From e5d9e2555c1865910f6b5085f70abfd30576c3ba Mon Sep 17 00:00:00 2001 From: pelikhan Date: Tue, 20 Oct 2026 09:57:13 -0700 Subject: [PATCH] fix: align CI assertions and guidance with admission gate Parse activation job conditions from YAML so admission guards and folded formatting preserve the existing regression coverage. Document ERR_ADMISSION within the debug playbook consumption budget. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/aw/debug-playbook.md | 2 +- actions/setup/js/daily_report_portfolio.test.cjs | 8 +++++++- pkg/workflow/task_job_generation_fix_test.go | 16 ++++++++++++++-- 3 files changed, 22 insertions(+), 4 deletions(-) diff --git a/.github/aw/debug-playbook.md b/.github/aw/debug-playbook.md index bb58c6a4ab5..3aa58c8e4eb 100644 --- a/.github/aw/debug-playbook.md +++ b/.github/aw/debug-playbook.md @@ -172,7 +172,7 @@ Registration/nonempty `safeoutputs.jsonl` does not prove publication. | `E006` | Body/string length. | Shorten; retain required content. | | `E008` | URL count/limit. | Reduce links; no concealment. | | `ERR_API`, `E007` | GitHub status; operation guard. | Resolve API/target cause; policy skip != failed mutation. | -| `ERR_CONFIG` | Variable names, handler/tool config, schema. | Fix source/config; recompile; never dump environment. | +| `ERR_CONFIG`, `ERR_ADMISSION` | Config/schema, OIDC permissions, admission decision. | Fix config/service; honor denials/outage policy; recompile; withhold credentials/environment. | | `ERR_NOT_FOUND`, `TARGET_NOT_FOUND` | Target/repository; visibility. | Correct target/access; 404 may conceal inaccessible resources. | | `ERR_PARSE` | JSON/NDJSON framing/schema/producer. | Fix producer/format; retain private evidence. | | `ERR_SYSTEM`, `E099` | First file/git/process failure. | Fix I/O/runtime/checkout; wrapper is not cause. | diff --git a/actions/setup/js/daily_report_portfolio.test.cjs b/actions/setup/js/daily_report_portfolio.test.cjs index 126f0fe7a54..030692439e8 100644 --- a/actions/setup/js/daily_report_portfolio.test.cjs +++ b/actions/setup/js/daily_report_portfolio.test.cjs @@ -7,6 +7,7 @@ import { newState, newRequest, generateRequestOperations, replayTransactions } f import { validatePolicy } from "./work_queue_policy.cjs"; import { frozenResourceScope } from "./work_queue_resource_scope.cjs"; import { validateDeliveryContract } from "./work_queue_delivery.cjs"; +import { parseDocument } from "./work_queue_yaml.cjs"; const repository = "owner/repo"; const settings = JSON.parse(fs.readFileSync(new URL("../../../.github/workflows/aw.json", import.meta.url), "utf8")).work_queue; @@ -172,7 +173,12 @@ describe("bounded daily and weekly discussion-report portfolio", () => { expect(dispatcher).not.toMatch(/^\s+workflow_dispatch:/m); expect(dispatcher).toContain(" max: 3"); const lock = fs.readFileSync(new URL("../../../.github/workflows/daily-report-dispatcher.lock.yml", import.meta.url), "utf8"); - expect(lock).toContain("if: github.run_attempt == 1"); + const document = parseDocument(lock, { version: "1.2", uniqueKeys: true }); + expect(document.errors).toEqual([]); + const activation = document.toJS().jobs.activation; + expect(activation.if).toContain("github.run_attempt == 1"); + expect(activation.if).toContain("needs.admission.result == 'success' || needs.admission.result == 'skipped'"); + expect(activation.needs).toBe("admission"); expect(lock).toContain("daily_report_portfolio.cjs"); for (const profile of REPORT_PROFILES) { const worker = source(profile); diff --git a/pkg/workflow/task_job_generation_fix_test.go b/pkg/workflow/task_job_generation_fix_test.go index 213a00b87b8..331a3ac9ada 100644 --- a/pkg/workflow/task_job_generation_fix_test.go +++ b/pkg/workflow/task_job_generation_fix_test.go @@ -9,6 +9,7 @@ import ( "testing" "github.com/github/gh-aw/pkg/stringutil" + "github.com/goccy/go-yaml" ) // TestTaskJobGenerationFix tests that task job is only generated when required @@ -164,10 +165,21 @@ Do conditional work.` t.Error("Expected activation job for workflow with if condition") } - // Verify activation job has the if condition (without ${{ }} wrapper, as per lock file format) - if !strings.Contains(lockContentStr, "if: github.ref == 'refs/heads/main'") { + var compiled struct { + Jobs map[string]struct { + If string `yaml:"if"` + } `yaml:"jobs"` + } + if err := yaml.Unmarshal(lockContent, &compiled); err != nil { + t.Fatalf("Failed to parse compiled workflow: %v", err) + } + activationCondition := compiled.Jobs["activation"].If + if !strings.Contains(activationCondition, "github.ref == 'refs/heads/main'") { t.Error("Expected activation job to have the if condition") } + if !strings.Contains(activationCondition, admissionJobResultCondition) { + t.Error("Expected activation job to preserve the admission result condition") + } // Verify main job depends on activation if !strings.Contains(lockContentStr, "needs: activation") {