fix(drift-audit): close four blind spots that hid the displayxr-common pin drift - #820
Merged
Merged
Conversation
…n drift The weekly drift-audit ran green through the whole 2026-08 common-pin drift (demos on v2.0.0/v2.1.0/v2.3.1 while common was v2.5.0, and cef-host pinned to a commit reachable from no branch). Four gaps, all in the pin check: 1. PIN_CONSUMERS listed only runtime/shell-pvt/leia-plugin/cef-host — every displayxr-demo-* repo was never audited at all. Added all five. 2. CMAKE_CANDIDATES lacked common/CMakeLists.txt, which is exactly where the demos declare their FetchContent pins. Without it, adding the demos in (1) would still have found nothing. 3. A pin that is not a vX.Y.Z tag (raw SHA, branch) makes semver_key() return None, so the `if latest and pk and lk` guard skipped it in silence. That is precisely how cef-host's dangling-SHA pin stayed invisible — the most dangerous case was the one check couldn't see. Non-tag pins are now their own `non-tag-pin` finding. 4. Submodule-pinned consumers were invisible to a FetchContent-only scan (displayxr-unreal). Added a submodule pass that reads .gitmodules and resolves the pinned sha back to a tag. (4) is deliberately self-discovering — SUBMODULE_CONSUMERS is a bare repo list and paths come from .gitmodules — so it cannot rot when a repo restructures or drops the submodule (unreal#37 is doing exactly that). A repo with no .gitmodules is a silent skip, never a finding. tag_for_sha() uses repos/:repo/tags for the DEREFERENCED commit.sha: release tags here are annotated, so git/ref/tags/:tag returns the tag-object sha, which never equals the commit a submodule pins — every lookup would have missed and reported a bogus non-tag-pin. Cached per repo, so it costs one paginated call. Verified against the live org: the scan now discovers common pins for gauss/modelviewer/avatar/earthview (previously none) and resolves unreal's submodule 0e8001fd -> v2.5.0. Synthetic checks cover the raw-SHA branch, SHA extraction from CMake, .gitmodules parsing, and the absent-.gitmodules skip. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011Y7bAdR1cFTNxadD5moCtk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The weekly
drift-auditworkflow ran green every Monday straight through thedisplayxr-commonpin drift we cleaned up today — demos sitting on v2.0.0 / v2.1.0 / v2.3.1 while common was v2.5.0, anddisplayxr-cef-hostpinned to a commit reachable from no branch in common (it resolved only because GitHub still serves unreachable objects; a GC would have broken that build with no warning).The audit already had a
displayxr-common pin spreadcheck. It just couldn't see any of it. Four gaps:PIN_CONSUMERSomitted everydisplayxr-demo-*repoCMAKE_CANDIDATESlackedcommon/CMakeLists.txt— where the demos declare their pinsif latest and pk and lkguard silentlynon-tag-pinfinding.gitmodulespass#3 is the one that mattered. 1/2/4 produce stale-but-valid pins — untidy. #3 hid a pin that could break a build with zero warning. The most dangerous case was the one the check was structurally unable to see.
Design notes
SUBMODULE_CONSUMERSis a bare repo list; paths come from.gitmodules. A hardcoded{repo: {path: dep}}map would rot the moment a repo restructures — and feat!: runtime owns the view math via XR_DXR_view_rig; drop the displayxr-common submodule displayxr-unreal#37 is dropping this submodule right now. Absent.gitmodules= silent skip, never a finding.tag_for_sha()usesrepos/:repo/tagsfor the dereferencedcommit.sha. Release tags here are annotated, sogit/ref/tags/:tagyields the tag-object sha, which never equals the commit a submodule pins — every lookup would miss and emit a bogusnon-tag-pin. Cached per repo → one paginated call.Verification
Run against the live org, the scan now discovers what it previously could not:
unreal resolving to a tag (rather than
None) is also the proof that the annotated-tag handling is right.Synthetic checks cover the paths no repo exhibits anymore: raw-SHA is unrankable → takes the new branch; SHA pins extract from real CMake text;
.gitmodulesparses; absent.gitmodulesyields no finding.A full
--dry-runis clean for common (everything is v2.5.0 as of today) and still reports the pre-existing unrelateddisplayxr-mcpv0.5.0→v0.5.2 lag.Not in this PR
DRIFT_AUDIT_TOKENis unset, so the workflow falls back toGITHUB_TOKEN: private repos are skipped and cross-repo issues can't be opened (the Jul 27 run only managed an issue on runtime itself). That's a secret to set, not a code change — flagging it so the audit's reach isn't overestimated.🤖 Generated with Claude Code
https://claude.ai/code/session_011Y7bAdR1cFTNxadD5moCtk