3 Commits

Include renames

Author	SHA1	Message	Date
timothyandClaude Opus 5	d44d9eb55f	fix(836): the guard's git fixtures must not inherit an identity from the machine ... CI red: `git commit -q -m docs on the PR head failed: Author identity unknown`. The fixtures set `user.email`/`user.name` on the ORIGIN repos, but the PR-arm test commits in a CLONE, which inherited nothing. A developer checkout has a global identity and the CI container has none, so the file was green here and red there. Fixed at the boundary rather than the site: `_GIT_CONF` is passed to EVERY git invocation in the file, so no repository it creates can depend on ambient config. It also disarms a global `core.hooksPath` (which would fire this repo's husky hooks against throwaway fixtures) and `commit.gpgsign` (which would block on a pinentry prompt no pytest timeout is watching). The now-redundant per-fixture `git config` calls are removed. `_env()` additionally points `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM` at os.devnull, so the ambient configuration is UNAVAILABLE rather than merely overridden. That alone did NOT reproduce CI, and the first version of this commit claimed it did: with the identity flags removed the suite still passed here, because a Mac invents an identity from the OS user and hostname. `user.useConfigOnly=true` is what closes it. Verified by removing the identity pair and watching the file go red locally with the same `Author identity unknown` CI produced — so a local run now catches this class instead of deferring it to the runner. Gate: ruff check + format --check pass over all 51 tracked files with the CI-pinned 0.12.11; suite 1237 passed, 2 skipped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HETQK67q1bEpDZpHLZNsp9	2026-08-30 00:46:49 +02:00
timothyandClaude Opus 5	7fa2e35617	fix(836): ruff format the new guard file ... `ruff format --check` was the only red in `script-tests` — `ruff check` passed on all 51 tracked files and pytest never ran. Purely cosmetic: the repo's ruff config allows a wider line than the hand-wrapping used, so several call sites collapse to one line. Verified with the version CI pins (ruff 0.12.11) over the same population the job derives (`git ls-files -z '*.py' '*.pyi' '*.ipynb'` under bash, 51 files): both `ruff check` and `ruff format --check` pass. Suite unchanged at 1237 passed, 2 skipped. A follow-up commit rather than an amend: the branch is already pushed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HETQK67q1bEpDZpHLZNsp9	2026-08-30 00:46:49 +02:00
timothyandClaude Opus 5	3f12167bf0	fix(836): never pass --depth to a checkout that may already be complete ... `git fetch --depth=N` GRAFTS a complete clone shallow — it writes `.git/shallow` and cuts history at N even though every object is already present. `scripts/ci-detect-docs-only.sh` has four consumers in docker-build.yml and they do not agree on checkout depth: test/migrations/functional-e2e check out `fetch-depth: 2`, while `build` (and api-docs/format on the PR arm) check out `fetch-depth: 0`. The script applied a depth chosen for the first group to all of them. For `build` that grafted its complete clone on every push to main, so the `git describe --tags` in the immediately following `Compute version and tags` step found no reachable tag, and a `|| echo v0.0.0` fallback that cannot fail turned that into a version: every `:latest` image shipped `InformationalVersion 0.0.0-<sha>`. Both fetch sites now go through `fetch_ref`, which passes `--depth` only when `git rev-parse --is-shallow-repository` answers `true`. That also closes the PR arm's `--depth=200` — the same defect with a larger N, grafting api-docs/format. An unknown answer passes no depth: the query fails only where there is no readable repository, and a depth cannot help there either. Second half: `Compute version and tags` no longer defaults. A failed `git describe` on the non-tag path fails the job rather than stamping 0.0.0, so no `:latest` is published instead of a mislabelled one. `build` is not a required status context, so this cannot block a merge. The tag path never calls `describe`, so `:prod`/`:<version>` releases are unaffected — which is also why they were correctly versioned throughout. Measured, not inferred: - The live defect, from run 2416 / job 10345 (push to main 8aeacd534): `INFO_VERSION=0.0.0-8aeacd53`. - Against a real anonymous clone of this repository: the predecessor detector grafts it and `describe` fails -> `0.0.0-1afad085`; the fixed detector leaves it complete -> `26.14.0-1afad085`. - The workflow step body executed on both clones: grafted -> exit 1 with a diagnostic, complete -> `26.14.0-1afad085`, tag path -> `26.14.0` + `:prod` even on a grafted clone. New guard `scripts/tests/test_docs_only_detector_clone_depth.py` drives the real script over real `file://` clones (a plain path clone silently ignores --depth, so it carries a negative control that requires the fixture to be able to graft at all). It was witnessed red against the predecessor. Its clause mutation is declared in mutation_manifest.py, which promotes the detector's guard-inventory row from NONE to MUTATION; the stated reason it was undeclared — that a skip-gate script's effect is visible only in a workflow run — was itself wrong. fixes #836 Decisions-Edit: yes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HETQK67q1bEpDZpHLZNsp9	2026-08-30 00:46:49 +02:00