From 433e8f81c8ff043a1c7c8ac2fc8c4ae2eaa9e4f1 Mon Sep 17 00:00:00 2001 From: Timothy Date: Sat, 5 Sep 2026 00:52:37 +0200 Subject: [PATCH] fix(885): cite the predecessor by description, not by a sha the rebase orphaned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three docstrings dated their measurement to `59003d5a3`, this branch's head before it was rebased onto `main` after ersatztv#907 landed. That commit is unreachable from the branch and will never be in `main`, so `git show` on it fails for every later reader — a citation that cannot be followed is worse than none, because it reads as checkable. Each now names what it measured against ("the predecessor of this commit", and for the guard, "as it walked `jobs.` only and compared per-file NAME SETS"), which is what the reader actually needs and what survives any rebase. Refs #885 Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_015QqCpYFsKgnAnx6jVwrKiV --- scripts/tests/test_ci_toolchain_image_resolves.py | 2 +- scripts/tests/test_workflow_persist_credentials.py | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/scripts/tests/test_ci_toolchain_image_resolves.py b/scripts/tests/test_ci_toolchain_image_resolves.py index b974186c0..181eab4ff 100644 --- a/scripts/tests/test_ci_toolchain_image_resolves.py +++ b/scripts/tests/test_ci_toolchain_image_resolves.py @@ -299,7 +299,7 @@ def test_a_refusal_with_NO_CHALLENGE_never_claims_a_token_was_obtained(preflight `probe` enters the token leg on a `401` only, so a registry answering `403` on the first read — or a `401` carrying no `Www-Authenticate` — leaves the script with no token having asked for - nothing. Measured 2026-09-05 on the predecessor at 59003d5a3, the `403` shape reported "even + nothing. Measured 2026-09-05 on the predecessor of this commit, the `403` shape reported "even after a Bearer token was obtained", which sends an operator to package visibility on evidence that does not exist (`dont-narrate-mechanisms-you-didnt-measure`). The two codes are BOTH driven because they take different paths: the challenge-less `401` still enters and abandons the token diff --git a/scripts/tests/test_workflow_persist_credentials.py b/scripts/tests/test_workflow_persist_credentials.py index cfad85b07..11c09b7a8 100644 --- a/scripts/tests/test_workflow_persist_credentials.py +++ b/scripts/tests/test_workflow_persist_credentials.py @@ -523,7 +523,8 @@ def test_the_DOCUMENT_walk_finds_every_secret_reference_the_TEXT_does() -> None: loader drops) is then a disagreement, and the guard says so instead of reporting clean. IT COUNTS OCCURRENCES, IT DOES NOT COMPARE NAME SETS, and that is the load-bearing part rather - than a refinement. Measured 2026-09-05 on the shipped tree at 59003d5a3: hoisting + than a refinement. Measured 2026-09-05 against the predecessor of this commit — the guard as it + walked `jobs.` only and compared per-file NAME SETS — hoisting `ETV_REGISTRY_AUTH: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}` into `docker-build.yml`'s root `env:` left a set-comparison cross-check GREEN (`14 passed`), because `build` legitimately keeps naming both names — the two halves cancelled and the check could only @@ -711,9 +712,9 @@ def test_the_collector_reports_a_WORKFLOW_SCOPE_reference_no_job_if_can_reach() def test_MUTATION_a_WORKFLOW_LEVEL_env_in_the_SHIPPED_workflow_is_DETECTED() -> None: """Drives the SHIPPED `docker-build.yml`, hoisting the credential to workflow scope. - This is the mutation that a name-set cross-check could not see (measured 2026-09-05 at - 59003d5a3: `14 passed`, rc=0) — `build` already names both halves, so a second copy at root - changed no NAME. It is exercised on the real file rather than a synthetic document for the same + This is the mutation that a name-set cross-check could not see (measured 2026-09-05 against the + predecessor of this commit: `14 passed`, rc=0) — `build` already names both halves, so a second + copy at root changed no NAME. It is exercised on the real file rather than a synthetic document for the same reason `test_MUTATION_the_BUILD_job_losing_its_route_EXCLUSION_is_DETECTED` is: `docker-build.yml` is the file the invariant is about, and a fixture would only prove the collector works on a document this repo does not ship.