Repository navigation
fix: 拒绝 BUILD_PROMPT 与 release.yml gitlink 漂移 - #450
Open
cursor[bot] wants to merge 2 commits into
Open
cursor[bot] wants to merge 2 commits into
cursor[bot] wants to merge 2 commits into
Conversation
Keep the published dc4433d1 pin. Align the recipe title with 0.3.21 and record the 2026-11-12 issue, security, and dead-code sweep. Co-authored-by: lightjunction.me <lightjunction.me@gmail.com>
审阅者指南实现添加共享的活动 pin 校验器，并确保发布快照和重试与已分派的 gitlink 及经过审阅的可复用工作流 pin 相匹配。
让配方校验调用共享检查，确保过期的 BUILD_PROMPT 源/版本字段或发布工作流 pin 无法通过校验。
配置将两个可复用的发布工作流固定到经过审阅的源提交，并明确发布时允许的源引用行为。
文档更新配方的活动源 pin，并记录候选源的变更及其验证状态。
记录发布必须使用经过审阅的 pin，并更新发布说明和问题分类备注，以反映当前工作流和扫描结果。
测试添加回归测试，覆盖过期或格式错误的活动 pin、历史示例、工作流引用、备用发布源，以及无效或伪造的快照。
锁定文件和 vendored 代码将实现子模块 gitlink 更新到候选源提交。
提示和命令与 Sourcery 互动
自定义使用体验访问你的控制面板，即可：
获取帮助Original review guide in EnglishReviewer's GuideImplementationAdd a shared active-pin validator and enforce that publish snapshots and retries match the dispatched gitlink and reviewed reusable-workflow pins.
Make recipe validation invoke the shared check so stale BUILD_PROMPT source/version fields or release workflow pins fail validation.
ConfigurationPin both reusable release workflows to the reviewed source commit and clarify the allowed source-ref behavior for publish.
DocumentationUpdate the recipe’s active source pin and document the candidate source’s changes and verification status.
Document publish’s reviewed-pin requirement and update release instructions and issue-triage notes to reflect the current workflow and scan findings.
TestsAdd regression coverage for stale or malformed active pins, historical examples, workflow references, alternate publish sources, and invalid or forged snapshots.
Lock files and vendored codeAdvance the implementation submodule gitlink to the candidate source commit.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
你好——我发现了 2 个问题
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="scripts/check-recipes.py" line_range="51" />
<code_context>
raise ValueError("DEPENDENCIES.md does not record the current source gitlink")
if gitlink not in readme:
raise ValueError("README.md does not record the current source gitlink")
+ if gitlink not in prompt:
+ raise ValueError("BUILD_PROMPT.md does not record the current source gitlink")
+ for workflow_name in ("exec.yml", "android-kernelsu-acceptance.yml"):
</code_context>
<issue_to_address>
**Stale pins pass validation**
When a stale active prompt or workflow value coexists with the expected value elsewhere, `verify_live_pins` uses substring checks for the prompt and workflow, so the stale title or active `uses` ref passes and the release gate reports valid pins.
Parse the active prompt version and reusable-workflow `uses` refs, then compare each exact value with the current recipe version or gitlink.
Also at `scripts/check-recipes.py:55-57`, `scripts/check-recipes.py:65-66`.
</issue_to_address>
### Comment 2
<location path="scripts/check-recipes.py" line_range="51-52" />
<code_context>
raise ValueError("DEPENDENCIES.md does not record the current source gitlink")
if gitlink not in readme:
raise ValueError("README.md does not record the current source gitlink")
+ if gitlink not in prompt:
+ raise ValueError("BUILD_PROMPT.md does not record the current source gitlink")
+ for workflow_name in ("exec.yml", "android-kernelsu-acceptance.yml"):
+ pin = f"LIghtJUNction/magicnet-android/.github/workflows/{workflow_name}@{gitlink}"
</code_context>
<issue_to_address>
**Release snapshots bypass pin checks**
When a release selects a `source_ref` different from the checked-in gitlink, the release action checks pins before `prepare` selects `source_ref`; `prepare` then writes the selected SHA into the snapshot gitlink without updating BUILD_PROMPT or `release.yml`. A release using a different source ref therefore produces a recipe snapshot whose documented pins disagree with its gitlink, despite the new gate.
Validate the finalized release snapshot against the pin contract, or prevent alternate-source snapshots unless their associated pin fields can be kept consistent.
Also at `scripts/check-recipes.py:53-58`.
