Skip to content

fix: pin gavel #337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityathebe merged 1 commit into from
Aug 3, 2026
+1 −1
Merged

fix: pin gavel #337

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

- uses: flanksource/gavel@main
- uses: flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0 # main

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow line context:"
if [ -f .github/workflows/test.yml ]; then
  nl -ba .github/workflows/test.yml | sed -n '30,42p'
else
  echo ".github/workflows/test.yml not found"
fi

echo
echo "All uses references in workflow:"
rg -n "uses:|gavel" .github/workflows/test.yml || true

echo
echo "Resolve flanksource/gavel main tag object/target:"
if command -v gh >/dev/null 2>&1; then
  for ref in "43a9189b99e71ed928f418e01cd34aa797c2c0e0" "main"; do
    echo "--- $ref"
    gh api "repos/flanksource/gavel/git/matches/$ref" -q '.[].sha' 2>/dev/null || true
  done
  gh api repos/flanksource/gavel/git/ref/tags/main 2>/dev/null || true
  tag_obj="$(gh api repos/flanksource/gavel/git/ref/tags/main -q '.object.sha' 2>/dev/null || true)"
  if [ -n "$tag_obj" ]; then
    echo "tag object:"
    gh api "repos/flanksource/gavel/git/tags/$tag_obj" 2>/dev/null || true
  fi
else
  echo "gh CLI not available"
fi

echo
echo "Read-only check: workflow contains pinned SHA with # main comment:"
python3 - <<'PY'
from pathlib import Path
p=Path(".github/workflows/test.yml")
if p.exists():
    lines=[(i+1,l.strip()) for i,l in enumerate(p.read_text().splitlines())]
    for i,l in lines:
        if "flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0 # main" in l:
            print(f"line {i}: {l}")
else:
    print("missing")
PY

Repository: flanksource/commons

Length of output: 220

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Workflow line context:"
if [ -f .github/workflows/test.yml ]; then
  awk '{printf "%5d\t%s\n", NR, $0}' .github/workflows/test.yml | sed -n '30,42p'
else
  echo ".github/workflows/test.yml not found"
fi

echo
echo "All uses references in workflow:"
grep -n "uses:\|gavel" .github/workflows/test.yml || true

echo
echo "Read-only structural check: workflow contains pinned SHA with # main comment:"
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/test.yml")
target = "flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0 # main"
for i, line in enumerate(p.read_text().splitlines(), 1):
    if target in line.strip():
        print(f"line {i}: {line.strip()}")
PRIVATED
for i, line in enumerate(p.read_text().splitlines(), 1):
    stripped=line.strip()
    if "flanksource/gavel@" in stripped:
        print(f"gavel ref at line {i}: {stripped}")
PY

echo
echo "Remote gavel refs/tags/main availability:"
python3 - <<'PY'
import urllib.request, json
ref_url = "https://api.github.com/repos/flanksource/gavel/git/ref/tags/main"
try:
    with urllib.request.urlopen(ref_url, timeout=20) as r:
        print(r.status)
        data = json.load(r)
        print(data)
except Exception as e:
    print(type(e).__name__, e)
PY

echo
echo "Remote pinned SHA availability:"
python3 - <<'PY'
import urllib.request, json

sha = "43a9189b99e71ed928f418e01cd34aa797c2c0e0"
url = f"https://api.github.com/repos/flanksource/gavel/git/matches/{sha}"
try:
    with urllib.request.urlopen(url, timeout=20) as r:
        print(r.status)
        data = json.load(r)
        print(data)
except Exception as e:
    print(type(e).__name__, e)

# Also show HEAD/main commit if easily available without raw content
main_url = "https://api.github.com/repos/flanksource/gavel/git/refs/heads/main"
try:
    with urllib.request.urlopen(main_url, timeout=20) as r:
        data = json.load(r)
        print("HEAD main object:", data.get("object"))
except Exception as e:
    print(type(e).__name__, e)
PY

Repository: flanksource/commons

Length of output: 1639

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Remote gavel refs/tags/main object:"
python3 - <<'PY'
import urllib.request, json
url = "https://api.github.com/repos/flanksource/gavel/git/ref/tags/main"
try:
    with urllib.request.urlopen(url, timeout=20) as r:
        data = json.load(r)
        print("status", r.status)
        print("object", data.get("object"))
        if data.get("object", {}).get("type") == "tag":
            tag_url = "https://api.github.com/repos/flanksource/gavel/git/tags/" + data["object"]["sha"]
            with urllib.request.urlopen(tag_url, timeout=20) as tr:
                tdata = json.load(tr)
                print("tag object", tdata)
                print("dereferenced commit", tdata.get("object", {}).get("sha"))
except Exception as e:
    print(type(e).__name__, e)
PY

echo
echo "Remote commit SHA availability:"
python3 - <<'PY'
import urllib.request, json
sha = "43a9189b99e71ed928f418e01cd34aa797c2c0e0"
url = "https://api.github.com/repos/flanksource/gavel/git/commits/" + sha
try:
    with urllib.request.urlopen(url, timeout=20) as r:
        data = json.load(r)
        print("status", r.status)
        print("sha", data.get("sha"))
        print("commit_message", data.get("commit", {}).get("message", "").splitlines()[0])
except Exception as e:
    print(type(e).__name__, e)
PY

