Share one approval branch per source commit across environments - #921
Merged
Merged
Conversation
Each OpenSecret EIF release run pushed its own opensecret/pcr-approval-<env>-<commit> branch, so when one commit changed both measurement sets the two single-environment pull requests each failed the other environment's approval comparison (#918 and #919), and the approvals had to be combined by hand (#920). The publisher now targets opensecret/pcr-approval-<commit>: if the branch already exists it must descend from the source commit and change only approval files, the run refuses to repeat an environment that is already on it, and its commit is rebased onto the branch tip. A push rejected by the other environment's concurrent run is refetched, replayed and retried up to five times. Fixtures cover the sequential second environment, the repeated environment refusal, and a lost push race driven through a git shim; the runbook describes the shared branch. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The Nix check sandbox has no /usr/bin/env, so the shim must name the bash the test itself found. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Each
OpenSecret EIF releaserun pushed its ownopensecret/pcr-approval-<env>-<commit>branch. When one commit changes both measurement sets, the two single-environment PRs each fail the other environment's approval comparison by design (#918, #919), and the approvals had to be combined by hand (#920).scripts/ci/publish_opensecret_approval.shnow targetsopensecret/pcr-approval-<commit>, shared by both environments' runs for that commit:Fixtures: sequential second environment lands on the same branch with both approvals; repeated environment is refused; a lost push race (a git shim pushes the other environment's commit between fetch and push) is replayed on top. The Nitro runbook describes the shared branch. No workflow YAML change.
🤖 Generated with Claude Code