</issue_to_address>Sourcery 评估
待批准。 请先处理 2 项发现。
阻塞性发现：scripts/check-recipes.py:51、scripts/check-recipes.py:52
Original comment in English
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="scripts/check-recipes.py" line_range="51" />
<code_context>
raise ValueError("DEPENDENCIES.md does not record the current source gitlink")
if gitlink not in readme:
raise ValueError("README.md does not record the current source gitlink")
+ if gitlink not in prompt:
+ raise ValueError("BUILD_PROMPT.md does not record the current source gitlink")
+ for workflow_name in ("exec.yml", "android-kernelsu-acceptance.yml"):
</code_context>
<issue_to_address>
**Stale pins pass validation**
When a stale active prompt or workflow value coexists with the expected value elsewhere, `verify_live_pins` uses substring checks for the prompt and workflow, so the stale title or active `uses` ref passes and the release gate reports valid pins.
Parse the active prompt version and reusable-workflow `uses` refs, then compare each exact value with the current recipe version or gitlink.
Also at `scripts/check-recipes.py:55-57`, `scripts/check-recipes.py:65-66`.
</issue_to_address>
### Comment 2
<location path="scripts/check-recipes.py" line_range="51-52" />
<code_context>
raise ValueError("DEPENDENCIES.md does not record the current source gitlink")
if gitlink not in readme:
raise ValueError("README.md does not record the current source gitlink")
+ if gitlink not in prompt:
+ raise ValueError("BUILD_PROMPT.md does not record the current source gitlink")
+ for workflow_name in ("exec.yml", "android-kernelsu-acceptance.yml"):
+ pin = f"LIghtJUNction/magicnet-android/.github/workflows/{workflow_name}@{gitlink}"
</code_context>
<issue_to_address>
**Release snapshots bypass pin checks**
When a release selects a `source_ref` different from the checked-in gitlink, the release action checks pins before `prepare` selects `source_ref`; `prepare` then writes the selected SHA into the snapshot gitlink without updating BUILD_PROMPT or `release.yml`. A release using a different source ref therefore produces a recipe snapshot whose documented pins disagree with its gitlink, despite the new gate.
Validate the finalized release snapshot against the pin contract, or prevent alternate-source snapshots unless their associated pin fields can be kept consistent.
Also at `scripts/check-recipes.py:53-58`.
</issue_to_address>Sourcery assessment
Approval pending. 2 findings to address first.
Blocking findings: scripts/check-recipes.py:51, scripts/check-recipes.py:52
Owner
|
已在 6e7f8ca 更新本 PR。
本地验证：15 项 pin、41 项发布计划、16 项资产回归通过；recipkg check/pack/归档检查/build（8 包、62 Markdown）、actionlint、diff-check 通过。新 head 的完整预览 CI已排队，Android 与浏览器最终结果尚待复验；未合并、未发布。 |
Owner
|
精确 head 两项原 inline finding 已由精确 pin 校验和最终快照/重试校验修复并关闭线程。独立复审再次确认源码诊断白名单及停止身份验证未被弱化。 边界：本次 Android 完整通过不等于此前间歇性 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
摘要
v1.8.7 已把 gitlink、README、DEPENDENCIES 与
release.yml可复用工作流对齐到dc4433d1，但BUILD_PROMPT.md标题仍写配方 0.3.20；昨日 #448 的 live-pin 门禁也未合入且已与 main 冲突。本 PR 在当前已发布固定点上补齐这两处，并记录 2026-11-12 Issue / 安全 / 冗余代码扫描。改动
BUILD_PROMPT.md标题从 0.3.20 改为 0.3.21check-recipes.py拒绝 BUILD_PROMPT gitlink、配方版本或release.yml可复用工作流与当前 gitlink 漂移dc4433d1回退Issue 边界
本环境不能推送
magicnet-android，也不关闭上述 Issue。本地验证
test-check-recipes.py7 passedtest-release.py16 passedtest-release-plan.py37 passedcheck-recipes.py8 packages / 62 Markdown；live pindc4433d1/ v1.8.7 10615check-workflows.shpassedSourcery 摘要
使配方元数据和发布工作流引用与已发布的源代码修订版本保持一致，并在验证检查中强制执行这一一致性。
错误修复：
增强功能：
文档：
测试：
Original summary in English
Sourcery 摘要
在整个验证和发布流程中，确保已发布的源代码修订版本、配方元数据和可复用的发布工作流保持一致。
Bug Fixes:
Enhancements:
Documentation:
Tests:
Original summary in English
Summary by Sourcery
Enforce consistency between the published source revision, recipe metadata, and reusable release workflows throughout validation and publishing.
Bug Fixes:
Enhancements:
Documentation:
Tests: