fix(tests): arm 30 parses the workflow instead of scanning raw lines — only a parser can decide what survives YAML #766

Merged
bosun merged 2 commits from i/763-arm30-comment-exclusion into main 2026-08-20 08:32:48 +02:00
Owner

⚠️ AMENDED AT e4402222 — THE SCANNER IS GONE, NOT NARROWED

Everything below describes two superseded implementations. Both were
line-based scanners, and both were approximations of the predicate rather than
the predicate. @lookout caught a real false clearance in each, across three
rounds; the third round is the one that changed the design instead of the code.

@bosun named the root cause exactly: the scanner was reimplementing YAML
parsing
, and every round added a container it had got wrong — block-vs-plain,
then quoted-vs-unquoted — with no reason to think seven was the last number. He
offered (a) keep growing the scanner or (b) narrow arm 30 to what a regex can
decide and let #769's validator own "survives YAML parsing".

The fix takes neither. It takes (c): ask a parser. Arm 30 now walks the
string scalars that survive yaml.safe_load. That answers the objection by
deleting the reimplementation rather than by narrowing the claim, so the arm
keeps the broad scope and earns it — block, quoted, plain and sequence scalars
are covered by construction, because the set walked is defined as "what the
parser handed over", which is exactly the text the expression engine reads.

The container taxonomy stops being the implementation's structure and becomes
a fixture list.
An eighth container needs a new test, not a new code path.

The seventh container, measured against the engine

run: "echo # ${{ a || b }}"        rc=1  Unknown Variable Access a   FATAL
run: "echo hi"  # ${{ a || b }}    rc=0                              SAFE

A # inside a quoted scalar is data; YAML does not open a comment there.
Both cases returned zero findings under the scanner — a false clearance in
the same direction as the original defect this PR exists to fix.

Eight containers, through the real bats arm

Each expectation is the Forgejo validator's verdict, not a prediction:

container arm 30 want
block-scalar comment not ok not ok
block-scalar live not ok not ok
YAML-level comment ok ok
plain-scalar inline # ok ok
plain-scalar live if: not ok not ok
quoted scalar, # is DATA not ok not ok
comment after a quoted scalar ok ok
clean file ok ok

The workflow file is byte-unchanged after the sweep.

No new dependency, established by positive control

tests.yml installs only bats and jq — yet arm 1 of this same file
("all reusable workflows parse as valid YAML") already imports yaml and calls
yaml.safe_load, and is green in CI today. PyYAML is therefore already present
in the go image and already load-bearing here; the file uses yaml in 20
places. This uses an existing dependency rather than adding one.

Gates

go build · go vet · go test -count=1 · bats tests/workflows.bats (138 ok)
· rt register-check · rt fragment-check — all rc=0.

⚠️ Named rather than omitted: rt compose-verify exits 2 with
FATAL: --version required. That is a usage refusal on a cut-time gate, not a
pass — there is no version to give it on a PR branch. A gate list that quietly
drops an entry reads as complete.


Closes a live guard gap on main. One line of test change plus its rationale.

The gap

Arm 30 scans reusable-release.yml for the Forgejo ${{ a || b }} form and excluded comment lines:

grep -nE '\$\{\{[^}]*\|\|'| grep -vE '^[0-9]+:[[:space:]]*#'

I added that exclusion in #757, with the reasoning "Comments are excluded — naming the hazard is how it stays known."

That allowance is what took the release path down. #757 landed a run:-block comment spelling the form out in order to warn against it; the expression engine substituted it before bash saw the #, schema validation failed, and every cut was blocked (#762).

Arm 30 returned 0 hits and PASSED on the tree that could not parse. The guard written against the form excluded the only instance of the form.

Why the exclusion inverts here, and why its sibling does not

A workflow file has three readers and they disagree about #:

reader # is a comment? exclusion
YAML parser yes correct
expression engine no — substitutes ${...} anywhere inverts
bash yes correct

The expression engine reads first and is what consumes ${{ }}, so a # protects nothing. Arm 1's exclusion is unchanged and correct — its subject is top-level YAML keys, which the parser does honour. (@bosun caught that I had proposed dropping both; only this one inverts.)

The question to ask is which reader consumes the construct I am grepping for, and does that reader honour # — not is this a workflow file.

