fix(smoke): audit SELF under the rule matching how the orchestrator is triggered - #1799
Merged
Merged
Conversation
…s triggered The trigger-policy audit unconditionally appended SELF_ID to the PR-definition list, which requires fork hardening AND a pullRequest trigger carrying a collaborator comment gate. That held while the candidate orchestrator was the only one, but the released orchestrator is scheduled-only by design - REGISTERED.md says so explicitly - so it failed its own audit with 'PR trigger policy drift detected for definition 2568' before running a single case. SELF now joins whichever list matches its trigger model: PR_IDS in candidate mode, SCHEDULED_ONLY_IDS in released mode. The comment-gate assertion is likewise PR-only, since there is no PR trigger in released mode to carry one. Keyed off the compile mode rather than off the definition's own triggers. Reading the triggers would be fail-OPEN: a candidate definition that LOST its PR trigger would silently reclassify itself into the weaker scheduled-only rule and pass. Keying off the mode keeps both directions fail-closed. Found by the first live released run (build 629514), which reached the audit and stopped there - the guard working, on the wrong rule. Mutation-checked: pinning SELF_IS_PR_DEFINITION to True fails the new test. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 323b70ff-d193-4c6e-b4c7-9ec6c3dc6ebd
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The trigger-policy audit unconditionally appended \SELF_ID\ to the PR-definition list, which requires fork hardening and a \pullRequest\ trigger with a collaborator comment gate.
That held while the candidate orchestrator was the only one. The released orchestrator (2568) is scheduled-only by design, so it failed its own audit before running a single case:
\
PR trigger policy drift detected for definition 2568 (ado-aw released smoke).
\\
Found by the first live released run (build 629514), which reached the audit and stopped there — the guard working correctly, on the wrong rule.
Fix
\SELF\ now joins whichever list matches its trigger model: \PR_IDS\ in candidate mode, \SCHEDULED_ONLY_IDS\ in released mode. The comment-gate assertion is likewise PR-only.
Keyed off the compile mode, not the definition's own triggers. Reading the triggers would be fail-open: a candidate definition that lost its PR trigger would silently reclassify into the weaker scheduled-only rule and pass. Keying off the mode keeps both directions fail-closed.
Validation
px vitest run src/compiler-smoke-e2e\ green, incl. a new regression test