fix(sync): publish without force under the ruleset - #2
Open
shmpwk wants to merge 3 commits into
Open
Conversation
Publishing to awf-latest/universe needs refs/heads/awf-latest gone, because git cannot hold a branch and a namespace of the same name. Deleting it here is refused by the organisation rulesets, so the push failed with a ref lock error even though the rule violations themselves were bypassed. Keep the names the previous workflows used instead: awf-latest for the universe mirror and awf-core-latest for the core one, both already present, plus a new awf-launch-latest. Nothing that already points at those branches has to move, and the namespace can still be adopted later: every branch is a deterministic function of its inputs, so renaming costs one configuration change and one rerun rather than a history rewrite. Also carries the optional-source support the launch mirror depends on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Shumpei Wakabayashi <shumpei.wakabayashi@tier4.jp>
Publishing always passed --force for sources configured with force: true, even when the update was a plain fast-forward. That is pointless, and it trips rulesets that forbid non-fast-forward updates but would have accepted the very same update without the flag. Classify the update first. An unchanged branch is not pushed at all, a fast-forward is pushed without --force, and only a genuinely diverged history forces. A diverged history on a source that does not allow forcing now fails with that as the reason instead of letting git report a non-fast-forward. When the remote does reject a push, match its message and say which knob is involved: a ref name colliding with an existing branch, a ruleset whose bypass list does not include the pushing identity, or a history that diverged. These took a while to tell apart by hand, and the raw git output names none of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Shumpei Wakabayashi <shumpei.wakabayashi@tier4.jp>
Rebuilding awf-combined-latest from scratch reordered history whenever a member advanced, which rewrote published commit ids and tripped rulesets that forbid force pushes. Resume from the published tip by matching each member's renamed subtree oids, append only the pending commits, and verify the tip tree against the current member tips instead of rebuild identity. Per-source mirrors stay fully deterministic; combined force stays off. Signed-off-by: Shumpei Wakabayashi <shumpei.wakabayashi@tier4.jp> Co-authored-by: Cursor <cursoragent@cursor.com>
shmpwk
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ルールセットが force push を禁じていても、このリポジトリのミラーを publish できるようにする。土台は次の三つで、どれも同じ筋に乗る。
awf-latest/universeはawf-latestが残っていると作れない。組織ルールセットが既存ブランチの削除を拒むので、以前の workflow と同じ平坦な名前のままにする。force: trueでも fast-forward には--forceを付けない。付けていたせいで、ルールセットが受け入れる更新まで落ちていた。保証の入れ替え（結合ブランチ）
実運用で効くのは 2 行目。
awf-combined-latestは既に一度書き換わる状況になっており、ブランチを切る・コミットを参照する利用者から見ると、公開済み id の不変性の方が強い。失う「再構築で一致」は監査用の性質で、運用上の性質を犠牲にして得ていたものだった。内容の検証は維持する
結合ブランチは 3 つのミラーからの派生物で、ミラー自体は完全に決定的。したがって「持つべき内容」はいつでも再計算でき、
--verifyは tip のツリーが現在のメンバー tip の合成と一致すること（および同じ公開済み tip からの append が再現すること）を見る。id ではなく内容で照合する。外部状態は不要
「どこまで replay 済みか」は公開済み tip から復元する。tip には各メンバーのサブツリーがリネーム後のパスで入っており、その oid をメンバー履歴と突き合わせれば再開位置が一意に決まる。別ブランチや別 ref は持たない。
変わらないもの
universe/core/launchのミラー履歴は完全に決定的で、ここは何も変えないawf-latest/awf-core-latestを指しているものも動かさないTest plan
tools/sync_config.py validatetools/mirror.py combine awf-combined-latest --work /tmp/combine --downstream <url> --verifyunchanged/ 進んでいれば fast-forward のみ--forceなしで ruleset 下の publish が通ること