[PR #4199] [MERGED] ci: pin Cutter actions and guard workflow-only changes #6121

New issue

Closed

opened 2026-10-31 01:12:01 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:01 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4199
Author: @N0zoM1z0
Created: 10/15/2026
Status: ✅ Merged
Merged: 10/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/ci-cutter-action-pins-20261015

📝 Commits (2)

a43d10c ci: pin Cutter actions and guard workflow-only changes
c4abda9 test(ci): require immutable Docker action digests

📊 Changes

3 files changed (+156 additions, -3 deletions)

View changed files

📝 .github/workflows/ci.yml (+5 -0)
📝 .github/workflows/real-cutter.yml (+3 -3)
➕ tests/boundary/filesystem/workflowActionPinning.test.ts (+148 -0)

📄 Description

Closes #3434. Extracts the CI portion of #3440; credit to @GovinduSasanka for the original pins and YAML guard.

real-cutter.yml still had three mutable @v4 references. Pin them to the exact official commits those tags currently resolve to, matching other workflows (upload v4.6.2, download v4.3.0). A YAML-based regression checks actual action/reusable-workflow call sites across all 30 repository workflows and four composite action manifests; arbitrary inputs named uses are ignored. Docker action references require a complete SHA256 digest, rather than a mutable image tag.

Workflow-only PRs previously skipped the test suite. The static job now runs this source-only guard through the existing exact-test runner for that tier, without runtime preparation. Code tiers retain execution in their normal shards.

Validation on base 1b828dbb1:

New guard reports exactly the three Cutter references on the baseline; fixed tree passes. Reverting one pin and removing the workflow-only guard each produce one expected failing regression.
With dist physically absent, both fresh-process guard runs pass all five cases: 1.15s / 1.22s, CPU 1.19/0.18s / 1.21/0.26s user/system, sampled family RSS 293 / 280MiB. Local dependencies and OS caches were warm; startup vs cache effects were not isolated, and agent tokens are unmeasured. Sampling may miss brief/reparented children and double-count shared pages.
Four CI boundary files: 250 passed before the digest-only follow-up, including classification and required/report gates; their sources are unchanged. Current five-case guard passes; the old Docker exemption fails the new assertion, and an actual workflow changed to a Docker tag is rejected. check:ci (eight tasks and 1441 architecture guards) and pinned actionlint1.7.7 pass. Current-head CI 38785256104 passes all 36 jobs, including Windows, Portable aggregation and the required gate. The guard itself ran five passing cases in 170ms in shard1. Codex and Greptile completed on c4abda9f4 with no remaining findings; the valid Docker finding was fixed and its controls rerun.

Scope: existing CI integrity only; no CLI/MCP, Evidence, provider or package behavior changes. The self-hosted Cutter engine lane was not run; official tag/commit identities were verified through GitHub's API. Hopper/apktool and installer changes in #3440 remain separate.

Post-merge verification on 3406dc4d8: expected integration tree matches, all guard/workflow inputs match the tested head, and the actual merged-main guard passes all five cases (3.13s wall, child CPU 2.22/0.65s, sampled family RSS 287MiB).

The user delegated implementation, technical review, ready-for-review creation and merge. Assistant technical review is reported; a separate human reread is not claimed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4199 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/15/2026 **Status:** ✅ Merged **Merged:** 10/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/ci-cutter-action-pins-20261015` --- ### 📝 Commits (2) - [`a43d10c`](https://github.com/morluto/rea/commit/a43d10c80e8fbac6fca91eb0059130db8b279106) ci: pin Cutter actions and guard workflow-only changes - [`c4abda9`](https://github.com/morluto/rea/commit/c4abda9f492c426b5f8e98bdbf04729e24e608dd) test(ci): require immutable Docker action digests ### 📊 Changes **3 files changed** (+156 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+5 -0) 📝 `.github/workflows/real-cutter.yml` (+3 -3) ➕ `tests/boundary/filesystem/workflowActionPinning.test.ts` (+148 -0) </details> ### 📄 Description Closes #3434. Extracts the CI portion of #3440; credit to @GovinduSasanka for the original pins and YAML guard. `real-cutter.yml` still had three mutable `@v4` references. Pin them to the exact official commits those tags currently resolve to, matching other workflows (upload v4.6.2, download v4.3.0). A YAML-based regression checks actual action/reusable-workflow call sites across all 30 repository workflows and four composite action manifests; arbitrary inputs named `uses` are ignored. Docker action references require a complete SHA256 digest, rather than a mutable image tag. Workflow-only PRs previously skipped the test suite. The static job now runs this source-only guard through the existing exact-test runner for that tier, without runtime preparation. Code tiers retain execution in their normal shards. Validation on base `1b828dbb1`: - New guard reports exactly the three Cutter references on the baseline; fixed tree passes. Reverting one pin and removing the workflow-only guard each produce one expected failing regression. - With `dist` physically absent, both fresh-process guard runs pass all five cases: **1.15s / 1.22s**, CPU **1.19/0.18s / 1.21/0.26s user/system**, sampled family RSS **293 / 280MiB**. Local dependencies and OS caches were warm; startup vs cache effects were not isolated, and agent tokens are unmeasured. Sampling may miss brief/reparented children and double-count shared pages. - Four CI boundary files: **250 passed** before the digest-only follow-up, including classification and required/report gates; their sources are unchanged. Current five-case guard passes; the old Docker exemption fails the new assertion, and an actual workflow changed to a Docker tag is rejected. `check:ci` (eight tasks and 1441 architecture guards) and pinned actionlint1.7.7 pass. Current-head CI [38785256104](https://github.com/morluto/rea/actions/runs/38785256104) passes all **36 jobs**, including Windows, Portable aggregation and the required gate. The guard itself ran **five passing cases in 170ms** in shard1. Codex and Greptile completed on `c4abda9f4` with no remaining findings; the valid Docker finding was fixed and its controls rerun. Scope: existing CI integrity only; no CLI/MCP, Evidence, provider or package behavior changes. The self-hosted Cutter engine lane was not run; official tag/commit identities were verified through GitHub's API. Hopper/apktool and installer changes in #3440 remain separate. Post-merge verification on `3406dc4d8`: expected integration tree matches, all guard/workflow inputs match the tested head, and the actual merged-main guard passes all five cases (3.13s wall, child CPU 2.22/0.65s, sampled family RSS 287MiB). The user delegated implementation, technical review, ready-for-review creation and merge. Assistant technical review is reported; a separate human reread is not claimed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:01 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:45:48 +00:00

[PR #6144] [MERGED] fix(cancellation): preserve caller abort reason in cancellation errors #7159

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6121

No description provided.

Rows
Columns