admin/0pt
5
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): check out the siax-templates pin directly instead of comparing main #120

Merged
admin merged 1 commits from fix/templates-pin-0pt-20260926 into main 2026-09-26 18:47:55 +00:00
Conversation 1 Commits 1 Files Changed 3
+48 -17
1 Commits
Author SHA1 Message Date
Claude CodeandClaude Opus 5 65ee88a01c fix(ci): check out the siax-templates pin directly instead of comparing main
CI (SIAX Cloud) / integration (push) Skipped
Details
Security Scan (SIAX Cloud) / security (push) Successful in 16s
Details
CI (SIAX Cloud) / security (push) Successful in 22s
Details
masterplan-lock / check (push) Successful in 21s
Details
masterplan-lock / check (pull_request) Successful in 7s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 19s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 1m2s
Details
CI (SIAX Cloud) / quality (push) Successful in 1m56s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 1m16s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 1m15s
Details 
The G17 gate cloned sax3l/siax-templates on the moving branch `main` and
then required that clone's HEAD to equal SIAX_TEMPLATES_PINNED_SHA. Every
merge in siax-templates -- including ones that touch nothing under
ci/v2/reference-hooks -- therefore turned this repo's release chain red
while nothing was actually unsafe (CD-03 / CI-RED-02). It is red right now:
siax-templates main is at 6612f6ae, the pin is 09504e3a.

The pin is still a real supply-chain control; what was wrong was tying it
to someone else's branch tip. The step now fetches the pinned commit by
SHA (shallow, no branch consulted) and checks it out detached, falling back
to fetching the branches and taking the same commit out of them if the
server refuses a by-SHA fetch. It fails closed on the thing that actually
matters -- the reviewed commit no longer existing upstream -- and the
post-checkout HEAD assertion is kept so the gate still proves what it ran.

SIAX_TEMPLATES_REF is removed rather than left unused, so the moving-branch
shape cannot quietly come back. The pin value itself is unchanged: commit
09504e3a is confirmed present in siax-templates (Gitea API, two commits
behind main). Two comments that described the old "refuses to run if main
moved" behaviour are corrected in the same change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-26 20:07:29 +02:00