Repository navigation
ci: adopt the org CI canon in test.yml (CR-241, 19 -> 12 findings) - #243
Merged
Merged
Conversation
Bring .github/workflows/test.yml to the org canon: hosted authz job, canonical changes classifier, pinned workflow-lint, heavy-job if line and the required check aggregate that refuses an unauthorised run first. Canon: ci-labels.md sha256 d5125e09...; checker ci-policy-check.py sha256 efebe567... (full shas in the PR body). Not adopted here (named in the PR body): gate.yml and promote-baseline.yml still use pull_request_target (R1) and need an identity or event redesign. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Every `uses:` line in the new canon jobs carries a full 40-hex commit and a
version comment (L6 ruling, CORE-TOP 17:34-17:35, canon card LB-635):
uses: actions/checkout@3d3c42e # v7.0.1
Tag v7.0.1 resolves to commit 3d3c42e5aac5ba805825da76410c181273ba90b1
(`gh api repos/actions/checkout/git/ref/tags/v7.0.1`, type commit).
The current checker (ci-policy-check.py sha256 efebe567...) refuses the SHA
form in the `changes` and `check` jobs until LB-635 is live; those findings are
expected and wait for the canon fix.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… commit (CR-241)
`release.yml` step "Mint org App token" used `actions/create-github-app-token@v1`
(a floating tag). The org CI checker now refuses tag-only third-party actions
(rule R12, LB-635). Pin it to the commit with the exact release version:
uses: actions/create-github-app-token@d72941d # v1.12.0
Tags v1 and v1.12.0 both resolve to commit d72941d797fd3113feb6b93fd0dec494b13a2547
(`gh api repos/actions/create-github-app-token/git/ref/tags/<tag>`, type commit).
One line; no other change.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This was referenced Oct 23, 2026
luisleo526
added a commit
that referenced
this pull request
Oct 24, 2026
… base is an ancestor of the head (REV-CX r4 F1) The PR base 54ce4de was not an ancestor of core/cr150-l5 (4b0ff8b): the merge-base was v1.6.3 (3ac6503) and main had gained two commits, so the PR diff showed 1,106 deleted lines it does not intend. This is a merge commit, not a rebase; the automatic merge was clean (five files from main: .github/workflows/promote-baseline.yml, release.yml, test.yml, CONTRIBUTING.md, tests/test_pr_workflows.py). No conflict resolution, no edit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This was referenced Oct 24, 2026
luisleo526
added a commit
that referenced
this pull request
Oct 24, 2026
Adds "## 1.7.0 — 2026-10-25" to CHANGELOG.md per the file's release note policy (shape of the 1.6.1 section): compatibility and migration (exact pair with engine v1.7.0, regenerate C++ and relink against the engine v1.7.0 headers and libpineforge.a) and the three pull requests merged after v1.6.3: #213 (the user-observable change: the strategy_reads_trade_history export, the guarded set_trade_history_streamable constructor call for scripts that do not read closed-trade rows, the qualified constructor host calls, and the larger set of reserved names with their pf_safe_ escape, from the diff of 89b48cb and docs/PUBLIC_CONTRACT.md), and #242 and #243 as repository/CI only. No backfill of 1.6.2 or 1.6.3 (follow-up card), no claim about the engine beyond its own notes, VERSION untouched (release.yml writes it). CHANGELOG.md only. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canon
ci-labels.mdsha256d5125e0977706353a26f0e31133eedcf3a2c6a67bf53d05cdbc7876930a3b3a4; checkerci-policy-check.pysha256efebe567985541c7e99b17859ce6d881d6f53694ee2c602c5d61aa517613c8f7.Card CR-241 (live CI checker findings beyond engine). Lane: Codex gpt-6.1-sol. ORG-CX re-ran the checker read-only and ran the TypeSafe diff guard (PASS). No repo tests ran on a Mac: hosted CI on this head is the proof.
Canon blocks use
actions/checkout@v7by tag (LB-545 addendum), copied byte for byte. This replaces earlier SHA-pinned checkouts.Change:
.github/workflows/test.ymladopts the canon blocks. Checker findings 19 -> 12.Left, named, not fixed (follow-up card): 12 findings in
gate.yml(R1pull_request_target; R9 changes/workflow-lint/preflight-docs classes, differential/pytest heavyif, gate consumes class outputs, check shape; R10 gate always()) andpromote-baseline.yml(R1pull_request_target). Both usepull_request_targetby design (SEC846 fork-safe gate, identity bound to the base), so that is a design question, not an adoption edit. The required checkgateis untouched.🤖 Generated with Claude Code
Update (LB-635 live, checker
3482938c, canondbd9d4ee): everyuses:line this PR adds is SHA-pinned (actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1). One more commit (2b97e6e6a5) pins the oldrelease.yml:59toactions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0(tags v1 and v1.12.0 both read at that commit). Checker on the head: 12 findings, all known, carded CR-283 (10-27):gate.ymlR1pull_request_target; R9changes,workflow-lint,preflight-docsx2,differential,pytest,gate,checkx2; R10gate;promote-baseline.ymlR1pull_request_target. These usepull_request_targetby SEC846 design (fork-safe gate, identity bound to the base); a canon exception or a redesign is CR-283's question.