From 2cc97743c0a3da18d372f561ff2fd268eeddeccd Mon Sep 17 00:00:00 2001 From: Timothy Date: Fri, 28 Aug 2026 20:46:28 +0200 Subject: [PATCH] docs(786): record the parser's measured fail-closed property MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `_ROW`'s `[^|]*` Blocks cell means a raw pipe inside it — a code span such as `grep ... | cut ...` — stops the row matching. An unmatched row is an ABSENT row, which the set equality reports as a guard job with no entry, so the failure is a loud red rather than a silently skipped row. Measured rather than reasoned: injecting a pipe into one Blocks cell reddens test_the_inventory_covers_exactly_the_guard_JOBS_that_exist naming that job. Recorded because a regex over a Markdown table invites the opposite assumption, and the next person to widen a cell should know which way it breaks. Refs #786 --- scripts/tests/test_workflow_job_guards.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/scripts/tests/test_workflow_job_guards.py b/scripts/tests/test_workflow_job_guards.py index e7fc09c58..4757a2ef4 100644 --- a/scripts/tests/test_workflow_job_guards.py +++ b/scripts/tests/test_workflow_job_guards.py @@ -64,6 +64,15 @@ ROLES = frozenset({GUARD, ADVISORY, NONE}) # role -> the Kind the row must carry. `none` is absent by construction: it takes no row. ROLE_KIND = {GUARD: "GUARD", ADVISORY: "ADVISORY"} +# Keyed on the `.yml::` shape of the first cell, so this cannot match a row of the +# file-guard table (or any other) even before `inventory_section()` narrows the text. +# +# A MALFORMED ROW FAILS CLOSED, which is the property that makes a regex acceptable here at all. +# `[^|]*` for the Blocks cell means a raw `|` inside it (a code span such as `grep … | cut …`) +# stops the row matching — and an unmatched row is an ABSENT row, which the set equality reports as +# a guard job with no entry. Measured: injecting a pipe into one Blocks cell reddens +# `test_the_inventory_covers_exactly_the_guard_JOBS_that_exist` naming that job. The failure is a +# loud red on a correct-looking table, never a silently skipped row. _ROW = re.compile(r"^\|\s*`([a-z0-9.-]+\.ya?ml::[A-Za-z0-9_-]+)`\s*\|([^|]*)\|\s*([A-Z]+)\s*\|", re.M)