Repository navigation
ci: read the guard's inert list from the base revision - #11
Merged
Merged
Conversation
The guard normalised `package.json` on both sides with the inert devDependency list from the commit under test, so a PR could add a dependency to that list and skip the release the dependency was meant to cut — `.github/**` is non-shipping, so the workflow change never counted either. The literal stays in the file: it is the list this commit publishes under, and the next run reads it from the base. This run reads the base copy instead, so an entry only takes effect after it has landed through review. A base with no literal (guard newly added) yields [], which treats every devDependency change as shipping — the fail-closed direction.
nabheet
force-pushed
the
ci/guard-inert-base-10
branch
from
November 1, 2026 00:52
b22c5e6 to
4fc1a82
Compare
nabheet
marked this pull request as ready for review
November 1, 2026 01:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs
nabheet/galactic-config#10.Problem
The guard normalised
package.jsonon both sides with the inert devDependency list read from the commit under test. A PR could add its own dependency to that list and skip the release the dependency was meant to cut — and.github/**is non-shipping, so the workflow edit never counted either.Change
The literal stays in the file: it is the list this commit publishes under, and the next run reads it from there. This run reads the comparison base's copy instead, so an entry only takes effect once it has landed through review.
No literal on the base (guard newly added) yields
[]→ every devDependency change ships. Fail-closed. The extraction tolerates trailing whitespace on the literal line.Proof
Reproduced locally against a scratch branch, running the guard's real script with the base pinned:
RESULT: changedfalsefalsetrueUnder the old guard the last commit normalises to no diff, so it would have logged
skipand released nothing.Not fixed here
The guard code itself still runs from the commit under test, so a PR can rewrite the guard. Closing that needs the guard body loaded from the base revision, which is a restructure of all five workflows, not a one-line change.
Release impact
.github/**only, so the merge run reportsRESULT: changed=falseand publishes nothing.