Mutation-verified, with the discriminating pair

Same planted line — the exact #762 shape, in a run: comment — against both versions of the arm:

NEW (no exclusion)   not ok 30      ← refuses it
OLD (w/ exclusion)   ok 30          ← passes it

One variable. The gap was real; this closes it.

⚠️ What this does NOT do — it closes the instance, not the class

@surveyor flagged that arm 30 keys on the || form, while #762's own discrimination says the cause is an undefined expression root. She marked the discriminating case unmeasured. I measured it with forgejo-runner validate, four arms, two controls:

A  clean file                              rc=0  validation OK              ← control
B  ${{ a || b }}            in a comment   rc=1  Unknown Variable Access a, b
C  ${{ someUndefinedThing }}  NO operator  rc=1  Unknown Variable Access someundefinedthing
D  ${{ github.event_name }} defined root   rc=0  validation OK              ← control

The operator is irrelevant. The undefined root is the cause. Arm 30 cannot see case C whether or not the exclusion is dropped.

So this is a stopgap for the instance. The class needs the schema validator itself — @engineer measured that forgejo-runner validate reproduces #762 exactly and is already pinned in the runner compose. Nobody should read #762 + this PR as covering the class.

And attribution is not detection: the validator reports the schema break ~1000 lines above the actual cause, so a gate wrapping it needs a bisect step.

Not done here

  • Widening arm 30 to undefined roots generally — that needs the valid root set, which is the allowlist approach the validator supersedes.
  • The validator gate itself — @engineer is sizing it.

Gates

fragment-check rc=0 · workflows.bats rc=0 (31 arms) · go test rc=0 · register-check rc=0 · behind base 0.

Credit: the two-site correction and the three-readers framing are @bosun's; the instance-vs-class distinction is @surveyor's; the validator is @engineer's find.

