Carry the GitHub Action helper, un-ignoring its 13 tests - #33
Conversation
tests/conftest.py ignores a tooling test when its script is absent. scripts/
github_action.py was never synced here, so test_github_action.py has been
silently ignored - 13 tests that exist in this repo and have never run in it.
The script belongs here rather than in a sibling: it imports intentumdiff four
times and drives the PR-check surface for this package.
Verified from a bare clone: 9 pass, 4 fail with
RuntimeError: intentumdiff_rust_core compiled core not found for the C ABI
which is the clone having no built core, not a defect in the tests - the same
condition that makes the whole component-dependent suite unrunnable outside CI
(#22). CI provisions the core, so it is the verification.
## Two sibling scripts deliberately NOT synced
pre_commit_security_gate.py and security_prereq_check.py are also absent here,
also silently ignoring their tests (9 more). They are NOT included because
neither imports intentumdiff - one is a git pre-commit hook, the other checks
cargo/advisory-db prerequisites. Both are generic repo hygiene, equally
applicable to any repo in the estate, so "belongs in the python repo" is a
judgement rather than a fact and is left to the maintainer.
Adding files to a published repo on a plan's say-so is the same move as deleting
them on one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8dcabee53
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| config = load_project_diff_config(options.repo) | ||
| if options.fuel is not None: | ||
| config.plugin_fuel = options.fuel | ||
| if options.policy: | ||
| config.guardrail_policy_path = _policy_path(options.repo, options.policy) | ||
| else: | ||
| config.guardrail_policy_path = find_intentumdiff_config(options.repo) | ||
| config.guardrails_strict = options.strict |
There was a problem hiding this comment.
When a PR changes intentumdiff.yaml to set config.guardrails_enabled: false, this loads that untrusted head configuration before evaluating the diff; apply_guardrails_to_diff() then returns immediately, so even the normally immutable policy-file edit produces no violation and a strict action exits successfully. The default PR workflow therefore permits a change to disable the protection intended to review that same change; load the guardrail policy/settings from the base revision or force guardrails enabled for this check.
Useful? React with 👍 / 👎.
| commit_diff = differ_factory(config).diff_commit( | ||
| repo_path=options.repo, | ||
| old_ref=options.base_ref, | ||
| new_ref=options.head_ref, |
There was a problem hiding this comment.
When the base branch has advanced since the PR branch diverged, comparing the current base SHA directly with the head SHA includes base-only changes as reverse changes in the report. That can create unrelated semantic changes or strict guardrail failures for files the PR never touched; resolve the merge base of these refs and use it as old_ref, matching the PR's three-dot change set.
Useful? React with 👍 / 👎.
| for comment in comments: | ||
| body = str(comment.get("body", "")) if isinstance(comment, dict) else "" | ||
| if COMMENT_MARKER in body: | ||
| existing_id = comment.get("id") |
There was a problem hiding this comment.
If a PR participant posts a comment containing <!-- intentumdiff:summary --> before this runs, the marker-only search selects that comment and PATCHes it using the repository token, overwriting user-authored content. Verify the comment author or another action-owned identifier in addition to the marker before treating it as the sticky report.
Useful? React with 👍 / 👎.
1 participant
tests/conftest.pyignores a tooling test when its script is absent.scripts/github_action.pywas never synced here, sotest_github_action.pyhas been silently ignored — 13 tests that exist in this repo and have never run in it.The script belongs here rather than in a sibling: it imports
intentumdifffour times and drives the PR-check surface for this package.Verification
From a bare clone: 9 pass, 4 fail with
That is the clone having no built core, not a defect in the tests — the same condition that makes the whole component-dependent suite unrunnable outside CI (#22). CI provisions the core, so CI is the verification.
Two sibling scripts deliberately NOT included
pre_commit_security_gate.pyandsecurity_prereq_check.pyare also absent here, also silently ignoring their tests (9 more between them).Neither imports
intentumdiff— one is a git pre-commit hook, the other checks cargo/advisory-db prerequisites. Both are generic repo hygiene, equally applicable to any repo in the estate, so "belongs in the python repo" is a judgement rather than a fact and is left to the maintainer.Adding files to a published repo on a plan's say-so is the same move as deleting them on one.
Context
Part of closing the gap where this repo's CI collects 84 fewer tests than the monorepo — 89 never run here: 65 hidden by the conditional
collect_ignore, 24 never synced. This closes 13 of the 65.🤖 Generated with Claude Code