Skip to content

fix(workflows): update pinned SHA to commit with reusable/ directory#36

Merged
YiWang24 merged 8 commits into
mainfrom
fix/reusable-workflow-paths
May 4, 2026
Merged

fix(workflows): update pinned SHA to commit with reusable/ directory#36
YiWang24 merged 8 commits into
mainfrom
fix/reusable-workflow-paths

Conversation

@YiWang24

@YiWang24 YiWang24 commented May 4, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • SHA d280a64 was used as the pinned ref for all YiAgent/OpenCI reusable workflow calls, but that commit predates the reusable/ subdirectory reorganization — the directory simply does not exist there
  • GitHub Actions cannot resolve reusable/ci.yml (or any reusable/*.yml) at that SHA → every caller workflow fails immediately with "workflow file issue" before any job starts (0 jobs run)
  • Updated all 24 @d280a64 references and the manifest.yml source-of-truth entry to ebe8fca3260dce68d34d51b74703169e776bc72d, which is the first main-branch commit confirmed to contain .github/workflows/reusable/*.yml

Test plan

  • All 11 previously-failing workflows (ci, agent, dependencies, deploy, docs, issue-ops, observability, on-maintenance, pull-request, release) now start jobs successfully
  • verify-sha-consistency pre-commit hook passes (335 uses, 0 errors — verified locally)
  • YAML lint passes on all modified files
  • test workflow still passes (unrelated to this fix; ANTHROPIC_API_KEY must be updated separately to fix the Live Eval job)

View in Codesmith
Need help on this PR? Tag @codesmith with what you need.

  • Let Codesmith autofix CI failures and bot reviews

Summary by CodeRabbit

  • Chores
    • Migrated CI/CD workflows to use externally-managed reusable workflows from YiAgent/OpenCI, pinned to specific commit hashes for reproducibility.
    • Added automated SHA validation and bump scripts to maintain consistency of workflow dependencies.
    • Enhanced workflow verification with new SHA consistency checks in PR validation.
    • Updated linting configuration to exclude certain directories.

YiWang24 added 3 commits May 3, 2026 20:53
GitHub Actions does not support the ./ relative path syntax for
reusable workflows in subdirectories. Replaced all uses of
./.github/workflows/reusable/*.yml with the full
YiAgent/OpenCI/.github/workflows/reusable/*.yml@SHA format,
which supports subdirectory paths and is valid per GitHub docs.

This fixes the broken workflow names (showing file paths instead
of name: field values) and the workflow dispatch failures.
Switch from HEAD SHA to manifest-pinned SHA d280a64 for all
YiAgent/OpenCI reusable workflow references, matching the
verify-sha hook requirement. Also update two BATS tests that
asserted the old ./ relative path pattern, and suppress a
SC2016 false positive where $ is intentional grep BRE syntax.
SHA d280a64 predates the reusable/ subdirectory reorganization — at that
commit the directory does not exist, causing GitHub Actions to fail with
"workflow file issue" before any job starts.

Updated all 24 references and manifest.yml to ebe8fca which is the first
main-branch commit confirmed to contain .github/workflows/reusable/*.yml.
@qodo-code-review

Copy link
Copy Markdown
ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.

@coderabbitai

coderabbitai Bot commented May 4, 2026

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 54c7684d-c859-452c-8345-9dd9ae9113ba

📥 Commits

Reviewing files that changed from the base of the PR and between 7439335 and 58fdfb3.

📒 Files selected for processing (2)
  • .yamllint
  • tests/actions/self-test-routing.bats

📝 Walkthrough

Walkthrough

The PR updates the repository to externalize and pin its reusable workflows and actions to a specific YiAgent/OpenCI commit SHA, replacing local relative references with remote pinned versions. It adds SHA consistency verification, automated bumping infrastructure, and supporting tooling to manage the pinned dependency.

