Enforce overlay provenance for main rebuilds - #1005
Merged
jeonghun-jj-lee merged 1 commit intoSep 11, 2026
Merged
Conversation
9 tasks
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jeonghun-jj-lee
marked this pull request as ready for review
September 11, 2026 01:23
This was referenced Sep 11, 2026
Merged
jack-champagne
pushed a commit
that referenced
this pull request
Sep 11, 2026
manifest.upstream_base has held a commit SHA (not a tag) since recent promotions started passing --base <sha> to overlay-promotion.mjs, but materialize.mjs and drift_report.mjs both built the upstream fetch URL under refs/tags/, which 404s for a SHA. This has been failing vsix-gate on main since #1011. GitHub's /archive/<ref>.tar.gz endpoint resolves both tags and commit SHAs through the same path, so drop refs/tags/. Also scope overlay-promotion.mjs's main-branch promotion guard (#1005) to the real overlay/manifest paths only. It was checking this repo's current branch unconditionally, which correctly blocks a human running --apply directly on main, but also blocked overlay_promotion.test.ts's own --apply exercise (run via a custom --target/--manifest fixture, never the live overlay) whenever CI happened to run on main — which is every push to main, including this one. That's the second failure in the same CI run.
jack-champagne
pushed a commit
that referenced
this pull request
Sep 11, 2026
Automates the diff JJ has been generating by hand (#947, #1005, #1006, #1009, #1011): on a schedule (or manual dispatch), run the existing overlay-promotion.mjs --check against the fork's local/amicode tip, and on drift, run --apply on a deterministic review branch and open/update one PR. Deliberately not built: a signed webhook receiver, a GitHub App, compare-and-swap bot-merge authority, or exception-approval automation. JJ's own promotion PRs (#1009, #1011) were merged 6-27 seconds after opening once CI was green — the toil is producing the diff, not reviewing it, so a human (or required status checks) still merges here. Verified locally against a scratch git remote + the real harmoniqs/opencode clone (not just described): - --check against the current in-sync state exits 0, no PR opened - a simulated fork commit drifts --check to exit 1 - --apply on the review branch (created BEFORE --apply, since #1005's main-branch guard would otherwise refuse it) reproduces the correct manifest + overlay diff - re-running --apply after resetting the branch from main is idempotent (same tree each time, safe to force-push) If the app-bundle overlay is retired later (tracked separately, off #1010), this workflow is deleted, not migrated.
jack-champagne
added a commit
that referenced
this pull request
Sep 11, 2026
… bot (#1010 Phase 0+1) (#1025) * fix(app-bundle): resolve upstream_base as commit SHA, not tag manifest.upstream_base has held a commit SHA (not a tag) since recent promotions started passing --base <sha> to overlay-promotion.mjs, but materialize.mjs and drift_report.mjs both built the upstream fetch URL under refs/tags/, which 404s for a SHA. This has been failing vsix-gate on main since #1011. GitHub's /archive/<ref>.tar.gz endpoint resolves both tags and commit SHAs through the same path, so drop refs/tags/. Also scope overlay-promotion.mjs's main-branch promotion guard (#1005) to the real overlay/manifest paths only. It was checking this repo's current branch unconditionally, which correctly blocks a human running --apply directly on main, but also blocked overlay_promotion.test.ts's own --apply exercise (run via a custom --target/--manifest fixture, never the live overlay) whenever CI happened to run on main — which is every push to main, including this one. That's the second failure in the same CI run. * feat(ci): add overlay-promotion-bot workflow (#1010 Phase 1) Automates the diff JJ has been generating by hand (#947, #1005, #1006, #1009, #1011): on a schedule (or manual dispatch), run the existing overlay-promotion.mjs --check against the fork's local/amicode tip, and on drift, run --apply on a deterministic review branch and open/update one PR. Deliberately not built: a signed webhook receiver, a GitHub App, compare-and-swap bot-merge authority, or exception-approval automation. JJ's own promotion PRs (#1009, #1011) were merged 6-27 seconds after opening once CI was green — the toil is producing the diff, not reviewing it, so a human (or required status checks) still merges here. Verified locally against a scratch git remote + the real harmoniqs/opencode clone (not just described): - --check against the current in-sync state exits 0, no PR opened - a simulated fork commit drifts --check to exit 1 - --apply on the review branch (created BEFORE --apply, since #1005's main-branch guard would otherwise refuse it) reproduces the correct manifest + overlay diff - re-running --apply after resetting the branch from main is idempotent (same tree each time, safe to force-push) If the app-bundle overlay is retired later (tracked separately, off #1010), this workflow is deleted, not migrated. --------- Co-authored-by: Test <test@example.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1004
Summary
Verification