open/repo-standard
1
0
Fork 0
Code Issues Releases 7 Activity

fix(engine): the affirmative TAGS-SIGNED was suppressed by its own exemption OK

Browse source 
Gated on `findings.length === 0`, so a TAG-SIGNED-PREPOLICY OK silenced it —
and every repo in the org has pre-policy tags, which made the affirmative
verdict near-unreachable in practice.

Caught by dogfooding v0.11.0: this repo signed the first tag the check ever
judged, and the gate did not say so. Status was green either way, which is
exactly why it was worth fixing — a reader could not tell "signed its new tag"
from "has cut no tag since the policy". Two different facts wearing one
silence, which is the defect this engine already refuses to ship one check
over, where an exemption nobody can see reads like a check that stopped
running.

Keys the affirmative on the JUDGED findings only. Measured after: 18 repos
emit both codes, 3 NONE, still 0 ERROR / 0 WARN. 243 tests, from 241.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XsPsVsvhrSaejK3cLPmnN2
This commit is contained in:
Kjell Tore Guttormsen 2026-08-13 10:54:35 +02:00
commit f422b63bb3
7 changed files with 63 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/repo-standard-check.mjs
View file

@ -839,11 +839,16 @@ export function checkTagSigned({ tagObjects }, register) {
});
}
if (findings.length === 0 && inScope.length > 0) {
findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` });
}
if (findings.length === 0) {
findings.push({ level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
// The affirmative verdict is gated on the JUDGED findings only, never on
// `findings.length`. Gating on the whole list suppressed it the moment a
// pre-policy OK was present — which is every repo in the org, so this OK was
// near-unreachable in practice, and a reader could not tell "signed its new
// tag" from "has cut no tag since the policy". Two different facts, both green.
const judged = findings.some((f) => f.level === 'ERROR' || f.level === 'WARN');
if (!judged) {
findings.push(inScope.length > 0
? { level: 'OK', code: 'TAGS-SIGNED', msg: `all ${inScope.length} tag(s) cut under the policy (from ${from}) are signed` }
: { level: 'OK', code: 'TAGS-SIGNED', msg: `no tag has been cut since the signing policy took effect (${from}) — nothing to judge yet` });
}
return findings;
}