Changes

Externalize and Pin YiAgent/OpenCI Workflows with SHA Verification & Automation

Layer / File(s) Summary
Manifest & Core Pinning
manifest.yml
Updates YiAgent/OpenCI dependency SHA from d280a64a... to ebe8fca3....
Workflow Job References
agent.yml, ci.yml, dependencies.yml, deploy.yml, docs.yml, issue-ops.yml, observability.yml, on-maintenance.yml, pull-request.yml, release.yml
All workflow jobs switch uses: from local relative paths (./.github/workflows/reusable/...) to pinned YiAgent/OpenCI remote workflows at commit ebe8fca3260dce68d34d51b74703169e776bc72d.
Reusable Workflow Action References
.github/workflows/reusable/ci.yml
Updates 8 occurrences of YiAgent/OpenCI/actions/_common/resolve-openci action pin from d280a64... to ebe8fca... across all jobs that perform OpenCI resolution and checkout.
SHA Verification & Validation
.github/scripts/verify-sha-consistency.sh, .github/workflows/reusable/pr.yml
Adds SELF_REFS map to verify that required directory structures (.github/workflows/reusable) exist at pinned SHAs; introduces verify-sha job in PR workflow that runs verification and gates Stage 2 enrich job on its success.
Automated SHA Bumping
scripts/bump-self-sha.sh, .github/workflows/on-main-bump-sha.yml
New script to resolve latest remote SHA, walk back up to 20 commits to find commit containing .github/workflows/reusable/, update manifest.yml and workflow files; new Auto-bump self SHA workflow triggers on main push or dispatch, runs the bump script, and creates a follow-up PR if SHA was stale.
Configuration & Tests
.yamllint, tests/actions/self-test-routing.bats
Ignores .claude/worktrees/ from yamllint checks; updates issue-ops.yml workflow verification to use extended regex instead of PCRE.

Sequence Diagram

sequenceDiagram
    actor Developer as Developer
    participant Main as main branch
    participant Workflow as on-main-bump-sha.yml
    participant Script as bump-self-sha.sh
    participant Manifest as manifest.yml
    participant WorkflowFiles as .github/workflows/*.yml
    participant PR as GitHub PR

    Developer->>Main: Push to main
    Main->>Workflow: Trigger Auto-bump self SHA
    Workflow->>Workflow: Read YiAgent/OpenCI SHA from manifest.yml
    Workflow->>Workflow: Check if .github/workflows/reusable/ exists at that SHA
    Workflow->>Workflow: Compare against current HEAD
    
    alt SHA is stale or missing
        Workflow->>Script: Execute bump-self-sha.sh
        Script->>Script: Fetch REMOTE/BASE_BRANCH
        Script->>Script: Walk back up to 20 commits for commit containing .github/workflows/reusable/
        Script->>Script: Read current SHA from manifest.yml
        Script->>Script: Validate new SHA differs from old
        Script->>Manifest: Replace old SHA with new SHA
        Script->>WorkflowFiles: Replace old SHA refs in all workflow files
        Script->>Workflow: Report completion
        Workflow->>Main: Commit manifest.yml + workflow files to new branch
        Workflow->>Main: Push chore/bump-self-sha-${NEW_SHA:0:8}
        Workflow->>PR: Open PR back to main
    else SHA is current
        Workflow->>Workflow: Skip bump steps
    end
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Poem

🐰 A cottontail's ode to the SHA-pinned feast:

From local paths we hop away,
To pinned commits, a structured way,
Bump the SHAs when new ones come,
Verify their homes, leave none to shun,
A cleaner warren, branch by branch,
We've earned ourselves a well-earned crunch! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: updating pinned SHA references across workflow files to a commit that contains the reusable/ directory.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/reusable-workflow-paths

Review rate limit: 9/10 reviews remaining, refill in 6 minutes.

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
tests/actions/on-issue-routing.bats (1)

99-103: ⚡ Quick win

Assert SHA pinning in the reusable workflow matcher.

The current grep only checks the workflow path; @main would still pass. Tighten this to require a commit SHA format.

Proposed test hardening
-  count=$(grep -c 'uses: YiAgent/OpenCI/.github/workflows/reusable/issue\.yml' "$ENTRY")
+  count=$(grep -c 'uses: YiAgent/OpenCI/.github/workflows/reusable/issue\.yml@[0-9a-f]\{40\}$' "$ENTRY")
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@tests/actions/on-issue-routing.bats` around lines 99 - 103, The test "all
four jobs call the same reusable workflow reusable/issue.yml" currently greps
only the path and allows a branch like `@main`; change the grep to assert SHA
pinning by matching the uses line including a commit SHA format (e.g. requires @
followed by a 40-hex SHA). Update the command that sets count (which references
ENTRY) to use an extended/Perl regex (grep -E or -P) that matches "uses:
YiAgent/OpenCI/.github/workflows/reusable/issue\.yml@[0-9a-f]{40}" so only
pinned commits count.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/actions/on-pr-routing.bats`:
- Around line 43-45: Update the test "single checks job calls reusable pr.yml
workflow" to assert the workflow reference includes a 40-character SHA suffix,
not just the file path: modify the grep invocation that inspects "$ENTRY" (the
check in the test function) so it requires 'uses:
YiAgent/OpenCI/.github/workflows/reusable/pr\.yml@' followed by a 40-character
hex SHA (0-9a-f or A-F) pattern; this ensures the reusable workflow is pinned to
a commit SHA instead of just the path.

---

Nitpick comments:
In `@tests/actions/on-issue-routing.bats`:
- Around line 99-103: The test "all four jobs call the same reusable workflow
reusable/issue.yml" currently greps only the path and allows a branch like
`@main`; change the grep to assert SHA pinning by matching the uses line including
a commit SHA format (e.g. requires @ followed by a 40-hex SHA). Update the
command that sets count (which references ENTRY) to use an extended/Perl regex
(grep -E or -P) that matches "uses:
YiAgent/OpenCI/.github/workflows/reusable/issue\.yml@[0-9a-f]{40}" so only
pinned commits count.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0187ff2e-39e6-43ca-bdb6-3c5d501a1980

📥 Commits

Reviewing files that changed from the base of the PR and between 623b74c and 7794e59.

📒 Files selected for processing (14)
  • .github/workflows/agent.yml
  • .github/workflows/ci.yml
  • .github/workflows/dependencies.yml
  • .github/workflows/deploy.yml
  • .github/workflows/docs.yml
  • .github/workflows/issue-ops.yml
  • .github/workflows/observability.yml
  • .github/workflows/on-maintenance.yml
  • .github/workflows/pull-request.yml
  • .github/workflows/release.yml
  • .github/workflows/reusable/ci.yml
  • manifest.yml
  • tests/actions/on-issue-routing.bats
  • tests/actions/on-pr-routing.bats

Comment on lines 43 to 45
@test "single checks job calls reusable pr.yml workflow" {
grep -q 'uses: \.\/\.github\/workflows\/reusable\/pr\.yml' "$ENTRY"
grep -q 'uses: YiAgent/OpenCI/.github/workflows/reusable/pr\.yml' "$ENTRY"
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Strengthen assertion to enforce SHA pin format.

Line 44 currently matches only the workflow path, so it won’t fail if @<sha> is accidentally removed. Assert a 40-char commit suffix explicitly.

