Repository navigation
Conversation
…se ref verify_merge_base only checked that the base ref exists. When HEAD shares no history with it, git merge-base exits 1 silently, changed paths came back empty and the linter reported OK with zero checks run. Report git.merge_base_missing in that case as well. Co-authored-by: herklos.dev <herklos.dev@protonmail.com>
The validate step pipes cloud-validate.sh into tee. Without pipefail the step status is tee's, so a failing validation still left the job green and the failure summary and report upload never ran. Co-authored-by: herklos.dev <herklos.dev@protonmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make two policy gates fail closed. Both currently let a failing check pass silently.
Solve the issue: none (nightly audit, aspect "hooks fail-closed + CI parity").
Changelog
git.merge_base_missingwhen HEAD has no merge base with the base ref, instead of passing with zero checksset -o pipefailso a failingcloud-validate.shfails the step instead of being masked byteeWhat's new?
verify_merge_basenow also runsgit merge-base HEAD <base>. Before this change, unrelated histories made the linter printOK (0 violations)even when the branch toucheduser/**. Reproduced locally, exit 0 before the fix. New unit testtest_unrelated_histories_violationfails without the fix and passes with it. Related-history case is covered too.cloud-env-validate.yml: the validate step pipes intotee. GitHub's defaultbash -e {0}has no pipefail, so the step status was alwaystee's. The change is a single line; a passing validation is unaffected (the step passed on recent runs).Not changed here: the
PR policy checkstep inmain.ymlhas the same pipe pattern. That file is touched by open PRs, so it is left for a follow-up.