From dd819f22558bafa7b47e6ede17c7c2e8c27da015 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Fri, 13 Nov 2026 03:13:25 -0300 Subject: [PATCH] gate: no commit by a test identity A test in spin wrote git's author into the checkout's config, and every commit after it was the test's, on GitHub. The gate now runs go-tools' testidentity over the branch's commits since origin/main - a reserved-domain address, one with no dot, or one this tree's tests spell - so such a commit stops here. CI's Gate fetches the history it reads. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 3 +++ Taskfile.yml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f075936..c2119bd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,6 +29,9 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + # The gate's testidentity reads the branch's commits since origin/main, which a pull + # request's shallow checkout does not have. + fetch-depth: 0 - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 # No store cache: a package restored from one is never asked of the registry, so Socket # Firewall, which stands between the two, would not see it. diff --git a/Taskfile.yml b/Taskfile.yml index e25bb3c..2b4f129 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -100,11 +100,14 @@ tasks: - gh release upload {{.TAG}} --clobber {{.RELEASE}}/* gate: - desc: What holds the repository's shape - every install through the firewall, and every workflow step a task. + desc: What holds the repository's shape - every install through the firewall, every workflow step a task, and no commit since origin/main by a test's identity. cmds: - sfw check # The Task running this one, which taskgate asks for the task names. - taskgate -task {{.TASK_EXE}} + # A test that writes git's author into the checkout makes every commit after it the + # test's; this refuses those commits before they reach main. + - testidentity -base origin/main ci: desc: What CI's Gate job runs - the gate, the install, lint, typecheck, the unit tests, and the package.