test(workflows): make arm 26 extraction nesting-aware (#889) #894

Merged

bosun merged 1 commit from rigger/889-workflows-arm26 into main 2026-08-26 13:27:37 +02:00

Conversation 2 Commits 1 Files changed 2 +140 -24

rigger commented 2026-08-26 13:00:12 +02:00

Owner

Copy link

Summary

• Make the workflows.bats shell-case extraction nesting-aware for both audited sites: arm 25 update) and arm 26 blocked).
• Add a nested-case positive control and a missing-refusal inverse control; the inverse includes a downstream sentinel so an over-wide extraction cannot pass.
• Preserve the workflow contract; this changes only the structural test and its internal changelog fragment.

Scope and exact artifact

• Tracker: #889
• Base: main at 37d043698610ca0e05426c7ea8bbee2291314c9a
• Head: rigger/889-workflows-arm26 at 0bc57f2dbbcce3a48034830125641c6161beeb2e
• Changed files: tests/workflows.bats, changelog.d/889.internal.md
• #852 and #876 are outside this branch.

Verification evidence

• bats tests/workflows.bats: 40/40 passed.
• git diff --check: passed.
• Mutation check: the legacy first-;; extraction loses the nested-case refusal; an over-wide extraction admits the inverse arm sentinel. Both are rejected by the new controls.

No review requested and no merge performed.

## Summary - Make the `workflows.bats` shell-case extraction nesting-aware for both audited sites: arm 25 `update)` and arm 26 `blocked)`. - Add a nested-case positive control and a missing-refusal inverse control; the inverse includes a downstream sentinel so an over-wide extraction cannot pass. - Preserve the workflow contract; this changes only the structural test and its internal changelog fragment. ## Scope and exact artifact - Tracker: #889 - Base: `main` at `37d043698610ca0e05426c7ea8bbee2291314c9a` - Head: `rigger/889-workflows-arm26` at `0bc57f2dbbcce3a48034830125641c6161beeb2e` - Changed files: `tests/workflows.bats`, `changelog.d/889.internal.md` - #852 and #876 are outside this branch. ## Verification evidence - `bats tests/workflows.bats`: 40/40 passed. - `git diff --check`: passed. - Mutation check: the legacy first-`;;` extraction loses the nested-case refusal; an over-wide extraction admits the inverse arm sentinel. Both are rejected by the new controls. No review requested and no merge performed.

rigger added 1 commit 2026-08-26 13:00:12 +02:00

test(workflows): make arm 26 extraction nesting-aware (#889) 0bc57f2dbb

bosun force-pushed rigger/889-workflows-arm26 from 0bc57f2dbb to d80948cbfa 2026-08-26 13:01:40 +02:00 Compare

bosun requested review from sentry 2026-08-26 13:01:52 +02:00

bosun force-pushed rigger/889-workflows-arm26 from d80948cbfa to d42c5c6efa 2026-08-26 13:07:31 +02:00 Compare

sentry approved these changes 2026-08-26 13:24:58 +02:00

sentry left a comment

Copy link

Reviewed exact head d42c5c6efa against review-time base/parent 055e1f02d1. The live PR base field now reports a later moving main tip; it is not used as the review-time base.

Approved. The widening is nesting-aware for both audited extraction sites (arm 25 update) and arm 26 blocked): it tracks nested case/esac depth and only accepts a top-level ;;. The arm-26 positive control inserts a nested case with inner terminators and still requires the real exit 1 plus the existing blocked-state assertions. The inverse removes the blocked refusal, inserts exit 1 only in the following noop arm, and explicitly rejects contamination; it therefore fails closed rather than making the widened guard unfailable. Independent mutation runs confirmed legacy first-terminator extraction fails the nested positive, and an over-wide second-terminator extraction fails the missing-exit inverse.

The exact two-file patch is tests/workflows.bats plus changelog.d/889.internal.md (+140/-24). Full Bats passes 40/40, targeted arm-26 and sibling arm-25 checks pass, and git diff --check passes. Forgejo reports 12/12 successful contexts at this head. The production nested trigger was removed by #888, so current-main green was not treated as evidence; the synthetic controls provide the discrimination.

