diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 08:58:49 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-11 08:58:49 +0300 |
| commit | b09ea6733a3462b13e98369411ff10cd0101fc15 (patch) | |
| tree | 44b414a02df1293c893b36ceac68b84c0370fa36 /.github/workflows | |
| parent | 30e34f5b4fcd4bb3596922b1a878ed3302473a81 (diff) | |
| download | vyos-documentation-b09ea6733a3462b13e98369411ff10cd0101fc15.tar.gz vyos-documentation-b09ea6733a3462b13e98369411ff10cd0101fc15.zip | |
ci(ai-validation): clarify where schema-mismatch protection lives (Copilot)
Copilot finding on this PR: the previous comment block claimed the
workflow's fail-closed gate catches DB schema incompatibilities, but
that gate is purely a presence check (`-d .reference-db/extracted`)
— it does not load or validate the DB. The actual schema-mismatch
protection lives inside the pinned reviewer Python code (loaded via
`uv pip install ./reviewer-src` from `env.REVIEWER_REF`): newer
reviewer code would error at DB-load time inside the `Pass 1 —
deterministic checks` step.
Reword the rationale so it correctly attributes the protection to
where it actually executes. Comment-only change; no behavior delta.
Will sync the same wording to rolling/circinus/canonical in a small
follow-up batch once this PR merges.
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/ai-validation.yml | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml index c19f7737..b3d7c4e7 100644 --- a/.github/workflows/ai-validation.yml +++ b/.github/workflows/ai-validation.yml @@ -331,8 +331,11 @@ jobs: # DB assets). The reference DB schema is intentionally backwards # compatible across reviewer Python releases; the freshest DB is # the right choice. If the DB schema ever changes incompatibly, - # bump REVIEWER_REF in the consuming workflow and the new code - # will refuse to load an older-format DB at the fail-closed gate. + # bump REVIEWER_REF in the consuming workflow — the newer + # reviewer code will error at DB-load time inside `Pass 1 — + # deterministic checks`. The workflow's own fail-closed gate is + # a presence check (`[ -s diff-md.patch ] && [ ! -d + # .reference-db/extracted ]`); it does not inspect DB schema. latest: true fileName: reference-db-${{ steps.branch.outputs.vyos1x }}.tar.gz out-file-path: .reference-db |