Suggested test update
-  grep -q 'uses: YiAgent/OpenCI/.github/workflows/reusable/pr\.yml' "$ENTRY"
+  grep -Eq '^[[:space:]]*uses:[[:space:]]*YiAgent/OpenCI/\.github/workflows/reusable/pr\.yml@[0-9a-f]{40}[[:space:]]*$' "$ENTRY"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@test "single checks job calls reusable pr.yml workflow" {
grep -q 'uses: \.\/\.github\/workflows\/reusable\/pr\.yml' "$ENTRY"
grep -q 'uses: YiAgent/OpenCI/.github/workflows/reusable/pr\.yml' "$ENTRY"
}
`@test` "single checks job calls reusable pr.yml workflow" {
grep -Eq '^[[:space:]]*uses:[[:space:]]*YiAgent/OpenCI/\.github/workflows/reusable/pr\.yml@[0-9a-f]{40}[[:space:]]*$' "$ENTRY"
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@tests/actions/on-pr-routing.bats` around lines 43 - 45, Update the test
"single checks job calls reusable pr.yml workflow" to assert the workflow
reference includes a 40-character SHA suffix, not just the file path: modify the
grep invocation that inspects "$ENTRY" (the check in the test function) so it
requires 'uses: YiAgent/OpenCI/.github/workflows/reusable/pr\.yml@' followed by
a 40-character hex SHA (0-9a-f or A-F) pattern; this ensures the reusable
workflow is pinned to a commit SHA instead of just the path.

Two changes to prevent the "SHA predates reusable/ directory" class of
failures from reaching CI:

1. verify-sha-consistency.sh: after the existing consistency check, verify
   that any self-referencing entry (currently YiAgent/OpenCI) actually has
   the required directory (.github/workflows/reusable/) at the pinned SHA.
   Error message explicitly points to bump-self-sha.sh.

2. scripts/bump-self-sha.sh: automates the SHA update workflow. Fetches the
   latest main-branch HEAD, walks back until a commit with reusable/ is
   found, then atomically updates manifest.yml and all workflow files.
   Supports --dry-run for preview.

Usage: bash scripts/bump-self-sha.sh

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/scripts/verify-sha-consistency.sh:
- Around line 224-227: The current code silences git errors when running git
ls-tree into tree_output, causing shallow-clone cases where the commit object is
missing to surface as "SHA Missing Structure"; change the logic to first verify
the commit object exists by running git cat-file -e "$self_sha" (without
redirecting stderr) and if that fails call emit_error with a distinct message
like "SHA Missing Commit" explaining the commit object is not available locally,
then only run git ls-tree "$self_sha" "$self_required_path/" (as before) to
detect a missing directory and emit the existing "SHA Missing Structure" error
using emit_error when tree_output is empty.

In `@scripts/bump-self-sha.sh`:
- Around line 33-39: The ancestor walk can fail in shallow clones; after
resolving remote_sha (variable remote_sha) and before performing the ancestor
walk, detect a shallow repository (presence of .git/shallow or git rev-parse
--is-shallow-repository) and deepen/unshallow the repo by fetching more history
from REMOTE/BASE_BRANCH (use git fetch --unshallow or git fetch --depth=<n> from
REMOTE for BASE_BRANCH) so the subsequent ancestor traversal succeeds; ensure
the fetch call logs errors and falls back cleanly to die() if the
deepen/unshallow fails.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9256845e-91d8-420e-bde5-05ca9c1ecc79

📥 Commits

Reviewing files that changed from the base of the PR and between 7794e59 and c3418e4.

📒 Files selected for processing (2)
  • .github/scripts/verify-sha-consistency.sh
  • scripts/bump-self-sha.sh

Comment on lines +224 to +227
tree_output="$(git ls-tree "$self_sha" "$self_required_path/" 2>/dev/null || true)"
if [ -z "$tree_output" ]; then
emit_error "SHA Missing Structure" \
"manifest.yml: $self_name SHA $self_sha has no '$self_required_path/' directory. Run scripts/bump-self-sha.sh to update to a valid commit."

