DO NOT MERGE: negative control for BLO-23511 workflow-parse gate - #1430
Closed
allyblockcast[bot] wants to merge 2 commits into
Closed
DO NOT MERGE: negative control for BLO-23511 workflow-parse gate#1430allyblockcast[bot] wants to merge 2 commits into
allyblockcast[bot] wants to merge 2 commits into
Conversation
An unparseable workflow produces zero jobs, so it cannot fail any gate. GitHub manufactures a run that completes instantly with `conclusion: failure` and `jobs: []`, and every required check stays green because the broken workflow never ran. `docker-agent.yml` was unparseable on master for ~19h (f94d521 -> b6ac6af): no toolchain build, no image promote, no cluster image bump. The job that broke the file was the `alert-on-failure` job added to detect that very workflow failing, so the alert could never fire. `check-github-runner-labels.mjs` reads these same files but scans them line by line, and a line scanner reads a structurally broken file happily — so the repo had a workflow-scanning gate constitutionally unable to detect a workflow that does not parse. Adds actionlint to the `policy` job, pinned by version and SHA256. The `policy` job never installs node_modules (setup-pnpm runs with the default `run_install: false`) and `js-yaml` is only a version constraint in package.json, not a dependency; declaring one would change pnpm-lock.yaml, which `Block manual lockfile edits` rejects in the same job. A static binary sidesteps both, parses with a real YAML parser, and checks more besides. The gate fails closed. A missing binary or an empty workflow set is an error, not a skip — quietly no-opping would reproduce the exact bug being fixed. `-shellcheck=`/`-pyflakes=` are pinned off so the verdict depends on the pinned binary alone rather than on what a runner happens to preinstall. Verified: rejects f94d521's docker-agent.yml at line 409, the exact line the YAML parser cites; passes all 25 workflows on master. Refs BLO-23511 Refs BLO-23128
…gent.yml (BLO-23511) Deliberately reintroduces the exact broken workflow from f94d521 to prove the BLO-23511 parse gate fires. Expected: policy job red at docker-agent.yml:409. This branch is a throwaway demonstration and must never merge. Refs BLO-23511
Author
|
🔗 Paperclip issue: BLO-23511 |
1 similar comment
Author
|
🔗 Paperclip issue: BLO-23511 |
Author
|
Hey @allyblockcast[bot]! Before this PR can be reviewed, a few things need attention: Missing or incomplete:
Once updated, push a new commit and these checks will re-run automatically. — commitperclip |
Author
|
Negative control complete — closing as planned. Never intended to merge. Result: the gate fired exactly as specified. Run: https://github.com/Blockcast/paperclip/actions/runs/32304796388/job/96235109283 Line 409 — the exact line the YAML parser cites in BLO-23511. Refs BLO-23511 |
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Throwaway. Do not merge. Will be closed as soon as CI reports.
Negative control for #1429. Contains that PR's gate plus a deliberate break:
f94d5212's unparseabledocker-agent.yml, restored verbatim.A gate that only passes on valid input has not been shown to work. Expected result: the required
policyjob goes red atdocker-agent.yml:409— and note that without the gate this same break produces an instant 0-job run and every check stays green, which is the entire defect.Refs BLO-23511