Stop backplane reference-run staleness from blocking all PRs (Health/summary) #2821
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,10 +25,31 @@ | |
| MAX_STALE_AFTER_HOURS = 24 * 365 | ||
|
|
||
|
|
||
| # Findings default to "error" severity (structural defects that must block | ||
| # everywhere). "stale" severity marks an OPERATIONAL freshness lapse (a reference | ||
| # run aged past the freshness window) — real signal, surfaced by the dedicated | ||
| # backplane lane (health-78) and the CLI, but it must not fail the general | ||
| # structural validity suite, or the required `summary` check would go red for every | ||
| # unrelated PR the moment the window lapses. | ||
| ERROR_SEVERITY = "error" | ||
| STALE_SEVERITY = "stale" | ||
|
|
||
|
|
||
| @dataclass(frozen=True) | ||
| class Finding: | ||
| path: str | ||
| message: str | ||
| severity: str = ERROR_SEVERITY | ||
|
|
||
|
|
||
| def blocking_findings(findings: list[Finding]) -> list[Finding]: | ||
| """Structural findings that must block validation everywhere. | ||
|
|
||
| Operational freshness findings (``severity == STALE_SEVERITY``) are excluded: | ||
| they are surfaced (CLI / health-78) but do not gate unrelated work. | ||
| """ | ||
|
|
||
| return [finding for finding in findings if finding.severity != STALE_SEVERITY] | ||
|
|
||
|
|
||
| def _load_json(path: Path) -> dict[str, Any]: | ||
|
|
@@ -156,7 +177,11 @@ def _validate_reference_evidence( | |
| ) | ||
| elif now - generated_at > timedelta(hours=stale_after_hours): | ||
| findings.append( | ||
| Finding( | ||
| f"{prefix}.reference_run_evidence.generated_at", | ||
| "reference run is stale", | ||
| severity=STALE_SEVERITY, | ||
| ) | ||
| ) | ||
| run_id = evidence.get("run_id") | ||
| if not isinstance(run_id, str) or not run_id.strip(): | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,6 +28,58 @@ def test_drift_between_detects_genuine_content_change() -> None: | |
| assert drift_between("jobs:\n check: old\n", "jobs:\n check: new\n") is True | ||
|
|
||
|
|
||
| def test_action_pin_sha_bump_is_not_drift() -> None: | ||
| """A Renovate SHA bump on the same action must not read as drift. | ||
|
|
||
| This is the recurrence Health 74 kept firing on: consumer templates SHA-pin | ||
| actions, so every pin bump changed the fingerprint until a human re-baselined. | ||
| """ | ||
| before = " steps:\n - uses: actions/checkout@9c091bb # v7.0.0\n" | ||
| after = " steps:\n - uses: actions/checkout@3d3c42e # v7.0.1\n" | ||
| assert drift_between(before, after) is False | ||
|
|
||
|
|
||
| def test_pinned_and_floating_action_refs_are_equivalent() -> None: | ||
| """Root floats major tags; templates SHA-pin. That divergence is intentional | ||
| and must not count as drift once pins are canonicalized.""" | ||
| floating = " - uses: actions/checkout@v7\n" | ||
| pinned = " - uses: actions/checkout@3d3c42e5aac5ba8058 # v7.0.1\n" | ||
| assert drift_between(floating, pinned) is False | ||
|
|
||
|
|
||
| def test_different_action_path_is_still_drift() -> None: | ||
| """Only the @ref is canonicalized; swapping the action itself must still drift.""" | ||
| original = " - uses: actions/checkout@v7\n" | ||
| swapped = " - uses: someone-else/checkout@v7\n" | ||
| assert drift_between(original, swapped) is True | ||
|
|
||
|
|
||
| def test_reusable_workflow_ref_bump_is_not_drift_but_path_change_is() -> None: | ||
| same_path_bump_a = " uses: stranske/Workflows/.github/workflows/reusable-x.yml@main\n" | ||
| same_path_bump_b = ( | ||
| " uses: stranske/Workflows/.github/workflows/reusable-x.yml@abc123 # pin\n" | ||
| ) | ||
| different_path = " uses: stranske/Workflows/.github/workflows/reusable-y.yml@abc123 # pin\n" | ||
| assert drift_between(same_path_bump_a, same_path_bump_b) is False | ||
| assert drift_between(same_path_bump_a, different_path) is True | ||
|
|
||
|
|
||
| def test_genuine_logic_change_still_drifts_despite_pin_canonicalization() -> None: | ||
| """Deliberate-break guard: canonicalizing pins must not mask real logic drift.""" | ||
| base = ( | ||
| " steps:\n" | ||
| " - uses: actions/checkout@v7\n" | ||
| " if: github.event.action == 'labeled'\n" | ||
| ) | ||
| broken = ( | ||
| " steps:\n" | ||
| " - uses: actions/checkout@3d3c42e # v7.0.1\n" | ||
| " if: github.event.action == 'closed'\n" | ||
| ) | ||
| # Same-action pin differs (ignored) but the `if:` logic differs (must drift). | ||
| assert drift_between(base, broken) is True | ||
|
|
||
|
|
||
| def test_drift_between_honors_matching_fingerprinted_allowlist() -> None: | ||
| main = "name: main\njobs:\n check: true\n" | ||
| template = "name: template\njobs:\n check: true\n" | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When paired workflows use the same action path but genuinely different refs—for example, root
actions/checkout@v7versus a template still pinned to v6—this replaces both refs with<pinned>, so Health 74 reports them as synchronized. It likewise hides reusable-workflow ref changes such as@mainversus an unrelated branch. Since the repository has dedicated action-version synchronization and requires unintentional consumer drift to be aligned, normalize only equivalent floating/pinned versions (or Renovate-only digest changes), not every ref indiscriminately.AGENTS.md reference: AGENTS.md:L37-L43
Useful? React with 👍 / 👎.