test(release): pin the release-pr main-ref guard (RIG-3813) - #1271
Open
rigel-mintaka wants to merge 1 commit into
Open
rigel-mintaka wants to merge 1 commit into
rigel-mintaka wants to merge 1 commit into
Conversation
The main-ref guard on `release-pr` is a security invariant that nothing observed. actionlint validates syntax only, and no test inspected release job gating, so an edit deleting the guard would have stayed green while re-opening a path for a `workflow_dispatch` from any ref to cut a release from `main`. Pin it in `tools/toolchain`, which already holds the precedent for asserting about a workflow file from a bun test (the Postgres image digest shared by ci.yml and the local harness). The assertion isolates the `release-pr` job block before matching, because four other jobs carry the identical `github.ref` predicate and a whole-file substring search would pass with the guard deleted from the one job that needs it. Verified against that exact mutation: removing only `release-pr`'s guard while every sibling keeps its own turns the case red. An unlocatable or implausibly small job block fails rather than reporting a pass, so the test cannot turn "I could not check this" into green. `release.yml` joins the `test` task inputs for the same reason ci.yml is already there: a file a test asserts about must invalidate the task, or the assertion stays cached and stops running against what it constrains. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
added this pull request to stack #1272
September 17, 2026 02:32
|
Compass engineering docs preview: https://compass-native-rig-3813-guar.compass-eng-docs.pages.dev Deployed from |
rigel-mintaka
marked this pull request as ready for review
September 17, 2026 02:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #1263, which adds the guard this pins. Part of RIG-3813.
Closes the one HIGH finding from #1263's review: the guard was a security invariant that nothing
observed. actionlint validates syntax only, and no test in the repo inspected workflow job gating,
so a future edit deleting
if: github.ref == 'refs/heads/main'fromrelease-prwould have stayedgreen while re-opening the path for a
workflow_dispatchfrom any ref to cut a release frommain.Where it lives
tools/toolchain, which already holds the repo's precedent for asserting about a workflow file froma bun test: the Postgres image digest shared by
.github/workflows/ci.ymland the local harness. Nonew moon project, and no YAML parser dependency - the assertion works on the file text, like the
precedent it follows.
The part that matters
The test isolates the
release-prjob block before matching. Four other jobs in the file carrythe identical
github.ref == 'refs/heads/main'predicate, so a whole-file substring search wouldpass with the guard deleted from the one job that needs it. That is the defect the test exists to
avoid, so it was verified against that exact mutation rather than assumed.
Verification
Three mutation trials, each run by the driver independently of the implementer, each restored after:
release-pr's guard; all four siblings keep the identical predicaterelease-pr must require main because it holds contents: write and mints release tagstarget-branch: mainAn unlocatable or implausibly small job block fails rather than passing, so the test cannot turn
"I could not check this" into green.
Gates:
moon run toolchain-parity:typecheckrc=0,moon run toolchain-parity:test88 tests across5 files with the two new cases named and passing,
biome checkclean on the new file.jj stconfirms
.github/workflows/release.ymlis unmodified by this PR.release.ymljoins thetesttask inputs for the same reasonci.ymlis already there: a file atest asserts about must invalidate the task, or the assertion stays cached and silently stops
running against what it constrains.
Open Questions
None.