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sha="$(yq -r '.deps["YiAgent/OpenCI"] // ""' manifest.yml)"
echo "is_shallow=$(git rev-parse --is-shallow-repository)"
echo "manifest_sha=$sha"

if git cat-file -e "${sha}^{commit}" 2>/dev/null; then
  echo "commit_object_present=yes"
else
  echo "commit_object_present=no (likely shallow clone or missing fetch)"
fi

Repository: YiAgent/OpenCI

Length of output: 101


🏁 Script executed:

# Find the target file and check its content
find . -name "verify-sha-consistency.sh" -type f

Repository: YiAgent/OpenCI

Length of output: 102


🏁 Script executed:

# Read the file to see lines around 224-227
if [ -f ".github/scripts/verify-sha-consistency.sh" ]; then
  wc -l ".github/scripts/verify-sha-consistency.sh"
  sed -n '210,240p' ".github/scripts/verify-sha-consistency.sh"
fi

Repository: YiAgent/OpenCI

Length of output: 1296


🏁 Script executed:

# Also check the full context of the function containing this code
if [ -f ".github/scripts/verify-sha-consistency.sh" ]; then
  sed -n '200,250p' ".github/scripts/verify-sha-consistency.sh"
fi

Repository: YiAgent/OpenCI

Length of output: 1661


🏁 Script executed:

# Check if git cat-file -e works as expected and how git ls-tree behaves
# Let's examine the git documentation/behavior in context

# First, verify the SELF_REFS pattern and how manifest.yml is used
grep -n "SELF_REFS" ".github/scripts/verify-sha-consistency.sh" | head -20

Repository: YiAgent/OpenCI

Length of output: 242


🏁 Script executed:

# Check if there are any other usages of git ls-tree in the script
grep -n "git ls-tree" ".github/scripts/verify-sha-consistency.sh"

Repository: YiAgent/OpenCI

Length of output: 231


🏁 Script executed:

# Verify the manifest.yml structure to understand the data being validated
if [ -f "manifest.yml" ]; then
  cat manifest.yml
fi

Repository: YiAgent/OpenCI

Length of output: 15767


Distinguish missing commit objects from missing directory structure in shallow clones.

Line 224 swallows git ls-tree errors with 2>/dev/null || true, causing shallow clones to produce false "SHA Missing Structure" errors even when the path exists in the commit but the commit object itself is unavailable locally. Check commit-object availability first using git cat-file -e, emit a more specific error, and only then perform the path check.

Suggested fix
   for self_name in "${!SELF_REFS[@]}"; do
     self_required_path="${SELF_REFS[$self_name]}"
     self_sha="$(echo "$manifest_map" | awk -F'\t' -v key="$self_name" '$1 == key { print $2; exit }')"
     [ -z "$self_sha" ] && continue

+    if ! git cat-file -e "${self_sha}^{commit}" 2>/dev/null; then
+      emit_error "Missing Commit Object" \
+        "manifest.yml: $self_name SHA $self_sha is not present in the local clone. Fetch more history (e.g., checkout with fetch-depth: 0) and rerun."
+      continue
+    fi
+
     # git ls-tree returns non-empty output when the path exists at that SHA.
     tree_output="$(git ls-tree "$self_sha" "$self_required_path/" 2>/dev/null || true)"
     if [ -z "$tree_output" ]; then
       emit_error "SHA Missing Structure" \
         "manifest.yml: $self_name SHA $self_sha has no '$self_required_path/' directory. Run scripts/bump-self-sha.sh to update to a valid commit."
     fi
   done
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
tree_output="$(git ls-tree "$self_sha" "$self_required_path/" 2>/dev/null || true)"
if [ -z "$tree_output" ]; then
emit_error "SHA Missing Structure" \
"manifest.yml: $self_name SHA $self_sha has no '$self_required_path/' directory. Run scripts/bump-self-sha.sh to update to a valid commit."
for self_name in "${!SELF_REFS[@]}"; do
self_required_path="${SELF_REFS[$self_name]}"
self_sha="$(echo "$manifest_map" | awk -F'\t' -v key="$self_name" '$1 == key { print $2; exit }')"
[ -z "$self_sha" ] && continue
if ! git cat-file -e "${self_sha}^{commit}" 2>/dev/null; then
emit_error "Missing Commit Object" \
"manifest.yml: $self_name SHA $self_sha is not present in the local clone. Fetch more history (e.g., checkout with fetch-depth: 0) and rerun."
continue
fi
# git ls-tree returns non-empty output when the path exists at that SHA.
tree_output="$(git ls-tree "$self_sha" "$self_required_path/" 2>/dev/null || true)"
if [ -z "$tree_output" ]; then
emit_error "SHA Missing Structure" \
"manifest.yml: $self_name SHA $self_sha has no '$self_required_path/' directory. Run scripts/bump-self-sha.sh to update to a valid commit."
fi
done
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/scripts/verify-sha-consistency.sh around lines 224 - 227, The
current code silences git errors when running git ls-tree into tree_output,
causing shallow-clone cases where the commit object is missing to surface as
"SHA Missing Structure"; change the logic to first verify the commit object
exists by running git cat-file -e "$self_sha" (without redirecting stderr) and
if that fails call emit_error with a distinct message like "SHA Missing Commit"
explaining the commit object is not available locally, then only run git ls-tree
"$self_sha" "$self_required_path/" (as before) to detect a missing directory and
emit the existing "SHA Missing Structure" error using emit_error when
tree_output is empty.