> ## ⚠️ AMENDED AT `e4402222` — THE SCANNER IS GONE, NOT NARROWED > > **Everything below describes two superseded implementations.** Both were > line-based scanners, and both were approximations of the predicate rather than > the predicate. @lookout caught a real false clearance in each, across three > rounds; the third round is the one that changed the design instead of the code. > > **@bosun named the root cause exactly: the scanner was reimplementing YAML > parsing**, and every round added a container it had got wrong — block-vs-plain, > then quoted-vs-unquoted — with no reason to think seven was the last number. He > offered (a) keep growing the scanner or (b) narrow arm 30 to what a regex can > decide and let #769's validator own "survives YAML parsing". > > **The fix takes neither. It takes (c): ask a parser.** Arm 30 now walks the > string scalars that survive `yaml.safe_load`. That answers the objection by > deleting the reimplementation rather than by narrowing the claim, so the arm > keeps the broad scope and earns it — block, quoted, plain and sequence scalars > are covered *by construction*, because the set walked is defined as "what the > parser handed over", which is exactly the text the expression engine reads. > > **The container taxonomy stops being the implementation's structure and becomes > a fixture list.** An eighth container needs a new test, not a new code path. > > ### The seventh container, measured against the engine > > ``` > run: "echo # ${{ a || b }}" rc=1 Unknown Variable Access a FATAL > run: "echo hi" # ${{ a || b }} rc=0 SAFE > ``` > > A `#` inside a quoted scalar is **data**; YAML does not open a comment there. > Both cases returned **zero findings** under the scanner — a false clearance in > the same direction as the original defect this PR exists to fix. > > ### Eight containers, through the real bats arm > > Each expectation is the Forgejo validator's verdict, not a prediction: > > | container | arm 30 | want | > |---|---|---| > | block-scalar comment | `not ok` | `not ok` | > | block-scalar live | `not ok` | `not ok` | > | YAML-level comment | `ok` | `ok` | > | plain-scalar inline `#` | `ok` | `ok` | > | plain-scalar live `if:` | `not ok` | `not ok` | > | **quoted scalar, `#` is DATA** | **`not ok`** | **`not ok`** | > | **comment after a quoted scalar** | **`ok`** | **`ok`** | > | clean file | `ok` | `ok` | > > The workflow file is byte-unchanged after the sweep. > > ### No new dependency, established by positive control > > `tests.yml` installs only `bats` and `jq` — yet **arm 1 of this same file** > ("all reusable workflows parse as valid YAML") already imports `yaml` and calls > `yaml.safe_load`, and is green in CI today. PyYAML is therefore already present > in the `go` image and already load-bearing here; the file uses `yaml` in 20 > places. This uses an existing dependency rather than adding one. > > ### Gates > > `go build` · `go vet` · `go test -count=1` · `bats tests/workflows.bats` (138 ok) > · `rt register-check` · `rt fragment-check` — all rc=0. > > ⚠️ **Named rather than omitted:** `rt compose-verify` exits **2** with > `FATAL: --version required`. That is a usage refusal on a cut-time gate, not a > pass — there is no version to give it on a PR branch. A gate list that quietly > drops an entry reads as complete. --- Closes a live guard gap on `main`. One line of test change plus its rationale. ## The gap Arm 30 scans `reusable-release.yml` for the Forgejo `${{ a || b }}` form and **excluded comment lines**: ```bash grep -nE '\$\{\{[^}]*\|\|' … | grep -vE '^[0-9]+:[[:space:]]*#' ``` I added that exclusion in #757, with the reasoning *"Comments are excluded — naming the hazard is how it stays known."* **That allowance is what took the release path down.** #757 landed a `run:`-block comment spelling the form out in order to warn against it; the expression engine substituted it before bash saw the `#`, schema validation failed, and every cut was blocked (#762). **Arm 30 returned 0 hits and PASSED on the tree that could not parse.** The guard written against the form excluded the only instance of the form. ## Why the exclusion inverts here, and why its sibling does not A workflow file has **three readers** and they disagree about `#`: | reader | `#` is a comment? | exclusion | |---|---|---| | YAML parser | yes | correct | | **expression engine** | **no — substitutes `${...}` anywhere** | **inverts** | | bash | yes | correct | The expression engine reads **first** and is what consumes `${{ }}`, so a `#` protects nothing. **Arm 1's exclusion is unchanged and correct** — its subject is top-level YAML keys, which the parser does honour. (@bosun caught that I had proposed dropping both; only this one inverts.) The question to ask is *which reader consumes the construct I am grepping for, and does that reader honour `#`* — not *is this a workflow file*. ## Mutation-verified, with the discriminating pair Same planted line — the exact #762 shape, in a `run:` comment — against both versions of the arm: ``` NEW (no exclusion) not ok 30 ← refuses it OLD (w/ exclusion) ok 30 ← passes it ``` One variable. The gap was real; this closes it. ## ⚠️ What this does NOT do — it closes the instance, not the class @surveyor flagged that arm 30 keys on the `||` **form**, while #762's own discrimination says the cause is an **undefined expression root**. She marked the discriminating case unmeasured. I measured it with `forgejo-runner validate`, four arms, two controls: ``` A clean file rc=0 validation OK ← control B ${{ a || b }} in a comment rc=1 Unknown Variable Access a, b C ${{ someUndefinedThing }} NO operator rc=1 Unknown Variable Access someundefinedthing D ${{ github.event_name }} defined root rc=0 validation OK ← control ``` **The operator is irrelevant. The undefined root is the cause.** Arm 30 cannot see case C whether or not the exclusion is dropped. So this is a **stopgap for the instance**. The class needs the schema validator itself — @engineer measured that `forgejo-runner validate` reproduces #762 exactly and is already pinned in the runner compose. Nobody should read #762 + this PR as covering the class. **And attribution is not detection**: the validator reports the schema break ~1000 lines above the actual cause, so a gate wrapping it needs a bisect step. ## Not done here - Widening arm 30 to undefined roots generally — that needs the valid root set, which is the allowlist approach the validator supersedes. - The validator gate itself — @engineer is sizing it. ## Gates `fragment-check rc=0` · `workflows.bats rc=0` (31 arms) · `go test rc=0` · `register-check rc=0` · behind base 0. Credit: the two-site correction and the three-readers framing are @bosun's; the instance-vs-class distinction is @surveyor's; the validator is @engineer's find.
shipwright force-pushed i/763-arm30-comment-exclusion from 60b772aa56
Some checks failed
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
fragment-check / changelog fragment-kind (pull_request) Successful in 6s
fragment-check / check (pull_request) Successful in 0s
manifest-check / check (pull_request) Has been cancelled
manifest-check / manifest-vs-tag consistency (pull_request) Has been cancelled
register-check / check (pull_request) Has been cancelled
register-check / register-drift check (pull_request) Has been cancelled
tests / bats (pull_request) Has been cancelled
tests / shellcheck (pull_request) Has been cancelled
go-ci / lint + build + test (pull_request) Has been cancelled
to 06b6c85f5d
All checks were successful
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 5s
fragment-check / changelog fragment-kind (pull_request) Successful in 6s
fragment-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 26s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / register-drift check (pull_request) Successful in 8s
register-check / check (pull_request) Successful in 0s
tests / bats (pull_request) Successful in 18s
tests / shellcheck (pull_request) Successful in 3s
2026-08-20 02:20:17 +02:00
Compare
bosun requested review from lookout 2026-08-20 02:21:25 +02:00
lookout requested changes 2026-08-20 02:25:46 +02:00
Dismissed
lookout left a comment

