From 1936c5e2c957e9e1117020265fff39db90837053 Mon Sep 17 00:00:00 2001 From: lab Date: Sun, 6 Sep 2026 02:41:19 +0700 Subject: [PATCH] fix(ci): carry the trusted-bot bypass to check, which never had it (Refs #3335) The census moved because this adds one `run:` step: quiet 127 -> 128 and shell 234 -> 235. Confirmed mine, not a neighbour's, by running the gate on a clean origin/master checkout with the same binary first -- it passes there. --- .github/workflows/check-now-freshness.yml | 30 +++++++++++++++++++ ...-09-05-check-blocks-every-dependabot-pr.md | 21 +++++++++++++ tools/census/quiet.txt | 2 +- tools/census/shell.txt | 4 +-- 4 files changed, 54 insertions(+), 3 deletions(-) create mode 100644 docs/now/2026-09-05-check-blocks-every-dependabot-pr.md diff --git a/.github/workflows/check-now-freshness.yml b/.github/workflows/check-now-freshness.yml index 28f5c8b9d8..ec4b126d76 100644 --- a/.github/workflows/check-now-freshness.yml +++ b/.github/workflows/check-now-freshness.yml @@ -35,8 +35,34 @@ on: jobs: check: runs-on: ubuntu-latest + # THE BYPASS THAT WAS NEVER CARRIED HERE. #1081 gave `check-now-freshness` and + # `check-linked-issue` a trusted-bot no-op on 2026-06-14, for a reason stated there: + # a SKIPPED required check never satisfies branch protection, so the bypass has to be + # a step that passes, not a job that is skipped. This job was exempt from the problem + # only because its entire body was `echo "Checking repository freshness..."` -- its + # blindness WAS the bypass. #2756 gave it real work on 2026-08-28 and the exemption + # went with the blindness. + # + # MEASURED, 2026-09-06: eight open Dependabot pull requests. The three opened + # 2026-09-01, after this job got teeth, are RED on `check` and green on the other + # three required contexts. The five opened 2026-08-24 are green only because their + # last run predates the change; any synchronize or title edit re-runs the job and + # flips them. The ruleset is not editable and there are no bypass_actors, so a red + # `check` means the pull request can never merge. + # + # The failure text even asserts what is false on this population: "NOW Sync Gate + # should have caught that first" -- on a bot pull request NOW Sync Gate deliberately + # does not look. + env: + IS_BOT: ${{ (github.actor == 'dependabot[bot]' || github.actor == 'github-actions[bot]' || github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'github-actions[bot]') && 'true' || 'false' }} steps: + - name: Trusted-bot bypass (no-op pass) + if: env.IS_BOT == 'true' + run: | + echo "Trusted bot PR -- gate passes as no-op. Closes 1031." + - uses: actions/checkout@v6 + if: env.IS_BOT != 'true' with: fetch-depth: 0 @@ -56,9 +82,11 @@ jobs: # NOW Sync Gate -> "you wrote one" # this -> "what you wrote says something" - name: Negative control + if: env.IS_BOT != 'true' run: python3 tools/check_now_entry_shape.py --self-check - name: The docs/now/ entry this PR adds must say something + if: env.IS_BOT != 'true' env: PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} @@ -78,11 +106,13 @@ jobs: # the two readers cannot drift into two rules; if they cannot be read the step # exits 2, which is could-not-run and not a pass. - name: Negative control for the fix( guard + if: env.IS_BOT != 'true' run: python3 tools/check_fix_carries_source.py --self-check # PR_TITLE is attacker-controlled text and reaches the script through the # environment, never through `${{ }}` interpolation into a shell line. - name: A fix( in a compiler scope must carry a source file + if: env.IS_BOT != 'true' env: PR_TITLE: ${{ github.event.pull_request.title }} PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} diff --git a/docs/now/2026-09-05-check-blocks-every-dependabot-pr.md b/docs/now/2026-09-05-check-blocks-every-dependabot-pr.md new file mode 100644 index 0000000000..53abe2cd59 --- /dev/null +++ b/docs/now/2026-09-05-check-blocks-every-dependabot-pr.md @@ -0,0 +1,21 @@ +# NOW -- check blocks every Dependabot PR (2026-09-05) + +## check blocks every Dependabot PR (Refs #3335) + +- The required context `check` has no trusted-bot bypass: IS_BOT appears 0 times and no + step is conditional. Its two neighbours have 6 and 3. +- #1081 gave those two the bypass on 2026-06-14, and stated why it is a no-op PASS step + rather than a skipped job: a skipped required check never satisfies branch protection. +- This job was exempt only because its whole body was an `echo`. Its blindness WAS the + bypass, and when #2756 gave it real work the exemption went with the blindness. +- Measured: eight open Dependabot pull requests. The three opened after the change are RED + on `check` and green on the other three required contexts. The five opened before are + green only because their last run predates it; a synchronize or a title edit flips them. +- The ruleset is not editable and there are no bypass_actors, so red `check` means never + merges. +- The failure text asserts what is false on this very population: "NOW Sync Gate should + have caught that first" -- on a bot pull request NOW Sync Gate deliberately does not look. +- Ported character for character; the expression is now identical in all three files, + checked rather than assumed. +- Found by an adversarial pass over the four required contexts: 8 candidates, 6 survived + refutation, 2 refuted. The other five are recorded for the next pass. diff --git a/tools/census/quiet.txt b/tools/census/quiet.txt index 781da0d6a9..6a4281ba61 100644 --- a/tools/census/quiet.txt +++ b/tools/census/quiet.txt @@ -2,7 +2,7 @@ GATE STEPS WHOSE PASS SURVIVES THE SUBJECT GOING MISSING workflow files read 50 steps in a quiet shape 31 - named a path but not quiet 127 (--excluded prints them) + named a path but not quiet 128 (--excluded prints them) by shape: failure branch passes 15 `… 2>/dev/null … || echo PASSED` diff --git a/tools/census/shell.txt b/tools/census/shell.txt index eccf11c616..335cb69fbc 100644 --- a/tools/census/shell.txt +++ b/tools/census/shell.txt @@ -2,10 +2,10 @@ WHICH INTERPRETER EACH GATE STEP IS HANDED TO, AND WHO SAYS SO workflow files read 50 jobs 71 - run: steps 234 + run: steps 235 who names the shell: - the runner does 213 no container, so bash -eo pipefail + the runner does 214 no container, so bash -eo pipefail a `shell:` key does 0 NOBODY 21 a container and no `shell:` key