Comment thread scripts/bump-self-sha.sh
Comment on lines +33 to +39
info "Fetching $REMOTE/$BASE_BRANCH ..."
git fetch --quiet "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
die "Cannot fetch $REMOTE/$BASE_BRANCH. Check your remote and network access."

remote_sha="$(git rev-parse "refs/remotes/$REMOTE/$BASE_BRANCH" 2>/dev/null)" || \
die "Could not resolve $REMOTE/$BASE_BRANCH after fetch."

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

remote="${REMOTE:-origin}"
branch="${BASE_BRANCH:-main}"

echo "is_shallow=$(git rev-parse --is-shallow-repository)"
git fetch --quiet "$remote" "$branch"
tip="$(git rev-parse "refs/remotes/$remote/$branch")"
echo "remote_tip=$tip"

if git rev-parse "${tip}^" >/dev/null 2>&1; then
  echo "parent_available=yes"
else
  echo "parent_available=no (deepen/unshallow needed for ancestry walk)"
fi

Repository: YiAgent/OpenCI

Length of output: 147


🏁 Script executed:

# First, let's locate and read the script file
fd -type f -name 'bump-self-sha.sh' | head -5

Repository: YiAgent/OpenCI

Length of output: 229


🏁 Script executed:

# Once located, read lines around 33-39 and 58-59 to understand the context
cat -n scripts/bump-self-sha.sh | sed -n '30,65p'

Repository: YiAgent/OpenCI

Length of output: 1536


🏁 Script executed:

# Test the actual ancestor walk scenario more thoroughly
# Check how many commits are available after fetch and if walk can complete
cat > /tmp/test_ancestor_walk.sh << 'EOF'
#!/usr/bin/env bash
set -euo pipefail

remote="${REMOTE:-origin}"
branch="${BASE_BRANCH:-main}"
workflow_search=".github/workflows/reusable"

echo "=== Initial State ==="
echo "is_shallow=$(git rev-parse --is-shallow-repository)"

echo -e "\n=== Fetching remote ==="
git fetch --quiet "$remote" "$branch" 2>/dev/null
remote_sha="$(git rev-parse "refs/remotes/$remote/$branch")"
echo "remote_sha=$remote_sha"

echo -e "\n=== Testing ancestor walk (simulating the script loop) ==="
candidate="$remote_sha"
max_iterations=5
iterations=0

while [ $iterations -lt $max_iterations ]; do
  iterations=$((iterations + 1))
  echo "  Iteration $iterations: candidate=$candidate"
  
