open/voyage
1
0
Fork 0
Code Issues Releases 13 Activity

fix(verification): the done line and the release check take only full commit ids

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-10-26 13:33:51 +01:00
commit e279f12131
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
4 changed files with 73 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

27
lib/verification/done-line.mjs
View file

@ -12,7 +12,8 @@
//
// `--check --step <N> --report <file> [--commit <sha>]`: exit 0 when the report
// carries a well-formed line for step N (at exactly that commit, with
// --commit), 1 when it does not. /trekexecute writes the line right after the
// --commit), 1 when it does not, 2 when --commit is not a full 40- or 64-hex
// commit id (a short id can also be a branch name; never green). /trekexecute writes the line right after the
// step's checkpoint and checks it with --commit, so the line is bound to the
// commit the test passed on.
//
@ -26,17 +27,26 @@ import { resolve } from 'node:path';
import { DEFAULT_TIMEOUT_MS, allowedCommand, runCommand, screenCommand, stoppedBy } from './criteria-runner.mjs';
import { repoRoot } from './red-proof.mjs';
import { isMain } from '../util/is-main.mjs';
import { FULL_SHA_RE } from '../review/reviewed-commit.mjs';
/**
* A line names a full commit id: 40 hex (SHA-1) or 64 hex (SHA-256), never a
* short one (M11). A `commit` that is not a full id matches nothing; the CLI
* refuses it before it gets here.
*/
export function doneLineRe(step, commit) {
const sha = commit ? String(commit).replace(/[^0-9a-f]/g, '') : '[0-9a-f]{40}';
const sha = commit === undefined || commit === null || commit === ''
? '(?:[0-9a-f]{40}|[0-9a-f]{64})'
: FULL_SHA_RE.test(String(commit)) ? String(commit).toLowerCase() : '(?!)';
return new RegExp(`^DONE step ${step}: \`.+\` exit 0 at ${sha} \\d{4}-\\d{2}-\\d{2}T\\S+$`, 'm');
}
/**
* With `commit` (the step's checkpoint sha, full 40 hex), the line must name
* exactly that commit. A regex cannot tell a typed line from a written one; the
* commit binds the line to the state the test ran on (/trekexecute writes the
* line right after the checkpoint, so HEAD is the step's own commit).
* With `commit` (the step's checkpoint sha, a full 40- or 64-hex id), the line
* must name exactly that commit. A regex cannot tell a typed line from a
* written one; the commit binds the line to the state the test ran on
* (/trekexecute writes the line right after the checkpoint, so HEAD is the
* step's own commit).
*/
export function hasDoneLine(reportPath, step, commit) {
if (!existsSync(reportPath)) return false;
@ -89,6 +99,11 @@ export function main(argv) {
}
if (check) {
if (!/^\d+$/.test(String(o.step ?? '')) || !o.report) { process.stderr.write(`done-line: --check needs --step and --report\n${USAGE}\n`); return 2; }
// A short id can also be a branch name (DJ3): only a full id binds the line.
if (o.commit !== undefined && !FULL_SHA_RE.test(o.commit)) {
process.stderr.write(`done-line: --commit ${o.commit} is not a full commit id (40 or 64 hex)\n${USAGE}\n`);
return 2;
}
const ok = hasDoneLine(o.report, o.step, o.commit);
process.stdout.write(json ? `${JSON.stringify({ step: Number(o.step), done: ok })}\n` : `step ${o.step}: ${ok ? 'DONE line present' : 'no DONE line - not done'}\n`);
return ok ? 0 : 1;