Repository: flanksource/commons

Length of output: 514

🌐 Web query:

flanksource gavel main tag commit 43a9189b99e71ed928f418e01cd34aa797c2c0e0

💡 Result:

The git commit hash 43a9189b99e71ed928f418e01cd34aa797c2c0e0 is not found in the flanksource/gavel GitHub repository [1]. A review of the repository's commit history, release tags, and associated pull requests does not show this specific commit hash [1][2][3]. The flanksource/gavel project is a tool written primarily in Go that provides a gavel command-line interface for managing git commits, among other features [1]. Official releases for the repository currently extend up to at least v0.0.52 [3]. The provided commit hash does not correspond to any known activity or branch within this repository [1].

Citations:

🌐 Web query:

github flanksource gavel commit 43a9189b99e71ed928f418e01cd34aa797c2c0e0

💡 Result:

The commit hash 43a9189b99e71ed928f418e01cd34aa797c2c0e0 is not associated with the official flanksource/gavel repository [1]. A comprehensive search of commit history, pull requests, and releases within that repository does not return this specific hash [1][2][3][4][5][6][7][8][9][10][11][12][13][14]. It is possible this commit hash belongs to a different project or a fork not indexed in the provided results, as similar hashes appear in other contexts unrelated to the flanksource/gavel codebase [15][16][17][18][19][20].

Citations:

🌐 Web query:

site:github.com/flanksource/commons gavel@

💡 Result:

Gavel is a specialized CI/CD tool, distributed as a GitHub Action (flanksource/gavel), designed to execute, monitor, and report on testing and linting processes within a repository [1][2][3]. It is primarily used in GitHub Actions workflows to streamline CI/CD feedback by providing integrated test summaries, artifact generation (such as JSON and HTML result files), and automated pull request comments [1][2][4][3]. When integrated into a workflow, it typically replaces standard, unformatted go test output, allowing for more structured reporting and better visibility into test performance and linting outcomes [2][3]. Key features and use cases include: - CI/CD Integration: It is invoked in GitHub Actions using uses: flanksource/gavel@<version> [1][3]. - Automated Reporting: It supports outputting results in multiple formats, including JSON, HTML, and Markdown summaries, and can automatically post these results as comments on pull requests [1][2][4][3]. - Configuration: It can be configured via a .gavel.yaml file to manage settings, such as ignoring specific files or detections, which helps reduce noise from false positives [5]. - Error Handling: It includes flags like fail-on-error, allowing developers to control whether the CI pipeline should fail based on the tool's execution results [1][3]. There is no indication that "gavel@" refers to an email domain; rather, it appears to be a misinterpretation of the GitHub Action syntax (e.g., flanksource/gavel@main or flanksource/gavel@v<version>), where the "@" symbol denotes a specific version, branch, or tag reference for the action [1][2][3].

Citations:

🌐 Web query:

"flanksource/gavel@43a9189b99e71ed928f418e01cd34aa797c2c0e0"

💡 Result:

flanksource/gavel is a CLI toolkit designed for testing, linting, AI-powered code review, and CI automation [1]. The repository, hosted on GitHub, is written primarily in Go [1]. The specific commit reference 43a9189b99e71ed928f418e01cd34aa797c2c0e0 corresponds to a historical state of the main branch in the flanksource/gavel repository. Key capabilities of the Gavel tool include: - Fixture-based testing using markdown files with command blocks, tables, and CEL assertions [2]. - AI-powered code review and automated repair of lint violations [3]. - Integration with the Model Context Protocol (MCP) to allow AI assistants to interact safely with Gavel commands [3]. - CI/CD workflow management, including migration tools for GitHub Actions [2], organization-wide CI status reporting [4], and automated PR handling [4][3]. - Process supervision (e.g., Procfile support) for managing local development environments [4]. - Support for various linters, including integration of oxlint [4]. The project supports agentic workflows via the "Agent Skills" specification, enabling compatibility with various AI assistants such as Claude Code, VS Code Copilot, Cursor, and the Gemini CLI [2]. As of August 2026, the project remains actively developed with frequent releases [5][6].

Citations:

Align the workflow comment with the pinned SHA.

Line 36 pins flanksource/gavel to a commit SHA, but # main still describes a mutable branch. Use the commit prefix or an explicit release tag if that is the intended dependency.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 36, Update the comment on the
flanksource/gavel workflow step to accurately describe the pinned dependency,
replacing “main” with the pinned commit SHA prefix or the intended explicit
release tag.

with:
args: test
version: latest
Expand Down
Loading