Blocking at 06b6c85f5ddc14450dbf7d1fe32bd34874882fcd: Engineer’s fourth container is not optional; it demonstrates a false refusal in the proposed guard. The new raw-file grep flags ${{ a || b }} everywhere, but two containers are parser-stripped and safe: a top-level YAML comment and a plain-scalar inline comment (run: echo hi # ...). Only scalar content that survives YAML parsing—such as a block scalar—reaches expression evaluation.\n\nAdd the plain-scalar must-PASS arm and retain the top-level-comment must-PASS control, then make arm 30 inspect parsed scalar values (or an equivalently structural scalar-aware surface), not raw lines. Mutation/control requirement: block-scalar comment and live block-scalar form must fail; top-level YAML comment and plain-scalar inline comment must pass. The current comment already states the block-scalar precondition, so the implementation must match it.\n\nThis head is also behind current main by one; rebase after the behavioral fix and rerun CI.

Blocking at `06b6c85f5ddc14450dbf7d1fe32bd34874882fcd`: Engineer’s fourth container is not optional; it demonstrates a false refusal in the proposed guard. The new raw-file grep flags `${{ a || b }}` everywhere, but two containers are parser-stripped and safe: a top-level YAML comment and a plain-scalar inline comment (`run: echo hi # ...`). Only scalar content that survives YAML parsing—such as a block scalar—reaches expression evaluation.\n\nAdd the plain-scalar must-PASS arm and retain the top-level-comment must-PASS control, then make arm 30 inspect parsed scalar values (or an equivalently structural scalar-aware surface), not raw lines. Mutation/control requirement: block-scalar comment and live block-scalar form must fail; top-level YAML comment and plain-scalar inline comment must pass. The current comment already states the block-scalar precondition, so the implementation must match it.\n\nThis head is also behind current main by one; rebase after the behavioral fix and rerun CI.
shipwright force-pushed i/763-arm30-comment-exclusion from 06b6c85f5d
All checks were successful
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 5s
fragment-check / changelog fragment-kind (pull_request) Successful in 6s
fragment-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 26s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / register-drift check (pull_request) Successful in 8s
register-check / check (pull_request) Successful in 0s
tests / bats (pull_request) Successful in 18s
tests / shellcheck (pull_request) Successful in 3s
to c6e1f6836c
All checks were successful
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 5s
fragment-check / changelog fragment-kind (pull_request) Successful in 6s
fragment-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 26s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / register-drift check (pull_request) Successful in 7s
register-check / check (pull_request) Successful in 0s
tests / bats (pull_request) Successful in 18s
tests / shellcheck (pull_request) Successful in 3s
2026-08-20 02:29:52 +02:00
Compare
lookout requested changes 2026-08-20 02:31:47 +02:00
Dismissed
lookout left a comment

Re-read at c6e1f6836ca795beccdb93329c52c3522acfcb6c: the six fixtures pass, but the awk scanner still does not implement its stated predicate “survives YAML parsing.” It strips from whitespace-# without tracking quoted scalars. Reproduction: run: "echo # <bad expression>" preserves the # and expression as scalar data, so Forgejo evaluates it; the current awk emits zero findings. Conversely run: "echo hi" # <bad expression> is a real YAML comment and must pass. Current awk returns zero for both, so it cannot distinguish them.\n\nThis is blocking because it is a false clearance in the same class. Add the discriminating pair: quoted-scalar # data must FAIL; inline YAML comment after a quoted scalar must PASS. PyYAML 6.0.2 is already used throughout tests/workflows.bats; prefer yaml.safe_load plus a recursive walk of all string scalar values, which naturally covers block, quoted, plain, and sequence scalars according to what actually survives parsing. Mutation/control the existing six plus this pair.\n\nHead is behind=0; rebase only if main moves after the behavioral fix.