  # Check if parent is available
  if ! git rev-parse "${candidate}^" >/dev/null 2>&1; then
    echo "  ERROR: Parent of $candidate not available in shallow clone!"
    echo "  Shallow clone depth insufficient for ancestor walk."
    break
  fi
  
  # In real script, would check if commit contains workflow_search
  # For now, just move to parent
  candidate="$(git rev-parse "${candidate}^")"
done

if [ $iterations -eq $max_iterations ]; then
  echo "  Walk completed $max_iterations iterations successfully"
fi
EOF
bash /tmp/test_ancestor_walk.sh

Repository: YiAgent/OpenCI

Length of output: 606


🏁 Script executed:

# Create a fresh shallow clone with depth=1 to test the actual failure scenario
temp_dir=$(mktemp -d)
cd "$temp_dir"
git clone --depth=1 https://github.com/YiAgent/OpenCI.git test_repo 2>&1 | head -10
cd test_repo

echo "=== Extreme shallow (depth=1) ==="
echo "is_shallow=$(git rev-parse --is-shallow-repository)"

# Now simulate what bump-self-sha.sh does
remote="origin"
branch="main"
git fetch --quiet "$remote" "$branch" 2>/dev/null
remote_sha="$(git rev-parse "refs/remotes/$remote/$branch")"
echo "remote_sha=$remote_sha"

# Try to access parent (this should fail in depth=1)
if git rev-parse "${remote_sha}^" >/dev/null 2>&1; then
  echo "parent_available=yes"
else
  echo "parent_available=no (THIS IS THE FAILURE CASE)"
fi

cd /
rm -rf "$temp_dir"

Repository: YiAgent/OpenCI

Length of output: 297


Make ancestor walk robust for shallow repositories.

The ancestor walk at lines 58-59 fails in shallow clones when parent commits are unavailable, terminating with "Ran out of history..." even when valid ancestors exist remotely. This is a real problem in CI environments and local shallow clones. Deepen or unshallow the repository before the walk to ensure this script works reliably in all scenarios.

Suggested fix
 info "Fetching $REMOTE/$BASE_BRANCH ..."
-git fetch --quiet "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
-  die "Cannot fetch $REMOTE/$BASE_BRANCH. Check your remote and network access."
+git fetch --quiet "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
+  die "Cannot fetch $REMOTE/$BASE_BRANCH. Check your remote and network access."
+
+# Ensure ancestry walk works in shallow clones.
+if [ "$(git rev-parse --is-shallow-repository 2>/dev/null || echo false)" = "true" ]; then
+  git fetch --quiet --deepen=100 "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
+    git fetch --quiet --unshallow "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
+    die "Repository is shallow and could not be deepened; cannot walk commit ancestry."
+fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
info "Fetching $REMOTE/$BASE_BRANCH ..."
git fetch --quiet "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
die "Cannot fetch $REMOTE/$BASE_BRANCH. Check your remote and network access."
remote_sha="$(git rev-parse "refs/remotes/$REMOTE/$BASE_BRANCH" 2>/dev/null)" || \
die "Could not resolve $REMOTE/$BASE_BRANCH after fetch."
info "Fetching $REMOTE/$BASE_BRANCH ..."
git fetch --quiet "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
die "Cannot fetch $REMOTE/$BASE_BRANCH. Check your remote and network access."
# Ensure ancestry walk works in shallow clones.
if [ "$(git rev-parse --is-shallow-repository 2>/dev/null || echo false)" = "true" ]; then
git fetch --quiet --deepen=100 "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
git fetch --quiet --unshallow "$REMOTE" "$BASE_BRANCH" 2>/dev/null || \
die "Repository is shallow and could not be deepened; cannot walk commit ancestry."
fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@scripts/bump-self-sha.sh` around lines 33 - 39, The ancestor walk can fail in
shallow clones; after resolving remote_sha (variable remote_sha) and before
performing the ancestor walk, detect a shallow repository (presence of
.git/shallow or git rev-parse --is-shallow-repository) and deepen/unshallow the
repo by fetching more history from REMOTE/BASE_BRANCH (use git fetch --unshallow
or git fetch --depth=<n> from REMOTE for BASE_BRANCH) so the subsequent ancestor
traversal succeeds; ensure the fetch call logs errors and falls back cleanly to
die() if the deepen/unshallow fails.