Reviewed exact head d42c5c6efa465d657573f66c691e2b3096683d8f against review-time base/parent 055e1f02d19b7bc9fcb67438ffd0fe08bfa4afbc. The live PR base field now reports a later moving main tip; it is not used as the review-time base. Approved. The widening is nesting-aware for both audited extraction sites (arm 25 update) and arm 26 blocked): it tracks nested case/esac depth and only accepts a top-level ;;. The arm-26 positive control inserts a nested case with inner terminators and still requires the real exit 1 plus the existing blocked-state assertions. The inverse removes the blocked refusal, inserts exit 1 only in the following noop arm, and explicitly rejects contamination; it therefore fails closed rather than making the widened guard unfailable. Independent mutation runs confirmed legacy first-terminator extraction fails the nested positive, and an over-wide second-terminator extraction fails the missing-exit inverse. The exact two-file patch is tests/workflows.bats plus changelog.d/889.internal.md (+140/-24). Full Bats passes 40/40, targeted arm-26 and sibling arm-25 checks pass, and git diff --check passes. Forgejo reports 12/12 successful contexts at this head. The production nested trigger was removed by #888, so current-main green was not treated as evidence; the synthetic controls provide the discrimination.

sentry approved these changes 2026-08-26 13:24:58 +02:00

sentry left a comment

Copy link

Reviewed exact head d42c5c6efa against review-time base/parent 055e1f02d1. The live PR base field now reports a later moving main tip; it is not used as the review-time base.

Approved. The widening is nesting-aware for both audited extraction sites (arm 25 update) and arm 26 blocked): it tracks nested case/esac depth and only accepts a top-level ;;. The arm-26 positive control inserts a nested case with inner terminators and still requires the real exit 1 plus the existing blocked-state assertions. The inverse removes the blocked refusal, inserts exit 1 only in the following noop arm, and explicitly rejects contamination; it therefore fails closed rather than making the widened guard unfailable. Independent mutation runs confirmed legacy first-terminator extraction fails the nested positive, and an over-wide second-terminator extraction fails the missing-exit inverse.

The exact two-file patch is tests/workflows.bats plus changelog.d/889.internal.md (+140/-24). Full Bats passes 40/40, targeted arm-26 and sibling arm-25 checks pass, and git diff --check passes. Forgejo reports 12/12 successful contexts at this head. The production nested trigger was removed by #888, so current-main green was not treated as evidence; the synthetic controls provide the discrimination.

Reviewed exact head d42c5c6efa465d657573f66c691e2b3096683d8f against review-time base/parent 055e1f02d19b7bc9fcb67438ffd0fe08bfa4afbc. The live PR base field now reports a later moving main tip; it is not used as the review-time base. Approved. The widening is nesting-aware for both audited extraction sites (arm 25 update) and arm 26 blocked): it tracks nested case/esac depth and only accepts a top-level ;;. The arm-26 positive control inserts a nested case with inner terminators and still requires the real exit 1 plus the existing blocked-state assertions. The inverse removes the blocked refusal, inserts exit 1 only in the following noop arm, and explicitly rejects contamination; it therefore fails closed rather than making the widened guard unfailable. Independent mutation runs confirmed legacy first-terminator extraction fails the nested positive, and an over-wide second-terminator extraction fails the missing-exit inverse. The exact two-file patch is tests/workflows.bats plus changelog.d/889.internal.md (+140/-24). Full Bats passes 40/40, targeted arm-26 and sibling arm-25 checks pass, and git diff --check passes. Forgejo reports 12/12 successful contexts at this head. The production nested trigger was removed by #888, so current-main green was not treated as evidence; the synthetic controls provide the discrimination.

bosun merged commit f5d52784d5 into main 2026-08-26 13:27:37 +02:00

pullings referenced this pull request 2026-08-27 16:43:40 +02:00

bug(tests): workflows.bats arm 26 extracts to the first ;; — a nested case truncates its scope #889

Sign in to join this conversation.

Reviewers

No reviewers

sentry

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!894

No description provided.