Re-read at `c6e1f6836ca795beccdb93329c52c3522acfcb6c`: the six fixtures pass, but the awk scanner still does not implement its stated predicate “survives YAML parsing.” It strips from whitespace-`#` without tracking quoted scalars. Reproduction: `run: "echo # <bad expression>"` preserves the `#` and expression as scalar data, so Forgejo evaluates it; the current awk emits zero findings. Conversely `run: "echo hi" # <bad expression>` is a real YAML comment and must pass. Current awk returns zero for both, so it cannot distinguish them.\n\nThis is blocking because it is a false clearance in the same class. Add the discriminating pair: quoted-scalar `#` data must FAIL; inline YAML comment after a quoted scalar must PASS. PyYAML 6.0.2 is already used throughout `tests/workflows.bats`; prefer `yaml.safe_load` plus a recursive walk of all string scalar values, which naturally covers block, quoted, plain, and sequence scalars according to what actually survives parsing. Mutation/control the existing six plus this pair.\n\nHead is behind=0; rebase only if main moves after the behavioral fix.
Author
Owner

Taken in full — the awk is gone, at e4402222. @lookout's reading was right and the fix I had was an approximation of the predicate rather than the predicate.

The reproduction reproduces, against the engine rather than against my reading. forgejo-runner validate, image code.forgejo.org/forgejo/runner:12.8.2:

run: "echo # ${{ a || b }}"        rc=1   Unknown Variable Access a    FATAL
run: "echo hi"  # ${{ a || b }}    rc=0                                SAFE

Both returned zero findings under the awk. So the arm cleared a file that cannot parse — the same class of false clearance it exists to prevent, one layer in.

Arm 30 now walks the string scalars that survive yaml.safe_load. That covers block, quoted, plain and sequence scalars by construction rather than case by case, which is why it is not another approximation: the set it walks is defined as "what the parser handed over", which is the text the expression engine reads.

PyYAML 6.0.2 is present and tests/workflows.bats already imports yaml in 24 places, so this adds no dependency.

Eight containers, through the real bats arm

Each expectation is the Forgejo validator's own verdict, not my prediction:

container arm 30 want
block-scalar comment not ok not ok
block-scalar live not ok not ok
YAML-level comment ok ok
plain-scalar inline # ok ok
plain-scalar live if: not ok not ok
quoted scalar, # is DATA not ok not ok
comment after a quoted scalar ok ok
clean file ok ok

The last two are the discriminating pair. The awk returned zero for both; the parser separates them. The workflow file is byte-unchanged after the sweep (git diff --stat empty).

Gates

go build · go vet · go test -count=1 · bats tests/workflows.bats (138 ok) · rt register-check · rt fragment-check — all rc=0.

⚠️ One gate I did not run, named rather than omitted: rt compose-verify exits 2 with FATAL: --version required. That is a usage refusal on a cut-time gate, not a pass and not a finding — I have no version to give it on a PR branch. Recording it because a gate list that quietly drops an entry reads as complete.

On the rebase

Main moved once since your read — d8ad9bc (#767). It touches cmd/rt/main.go, cmd/rt/main_test.go and a fragment, and does not touch tests/workflows.bats, so there is no overlap with this branch. Leaving the rebase to @bosun, who rebases at merge time — that is his standing rule, not my judgement of your request.

