Re-baseline Health 74 template-drift fingerprints (fix red main) - #2815
Merged
Conversation
Health 74 Template Drift has been red on main since 2026-07-20, forcing an admin override on every Workflows merge. Root cause is NOT unintended drift: Renovate/dep-pin bumps (#2799 actions/checkout v7.0.1, #2776 coverage pins) moved the consumer templates' pinned action SHAs, so 13 already-allowlisted entries' recorded fingerprints went stale. Verified via `git log --since=<last baseline>` that the only commits touching these 13 workflow files since the last re-baseline were those dependency bumps (root workflows keep floating major tags by design; consumer templates SHA-pin per the fleet action-pin contract, docs/HISTORY.md / PR #1925). The divergence is the intentional action-pin-contract drift, not a missing consumer improvement — so per the allowlist's own documented process, refresh the fingerprints rather than align (aligning would strip the required consumer pins). Refreshed main/template sha256 for: belt 71/72/73, auto-label, autofix-dispatcher, capability-check, decompose, dedup, guard, issue-optimizer, keepalive-loop-reporter, verifier, weekly-metrics. Per-entry reasons preserved; dated re-baseline note added to the header. check_template_drift.py now reports "unallowlisted drift: 0" (exit 0). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Contributor
Workflow source neededPR #2815 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe allowlist records a 2026-07-24 re-baseline and refreshed SHA256 fingerprints for multiple workflow-template pairs. Pairings, allowlist structure, and divergence descriptions remain unchanged. ChangesTemplate drift allowlist re-baseline
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Automated Status SummaryHead SHA: 67f55e7
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
This was referenced Jul 24, 2026
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
…summary) (#2821) * Make template-drift check pin-tolerant so Renovate bumps stop reddening it Health 74 Template Drift went red on main after every Renovate action-pin bump (#2799, and #2795 queued next), forcing a manual allowlist re-baseline each time — the 4th such re-baseline just landed (#2815). Root cause: normalize_text only stabilized line endings/whitespace, so a `uses: <action>@<sha> # vX` bump changed the fingerprint and staled the allowlist, even though consumer templates SHA-pin by contract while root floats major tags (an intentional, permanent divergence). Fix at the source: canonicalize GitHub Actions `uses:` refs in normalize_text — `uses: <action>@<ref>` (+ trailing `# vX` comment) collapses to `<action>@<pinned>`. The action PATH is preserved, so swapping to a different action is still drift and genuine logic changes still register; only the mutable pin ref is ignored. This makes action-pin bumps and the pinned-vs-floating divergence invisible to the check, so the allowlist stops going stale on dependency bumps. - scripts/check_template_drift.py: add _canonicalize_action_refs; apply in normalize_text. - tests: 6 new cases — SHA bump not drift, pinned==floating, different action still drift, reusable-workflow ref bump not drift / path change is, and a deliberate-break proving real logic drift still fails despite canonicalization. - config/template-drift-allowlist.txt: regenerated all 15 fingerprints under the new normalization (reasons preserved; 2026-07-24b note added). Verified: a simulated checkout SHA bump leaves the checker green (exit 0) with NO re-baseline; a real logic change still fails (exit 1). 25 drift tests pass. Workflows-repo-internal check only (consumers never run it) — no fleet blast radius. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply ruff format to drift-check tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Make backplane reference-run staleness non-blocking for the required suite The backplane registry's reference-run evidence has a 7-day freshness window (stale_after_hours=168). When it lapses, validate_registry() emitted a plain finding, so test_registry_has_no_tbd_placeholders_and_validates — which runs in `python ci` (the REQUIRED `summary` check) on every PR — went red, blocking ALL Workflows PRs until someone manually refreshed the evidence. There is no scheduled refresh, so this recurs weekly (it tripped 2026-07-24 ~14:29Z at 170.8h). Freshness is an OPERATIONAL concern, not a structural defect: an aged-but- well-formed reference run does not make the registry invalid. Separate the two: - Finding gains a `severity` field ("error" default; "stale" for the freshness lapse). Add blocking_findings() = structural (error) findings only. - The general structural test asserts blocking_findings(...) == [], tolerating a stale finding — so the required suite stops going red for unrelated PRs. - The CLI (`main`) and the dedicated, NON-required backplane lane (health-78, path-triggered) still exit 1 on staleness, so the freshness signal is preserved where it belongs instead of gating the whole fleet. - Tests: staleness is classified non-blocking; a deliberate-break proves structural defects (missing sha256) still block. Future-dated/malformed timestamps remain blocking errors. Scope: only reference-run staleness is reclassified. Deeper follow-up (auto- refresh the reference run, or schedule the conformance run) left for later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply black formatting (repo uses black, not ruff format) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
#2817) * Make template-drift check pin-tolerant so Renovate bumps stop reddening it Health 74 Template Drift went red on main after every Renovate action-pin bump (#2799, and #2795 queued next), forcing a manual allowlist re-baseline each time — the 4th such re-baseline just landed (#2815). Root cause: normalize_text only stabilized line endings/whitespace, so a `uses: <action>@<sha> # vX` bump changed the fingerprint and staled the allowlist, even though consumer templates SHA-pin by contract while root floats major tags (an intentional, permanent divergence). Fix at the source: canonicalize GitHub Actions `uses:` refs in normalize_text — `uses: <action>@<ref>` (+ trailing `# vX` comment) collapses to `<action>@<pinned>`. The action PATH is preserved, so swapping to a different action is still drift and genuine logic changes still register; only the mutable pin ref is ignored. This makes action-pin bumps and the pinned-vs-floating divergence invisible to the check, so the allowlist stops going stale on dependency bumps. - scripts/check_template_drift.py: add _canonicalize_action_refs; apply in normalize_text. - tests: 6 new cases — SHA bump not drift, pinned==floating, different action still drift, reusable-workflow ref bump not drift / path change is, and a deliberate-break proving real logic drift still fails despite canonicalization. - config/template-drift-allowlist.txt: regenerated all 15 fingerprints under the new normalization (reasons preserved; 2026-07-24b note added). Verified: a simulated checkout SHA bump leaves the checker green (exit 0) with NO re-baseline; a real logic change still fails (exit 1). 25 drift tests pass. Workflows-repo-internal check only (consumers never run it) — no fleet blast radius. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply ruff format to drift-check tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Health 74 Template Drift has been red on
mainsince 2026-07-20, forcing an--adminoverride on every Workflows merge (base-branch policy prohibits merge on the failing check, even though the ruleset's only required checksummarypasses).Root cause — intentional drift with stale fingerprints, not a real divergence
The allowlist already contains entries for all 13 flagged files. Their recorded fingerprints went stale after Renovate/dep-pin bumps moved the consumer templates' pinned action SHAs:
actions/checkout→ v7.0.1git log --since=<last baseline>confirms the only commits touching these 13 files since the last re-baseline were those dependency bumps. Root workflows keep floating major tags by design; consumer templates SHA-pin third-party actions per the fleet action-pin contract (docs/HISTORY.md / PR #1925). So this is the intentional action-pin-contract drift — aligning would strip the contractually-required consumer pins.Fix
Per the allowlist's own documented process, refresh the fingerprints (not align). Updated
main/templatesha256 for: belt 71/72/73, auto-label, autofix-dispatcher, capability-check, decompose, dedup, guard, issue-optimizer, keepalive-loop-reporter, verifier, weekly-metrics. Per-entry reasons preserved; dated re-baseline note added.scripts/check_template_drift.pynow reportsunallowlisted drift: 0(exit 0) — this PR's own Health 74 run should pass and turnmaingreen again.Recurrence note (not fixed here)
This is the 4th such re-baseline (06-14, 06-20, 06-24, now 07-24) — every Renovate action bump re-reddens Health 74 until a human refreshes fingerprints (e.g. #2795
setup-pythonv7 is queued and will re-trigger it). Worth a follow-up to auto-refresh the allowlist in the Renovate flow (or make the check tolerant of action-pin-only changes) so this stops recurring. Flagging rather than repeatedly hand-baselining.🤖 Generated with Claude Code
Summary by CodeRabbit