From 65ee88a01c10ca176ad4d69f545d7f5eb11430c3 Mon Sep 17 00:00:00 2001 From: Claude Code Date: Sat, 26 Sep 2026 20:07:29 +0200 Subject: [PATCH] fix(ci): check out the siax-templates pin directly instead of comparing main The G17 gate cloned sax3l/siax-templates on the moving branch `main` and then required that clone's HEAD to equal SIAX_TEMPLATES_PINNED_SHA. Every merge in siax-templates -- including ones that touch nothing under ci/v2/reference-hooks -- therefore turned this repo's release chain red while nothing was actually unsafe (CD-03 / CI-RED-02). It is red right now: siax-templates main is at 6612f6ae, the pin is 09504e3a. The pin is still a real supply-chain control; what was wrong was tying it to someone else's branch tip. The step now fetches the pinned commit by SHA (shallow, no branch consulted) and checks it out detached, falling back to fetching the branches and taking the same commit out of them if the server refuses a by-SHA fetch. It fails closed on the thing that actually matters -- the reviewed commit no longer existing upstream -- and the post-checkout HEAD assertion is kept so the gate still proves what it ran. SIAX_TEMPLATES_REF is removed rather than left unused, so the moving-branch shape cannot quietly come back. The pin value itself is unchanged: commit 09504e3a is confirmed present in siax-templates (Gitea API, two commits behind main). Two comments that described the old "refuses to run if main moved" behaviour are corrected in the same change. Co-Authored-By: Claude Opus 5 --- .gitea/workflows/release.yml | 45 ++++++++++++++++++++++++++++-------- .siax/hooks/G17.sh | 7 +++--- .siax/hooks/README.md | 13 +++++++---- 3 files changed, 48 insertions(+), 17 deletions(-) diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 731638b..4285668 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -58,7 +58,14 @@ env: # lib/test_emit_release_evidence.py}. Andringen ar bakatkompatibel by # design: ST0RE-uppladdningen ar OPT-IN via G17_REQUIRE_ST0RE (default 0), # sa en AUD0-only-konsument som 0pt kor exakt samma vag som forut. - SIAX_TEMPLATES_REF: main + # + # Deliberately NO branch name here: the pinned commit is checked out + # DIRECTLY (see the step below). The previous shape -- clone `main`, then + # require its HEAD to equal this pin -- turned every unrelated merge in + # siax-templates into a red release chain here (CD-03 / CI-RED-02) while + # nothing was actually unsafe. Checking the pin out directly keeps the pin + # a real supply-chain control (the gate runs exactly this reviewed commit, + # or it fails) without coupling it to someone else's branch tip. SIAX_TEMPLATES_PINNED_SHA: 09504e3a593ee8ce0eaba606df31c349a3d52277 SIAX_TEMPLATES_DIR: /tmp/siax-templates-g17-ref @@ -72,27 +79,45 @@ jobs: fetch-depth: 0 # --- fetch the shared G17 reference implementation ----------------- - # Same authenticated-clone-at-runtime mechanism this repo's OLD + # Same authenticated-fetch-at-runtime mechanism this repo's OLD # release.yml already used SIAX_CI_TOKEN for (the evidence-commit - # push this PR deletes) -- see .siax/hooks/G17.sh's header for why + # push a prior PR deleted) -- see .siax/hooks/G17.sh's header for why # NOT a `uses:` reusable workflow / submodule / vendored copy. Fails - # closed if the branch has moved past the exact commit this adapter - # was reviewed against. - - name: Fetch siax-templates G17 reference (pinned) + # closed if the exact commit this adapter was reviewed against cannot + # be checked out (removed or rewritten upstream); an unrelated merge + # on siax-templates' own main is NOT a failure and never was a real + # signal. + - name: Fetch siax-templates G17 reference (pinned commit) env: SIAX_CI_TOKEN: ${{ secrets.SIAX_CI_TOKEN }} run: | set -euo pipefail rm -rf "$SIAX_TEMPLATES_DIR" - git clone --quiet --branch "$SIAX_TEMPLATES_REF" \ - "https://oauth2:${SIAX_CI_TOKEN}@git.siax.io/${SIAX_TEMPLATES_REPO}.git" "$SIAX_TEMPLATES_DIR" + mkdir -p "$SIAX_TEMPLATES_DIR" + git -C "$SIAX_TEMPLATES_DIR" init --quiet + git -C "$SIAX_TEMPLATES_DIR" remote add origin \ + "https://oauth2:${SIAX_CI_TOKEN}@git.siax.io/${SIAX_TEMPLATES_REPO}.git" + # Ask for the pinned commit by SHA -- one shallow commit, no branch + # involved. A server with uploadpack.allowReachableSHA1InWant off + # refuses that, so fall back to fetching the branches and taking the + # same commit out of them. Either way the work tree ends up at + # exactly $SIAX_TEMPLATES_PINNED_SHA, never at a branch tip. + if ! git -C "$SIAX_TEMPLATES_DIR" fetch --quiet --depth 1 origin "$SIAX_TEMPLATES_PINNED_SHA"; then + echo "note: server refused a by-SHA fetch; falling back to fetching all branches" + git -C "$SIAX_TEMPLATES_DIR" fetch --quiet origin + fi + if ! git -C "$SIAX_TEMPLATES_DIR" -c advice.detachedHead=false \ + checkout --quiet --detach "$SIAX_TEMPLATES_PINNED_SHA"; then + echo "::error::siax-templates commit $SIAX_TEMPLATES_PINNED_SHA not found in $SIAX_TEMPLATES_REPO -- the reviewed commit was removed or rewritten upstream. Re-review siax-templates and update SIAX_TEMPLATES_PINNED_SHA deliberately." + exit 1 + fi actual_sha="$(git -C "$SIAX_TEMPLATES_DIR" rev-parse HEAD)" if [ "$actual_sha" != "$SIAX_TEMPLATES_PINNED_SHA" ]; then - echo "::error::siax-templates $SIAX_TEMPLATES_REF moved (now $actual_sha, pinned $SIAX_TEMPLATES_PINNED_SHA) -- refusing to run an unreviewed version of the gate. Re-review and update SIAX_TEMPLATES_PINNED_SHA deliberately." + echo "::error::checked-out siax-templates HEAD is $actual_sha, expected the pinned $SIAX_TEMPLATES_PINNED_SHA -- refusing to run an unreviewed version of the gate." exit 1 fi chmod +x "$SIAX_TEMPLATES_DIR/ci/v2/reference-hooks/"*.sh "$SIAX_TEMPLATES_DIR/ci/v2/reference-hooks/lib/"*.sh - echo "siax-templates G17 reference @ $actual_sha (pinned, verified)" + echo "siax-templates G17 reference @ $actual_sha (pinned commit, checked out directly)" - name: Resolve SHA + tag (never :latest) id: sha diff --git a/.siax/hooks/G17.sh b/.siax/hooks/G17.sh index ae34de4..029c7e6 100644 --- a/.siax/hooks/G17.sh +++ b/.siax/hooks/G17.sh @@ -70,9 +70,10 @@ # picks up main's current tip rather than an older commit, matching what a # fresh migration reviews). Pinned at # 384e35060b91ea78ec045e14af114abf5d5eb23b -- the exact ref lives in -# `.gitea/workflows/release.yml` (SIAX_TEMPLATES_REF=main + -# SIAX_TEMPLATES_PINNED_SHA, which refuses to run if main has moved past -# the pin). +# `.gitea/workflows/release.yml` (SIAX_TEMPLATES_PINNED_SHA, which is +# fetched and checked out DIRECTLY by SHA -- no branch is consulted, so an +# unrelated merge on siax-templates' main does not fail this gate; a pinned +# commit that no longer exists upstream does). set -euo pipefail REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" diff --git a/.siax/hooks/README.md b/.siax/hooks/README.md index 1100b8c..74318bc 100644 --- a/.siax/hooks/README.md +++ b/.siax/hooks/README.md @@ -45,10 +45,15 @@ Pinned to `sax3l/siax-templates` main at (`feat/g17-signed-deploy-gate-adr-w16-003`) merged, plus follow-up fixes #56/#57 (SPDX compound-license-expression evaluation, exercised live by this adapter's own `G17_LICENSE_ALLOW` policy) and #59 (G20 retry logic; -not used by 0pt yet, see below). `.gitea/workflows/release.yml`'s own -`SIAX_TEMPLATES_PINNED_SHA` step refuses to run if `siax-templates` main -has moved past this exact commit -- bumping the pin is a reviewed, -source-controlled diff to that one line, never a silent re-resolution. +not used by 0pt yet, see below). `.gitea/workflows/release.yml` fetches +and checks out `SIAX_TEMPLATES_PINNED_SHA` **directly by SHA** and refuses +to run if that exact commit cannot be checked out (removed or rewritten +upstream) -- bumping the pin is a reviewed, source-controlled diff to that +one line, never a silent re-resolution. It deliberately does **not** +compare the pin against `main`: that branch tip moves whenever anything +unrelated merges in `siax-templates`, and failing this chain on that said +nothing about whether the reviewed gate was safe (CD-03 / CI-RED-02). The +authoritative pin value is the one in `release.yml`. ## G20 (live-digest-equality) -- deliberately not wired yet -- 2.54.0