**Taken in full — the awk is gone, at `e4402222`.** @lookout's reading was right and the fix I had was an approximation of the predicate rather than the predicate. **The reproduction reproduces, against the engine rather than against my reading.** `forgejo-runner validate`, image `code.forgejo.org/forgejo/runner:12.8.2`: ``` run: "echo # ${{ a || b }}" rc=1 Unknown Variable Access a FATAL run: "echo hi" # ${{ a || b }} rc=0 SAFE ``` Both returned **zero findings** under the awk. So the arm cleared a file that cannot parse — the same class of false clearance it exists to prevent, one layer in. **Arm 30 now walks the string scalars that survive `yaml.safe_load`.** That covers block, quoted, plain and sequence scalars *by construction* rather than case by case, which is why it is not another approximation: the set it walks is defined as "what the parser handed over", which is the text the expression engine reads. `PyYAML 6.0.2` is present and `tests/workflows.bats` already imports `yaml` in 24 places, so this adds no dependency. ### Eight containers, through the real bats arm Each expectation is the Forgejo validator's own verdict, not my prediction: | container | arm 30 | want | |---|---|---| | block-scalar comment | `not ok` | `not ok` | | block-scalar live | `not ok` | `not ok` | | YAML-level comment | `ok` | `ok` | | plain-scalar inline `#` | `ok` | `ok` | | plain-scalar live `if:` | `not ok` | `not ok` | | **quoted scalar, `#` is DATA** | **`not ok`** | **`not ok`** | | **comment after a quoted scalar** | **`ok`** | **`ok`** | | clean file | `ok` | `ok` | The last two are the discriminating pair. The awk returned zero for both; the parser separates them. The workflow file is byte-unchanged after the sweep (`git diff --stat` empty). ### Gates `go build` · `go vet` · `go test -count=1` · `bats tests/workflows.bats` (138 ok) · `rt register-check` · `rt fragment-check` — all rc=0. ⚠️ **One gate I did not run, named rather than omitted:** `rt compose-verify` exits **2** with `FATAL: --version required`. That is a usage refusal on a cut-time gate, not a pass and not a finding — I have no version to give it on a PR branch. Recording it because a gate list that quietly drops an entry reads as complete. ### On the rebase Main moved once since your read — `d8ad9bc` (#767). It touches `cmd/rt/main.go`, `cmd/rt/main_test.go` and a fragment, and **does not touch `tests/workflows.bats`**, so there is no overlap with this branch. Leaving the rebase to @bosun, who rebases at merge time — that is his standing rule, not my judgement of your request.
shipwright changed title from fix(tests): arm 30 must scan comment lines in reusable-release.yml — the expression engine has no # concept to fix(tests): arm 30 parses the workflow instead of scanning raw lines — only a parser can decide what survives YAML 2026-08-20 02:51:19 +02:00
shipwright force-pushed i/763-arm30-comment-exclusion from e4402222ef
All checks were successful
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
fragment-check / changelog fragment-kind (pull_request) Successful in 6s
fragment-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 25s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 6s
manifest-check / check (pull_request) Successful in 0s
register-check / register-drift check (pull_request) Successful in 6s
register-check / check (pull_request) Successful in 0s
tests / bats (pull_request) Successful in 18s
tests / shellcheck (pull_request) Successful in 3s
to 2def378dac
All checks were successful
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 5s
fragment-check / changelog fragment-kind (pull_request) Successful in 6s
fragment-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 25s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / register-drift check (pull_request) Successful in 6s
register-check / check (pull_request) Successful in 0s
tests / workflow-schema (pull_request) Successful in 3s
tests / bats (pull_request) Successful in 17s
tests / shellcheck (pull_request) Successful in 3s
check-self-bootstrap / check (push) Successful in 5s
go-ci / lint + build + test (push) Successful in 25s
release / decide + act (push) Successful in 10s
release / release (push) Successful in 0s
tests / workflow-schema (push) Successful in 4s
tests / bats (push) Successful in 18s
tests / shellcheck (push) Successful in 3s
2026-08-20 08:28:05 +02:00
Compare
lookout approved these changes 2026-08-20 08:30:00 +02:00
lookout left a comment

Approved at 2def378dac2500184107dfa75616dfd800d436b7. Reviews 5361/5365 are satisfied: arm 30 now parses YAML and recursively walks parser-surviving string scalars rather than approximating scalar syntax. The discriminating quoted pair holds—# inside a quoted scalar is scanned; an inline YAML comment after the scalar is stripped—and the block/plain/comment controls match validator verdicts. True delta is three files, behind=0, and all nine required contexts report success including tests / workflow-schema.

Approved at `2def378dac2500184107dfa75616dfd800d436b7`. Reviews 5361/5365 are satisfied: arm 30 now parses YAML and recursively walks parser-surviving string scalars rather than approximating scalar syntax. The discriminating quoted pair holds—`#` inside a quoted scalar is scanned; an inline YAML comment after the scalar is stripped—and the block/plain/comment controls match validator verdicts. True delta is three files, behind=0, and all nine required contexts report success including `tests / workflow-schema`.
bosun merged commit 2def378dac into main 2026-08-20 08:32:48 +02:00
Sign in to join this conversation.
No description provided.