Skip to content

fix(policy): recompile CEL programs on rollback#141

Open
jonathanhaaswriter wants to merge 3 commits intomainfrom
fix/policy-rollback-cel-sync
Open

fix(policy): recompile CEL programs on rollback#141
jonathanhaaswriter wants to merge 3 commits intomainfrom
fix/policy-rollback-cel-sync

Conversation

@jonathanhaaswriter
Copy link
Copy Markdown
Collaborator

Summary

  • add a regression test covering CEL-backed policy rollback behavior
  • recompile condition programs during rollback before swapping the active policy version
  • preserve rollback semantics while ensuring post-rollback evaluations use the restored CEL conditions

Testing

  • go test ./internal/policy -run TestRollbackPolicyRecompilesCELConditions
  • python3 ./scripts/devex.py run --mode changed --base-ref writer/main
  • python3 ./scripts/devex.py run --mode pr --base-ref writer/main

jonathanhaaswriter and others added 2 commits March 25, 2026 12:12
RollbackPolicy called syncConditionProgramsLocked which deletes the
compiled program cache before recompiling. If recompilation of the
historical version failed, the active policy was left with no compiled
CEL programs, causing evaluations to silently stop matching.

Save the current CEL programs before sync and restore them if
recompilation fails, so a failed rollback never corrupts the active
policy's evaluation state.

Add test verifying that a failed rollback to an invalid CEL version
preserves the current policy's compiled programs.
@jonathanhaaswriter
Copy link
Copy Markdown
Collaborator Author

Re-reviewed the current diff and I don't have any additional actionable findings right now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants