Repository navigation
test(ci): pin the workflow spec's quoted-key, env-block and step-key rules - #604
Conversation
…w spec Three one-line changes of the key patterns kept all tests green: the closing quote of the single-quoted pattern optional, the bare pattern taking a leading quote, and the two quoted patterns merged into one that takes any quote on each side. Under them a key such as 'cache: "false" #': x was read as cache (the head rejected inputs that main accepted), and a mismatched pair "cache': false was read too. The one-sided test now also feeds a key with a left quote only, and the two mismatched pairs, so each of these changes turns it red. A new test checks that an entry of the env block is not read as an input of with:, which kills a change of the block comparison. split_lines is gone: the gmatch call is already an iterator. _Generated with xum • Model: anthropic:claude-sonnet-5-5 • Thinking:
|
@codex review |
|
@codex security review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…ot a word
The block-end line used line:match("%S"), and a change to line:match("%w") kept every
test green. An explicit YAML key puts "?" and ":" alone on their lines at the step-key
indent, so with "%w" the with: block stayed open and cache: false, which YAML puts under
env, counted as an input of with:. GitHub's workflow parser accepts that text. The new
test feeds it and expects no cache input under with:.
_Generated with xum • Model: anthropic:claude-sonnet-5-5 • Thinking:
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
ThomasK33
changed the title
Why
The verifier of #596 found three one-line changes of the key patterns in
field()that keep all 16 tests of the workflow spec green:X1: the closing quote of the single-quoted pattern is optional.X2: the bare pattern takes a leading'.X11: the two quoted patterns merge into one that takes any quote on each side (["']key["']:).Under each of them a workflow that CI accepts saves the mise cache on a pull request and still passes the spec, for example a key
'cache: "false" #': xor"cache': false #": x.actionlint,zizmorandprettier --checkpass both.The verifier of #596 found a fourth change,
X6, that also kept every test green. It compares the block withcurrent ~= nilinstead ofcurrent == block, so an entry of theenvblock counts as an input ofwith:.The verifier of #596 had run a fifth change,
X9, and found no input that tells it apart. The verifier of this PR found one. Before the new test below,X9kept every test green. It replaces the%Scheck of the block line with%w, so a step-key line with no letter or digit does not end thewith:block. An explicit YAML key is such a line:?and:alone on their lines at the step-key indent. WithX9,cache: falseafter them stays an input ofwith:, and YAML puts it underenv. GitHub's workflow parser accepts that text.#596 merged under the maintainer's waiver for this open test gap. This PR closes it.
What changed
Only
tests/unit/workflow_cache_spec.lua(+18, -17). The workflows are unchanged. The spec still has no YAML parser, and no new form is read.'cache: c) and two mismatched pairs ("cache_save': dand'cache_key": e). It is renamed to say so.envblock is not read as an input ofwith:. It readscache: falseunderenv:and expects nocacheunderwithandfalseunderenv.?and:at the step-key indent,envandcache: falseat the entry indent under them) and expects nocacheunderwith. It killsX9.split_linesis gone. The call(text .. "\n"):gmatch("(.-)\n")is already an iterator, and every result stays the same.Evidence
Each change of the reader is one edit of the spec, and the spec runs on the workflow of main. Before is the spec of main (16 tests), after is this branch (18 tests).
X1: closing'of the single-quoted pattern optionalX2: the bare pattern takes a leading'X11: the two quoted patterns mergedX6:current ~= nilinstead ofcurrent == blockS1toS10,X3,X4,X5,X7,X10X9:%wfor%Sin the block lineX8: block indent<= 8Counts over the 21 changes. Before, 15 are red and 6 are green. After, 20 are red and 1 is green. 15 stay red, 5 turn red (
X1,X2,X6,X9,X11) and 1 stays green (X8). The failing tests of the 15 that stay red are the same, apart from the renamed test and the two new tests:S6andS10also fail the env block test, andS1,S10andX7also fail the step-key test.X9is red because an explicit YAML key (?and:alone on their lines) tells it apart, GitHub's workflow parser accepts that text, and the new test catches it.X8stays green on every spec. No input that GitHub's parser accepts was found to tell it apart.I ran 170 workflows (the 169 of the verifier of #596 and the workflow of main) with the spec of main, with the spec after the first commit of this PR and with the final spec. 114 are red and 56 are green, and the result and the failing test names are the same for all of them. The 169 give the same rows as before this change.
actionlint1.7.12 on all 5: exit 0.zizmor1.25.2--offlineon all 5: no findings (25 suppressed).mise run format-check: exit 0 (458 files, 0 changed)mise run clean && mise run allexits 0 in 654 s: 1910 successes, 0 failures, 0 errors, 36 pending (seed 1794569343).luacheck: 0 warnings, 0 errors in 200 files. The stubclaudeand GNUtimeoutfirst onPATHGenerated with
xum• Model:anthropic:claude-sonnet-5-5• Thinking:xhigh