Two additions to prevent the "SHA predates reusable/ directory" class of
failures from ever reaching main:

1. reusable/pr.yml: new verify-sha job (needs: preflight) that runs
   verify-sha-consistency.sh on every PR. The enrich/Stage-2 gate now
   depends on it, so a bad SHA blocks the merge button.

2. on-main-bump-sha.yml: post-merge workflow that fires on every push to
   main. Checks whether the YiAgent/OpenCI SHA in manifest.yml is current
   and structurally valid; if not, runs bump-self-sha.sh and opens an
   auto-PR so the manifest never drifts out of sync without human action.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/reusable/pr.yml:
- Around line 363-369: Replace the unpinned "Install yq" step that downloads
from the `latest` URL with a pinned release approach: introduce or use an
environment variable (e.g., YQ_VERSION) and download the binary for that exact
tag (for example v4.44.1) instead of `latest`, and validate the download
(compare a provided checksum variable like YQ_SHA256 or use a known container
image) before installing; update the step named "Install yq" in this workflow
and apply the same change to the equivalent steps in the other workflows
mentioned (the reusable/ci.yml and on-main-bump-sha.yml occurrences) so all yq
downloads are pinned and verified.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a1ee82eb-233f-4408-b5d4-aa41e996ea47

📥 Commits

Reviewing files that changed from the base of the PR and between c3418e4 and 7439335.

📒 Files selected for processing (2)
  • .github/workflows/on-main-bump-sha.yml
  • .github/workflows/reusable/pr.yml
✅ Files skipped from review due to trivial changes (1)
  • .github/workflows/on-main-bump-sha.yml

Comment on lines +363 to +369
- name: Install yq
run: |
if ! command -v yq >/dev/null 2>&1; then
sudo wget -qO /usr/local/bin/yq \
https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod +x /usr/local/bin/yq
fi

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n --hidden --glob '!.git' '\byq\b|verify-sha-consistency' .github || true
sed -n '1,220p' .github/scripts/verify-sha-consistency.sh

Repository: YiAgent/OpenCI

Length of output: 10860


Pin the yq download to a specific release version.

This gate downloads yq from the latest release URL, introducing an unpinned external dependency in a merge check designed to validate pinned SHAs. This contradicts the purpose of the SHA validation gate and reintroduces a supply-chain risk.

The repo already demonstrates a pinned approach in .github/workflows/on-maintenance.yml (using YQ_VERSION environment variable). Apply the same pattern here: either hardcode a release version (e.g., v4.44.1) or reference an environment variable, and verify the download using a checksum or a container image that provides a known version.

Also apply the same fix to .github/workflows/reusable/ci.yml (line 336) and .github/workflows/on-main-bump-sha.yml (line 37), which have the same unpinned pattern.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/reusable/pr.yml around lines 363 - 369, Replace the
unpinned "Install yq" step that downloads from the `latest` URL with a pinned
release approach: introduce or use an environment variable (e.g., YQ_VERSION)
and download the binary for that exact tag (for example v4.44.1) instead of
`latest`, and validate the download (compare a provided checksum variable like
YQ_SHA256 or use a known container image) before installing; update the step
named "Install yq" in this workflow and apply the same change to the equivalent
steps in the other workflows mentioned (the reusable/ci.yml and
on-main-bump-sha.yml occurrences) so all yq downloads are pinned and verified.

@YiWang24 YiWang24 merged commit be43e4e into main May 4, 2026
3 of 4 checks passed
@sonarqubecloud

sonarqubecloud Bot commented May 4, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant