same file's env block (top-level and job-level), and an
unresolvable mediation stays a finding — fail safe, like the empty-ref
incident class.
- The tag-vs-installed comparison ran on markdown prose too, so a
released changelog section describing its past pin failed forever.
The comparison now runs only on configuration files (.yml/.yaml/.rkt/
.rktd); the shape-based empty-ref check still applies everywhere.
Tests: mediated+resolved passes, undefined variable fails naming the
variable, resolved wrong tag fails the comparison, changelog prose with
a past tag passes, empty ref in prose still fails.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #310.
Products adopting
raco rivet doctor --releasehit two false findings, both from the pin scanner's text-level view:Env-mediated pins read as empty refs. A workflow install step like
rivet.git#${{ env.RIVET_PIN }}(or${RIVET_PIN},$env:RIVET_PIN) captured zero characters of[A-Za-z0-9._-]and was classified as the autarx empty-ref incident. The scanner now recognizes the three mediation forms, resolves the name against the same file'senv:block (top-level and job-level), and classifies the resolved value normally. A mediation the file cannot resolve stays a finding naming the variable — fail safe, consistent with the incident class the gate exists for.Historical pins in prose. The tag-vs-installed comparison ran on
.mdfiles, so a released changelog section documenting its own past pin (rivet.git#v0.11.0in the 0.7.0 notes) failed against every future installed release. The comparison now runs only on configuration files (.yml/.yaml/.rkt/.rktd); the shape-based empty-ref check still applies everywhere, since an empty ref is suspicious regardless of context.Tests extend the release-gate suite in
rivet/tests/doctor.rkt: mediated-and-resolved passes; undefined variable fails naming the variable; resolved wrong tag fails the comparison; changelog prose with a past tag passes; empty ref in prose still fails.Verified against the regexmate repository (the reporter): the two inlined-SHA workflows and the reworded changelog stay green, and the synthetic mediated/undefined/wrong-tag/prose cases classify exactly as the tests assert.