Repository navigation
ci: pin that the repository's own workflow files pass its admission rules - #624
Conversation
The compare endpoint returns every changed file (up to 300) on each request and paginates only the commits, so the admission loop that asked for page 2 got `files: null` and refused any pull request with 100 or more files before a pod was requested. Both the admit job and the hosted result job now make one request to the base...head compare and fail closed when `files` is missing or holds 300 rows, which is GitHub's cap. Row, filename and rename checks are unchanged. The preflight pin requires the new reader and refuses the paging loop, and the tests run the real step text against a fake gh. docs/ci.md replaces the sentence beginning "Admission checks the live PR, then reads the payload-bound compare list with" with one that states the single read and the 300-file refusal. The page keeps its line count. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
…ules Admission refused main's own release.yml (the matrix runner under its fetched path) for every pull request, and no preflight stage ran the admission rules over the real workflow set. A new row copies the real .github workflows, actions and actionlint config into a temporary directory and expects no findings, and a mutation row restores the pre-fix literal-runner comparison in a copy of the checker source and expects exactly the release.yml finding. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
No issues found by static checks — no coupling regressions or blocking issues in the code graph. That is not the same as safe to merge: see what was not checked.
Not checked: tests were not run; formal verification proved 0 of 1 changed function(s) (1 sampled, not proven).
Formal verification. PR-changed functions: 1/1 verified (0 proven, 1 may-equivalent, 0 distinguished) · 0 not verified.
Graphify review — findings
Replaces the paginated compare loops in both gke-pr.yml admission readers with a single unpaginated gh api compare call that fails closed once the response reaches 300 files, since the compare endpoint truncates its file list beyond that. gke_admit_workflow_findings in the preflight now requires the new single-call shape and rejects any workflow that reintroduces while True:, page, per_page=, --paginate, or the old 3000-path cap. The docs describe the one-read, 300-file limit, and the new test helper announce_compare_fixture_paths refuses fixture and interpreter paths by name (any .env-suffixed path component, plus protected home directories) before the compare tests open them, so a legitimate path under a .env-named directory is rejected too.
No blocking issues surfaced. 1 lower-confidence candidate did not survive cross-model review.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 719 functions depend on the 702 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
gke_admit_workflow_findings()— 9 callers, 10 callees - worse:
admit_rule_findings()— 6 callers, 9 callees
Verification — 719 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 719 function(s) in the blast radius were not formally verified this run
Docs that may be stale (advisory)
AGENTS.md§ REQUIRED before claiming any change is done (lines 5-45): references changed symbolsrowsCHANGELOG.md§ Faster run_json report handling (lines 101-130): references changed symbolsreaderCHANGELOG.md§ Costs that remain (lines 917-1127): references changed symbolsrowsCHANGELOG.md§ 1.6.0 — 2026-10-17 (lines 1301-1466): references changed symbolsrowsCHANGELOG.md§ 1.6.0-rc.1 — 2026-10-14 (lines 1467-1583): references changed symbolsrowsREADME.md§ 2. C++, against the kernel (lines 190-223): references changed symbolsrowsREADME.md§ Releases (lines 717-740): references changed symbolsrowsbenchmarks/README.md§ Fairness (lines 236-245): references changed symbolsrowsdocker/README.md§ Backtest fingerprint (lines 556-595): references changed symbolsrowsdocs/adr/0001-kernel-adapter-boundary.md§ How the source-adapter reflects Pine for parity (lines 206-369): references changed symbolsrows
…and 10 more.
Formal verification
No difference found (not proven): No behavior difference found in gke\_admit\_workflow\_findings (not a proof).
The verifier ran both versions of gke\_admit\_workflow\_findings on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.
Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.
Note: An input the sampler did not try could still differ.
· 2 more finding(s) on lines outside this diff (see the check run).
The compare endpoint returns every changed file (up to 300) on each request
and paginates only the commits, so the admission loop that asked for page 2
got
files: nulland refused any pull request with 100 or more files beforea pod was requested. Both the admit job and the hosted result job now make one
request to the base...head compare and fail closed when
filesis missing orholds 300 rows, which is GitHub's cap. Row, filename and rename checks are
unchanged. The preflight pin requires the new reader and refuses the paging
loop, and the tests run the real step text against a fake gh.
docs/ci.md replaces the sentence beginning "Admission checks the live PR, then
reads the payload-bound compare list with" with one that states the single read
and the 300-file refusal. The page keeps its line count.
Admission refused main's own release.yml (the matrix runner under its fetched
path) for every pull request, and no preflight stage ran the admission rules over
the real workflow set. A new row copies the real .github workflows, actions and
actionlint config into a temporary directory and expects no findings, and a
mutation row restores the pre-fix literal-runner comparison in a copy of the
checker source and expects exactly the release.yml finding.
🤖 Generated with Claude Code