diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 22:53:37 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 22:53:37 +0300 |
| commit | b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc (patch) | |
| tree | 7d82bb7ae89442bda3dcacb6373791773b83ce7f | |
| parent | 112f9594594b7081860be0cc86471ae7c7e2a5a4 (diff) | |
| download | vyos-documentation-b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc.tar.gz vyos-documentation-b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc.zip | |
fix(ci): fail-fast on non-regular docs entries in PR diff
Copilot finding on .github/workflows/ai-validation.yml:86:
The bundling loop currently *skips* non-regular tree entries
(symlinks mode 120000, submodules 160000) with a `::warning::` and
continues. A PR that converts a regular docs/**/*.md into a symlink
effectively bypasses both Pass 1 (no file copied into _changed_md/)
and Pass 2 (LLM Read/Glob/Grep sees no content) — reducing
validation coverage on exactly the kind of change that warrants
closer review.
Replaced the `continue` with `exit 1` on non-regular mode. The error
message instructs the PR author to convert the file back to a regular
.md (or get explicit maintainer waiver). Maintainers can still land
non-regular doc entries by adjusting the workflow, but the decision
becomes visible rather than silent.
Combined with the symlink-exfil mitigation (commit 1ea164ff): we no
longer copy symlink target content into the artifact AND we no longer
silently skip the change. Either it's a regular file we can validate,
or the workflow fails loudly.
Same change being applied to the canonical reference copy in
VyOS-Networks/vyos-docs-opus-reviewer PR #13.
Suppressed-by-Copilot finding (line 110, id-token: write):
Same pushback as previous rounds. claude-code-action@v1 uses OIDC
internally (verified via this repo's commit b18a399c). Keeping.
🤖 Generated by [robots](https://vyos.io)
| -rw-r--r-- | .github/workflows/ai-validation.yml | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml index e93dc886..24afad00 100644 --- a/.github/workflows/ai-validation.yml +++ b/.github/workflows/ai-validation.yml @@ -76,14 +76,20 @@ jobs: echo "::warning::Skipping unsafe path with traversal/absolute prefix: $path" continue fi - # Skip non-regular tree entries (symlinks, submodules) per the - # commit immediately preceding this one. + # Refuse to bundle non-regular tree entries (symlinks mode 120000, + # submodules 160000, etc). Skipping silently would let a PR that + # converts a regular docs/**/*.md into a symlink bypass both Pass 1 + # (no file copied into _changed_md/) and Pass 2 (LLM Read/Glob/Grep + # tools see no content) — reducing validation coverage on exactly + # the PRs that warrant the closest look. Maintainers must explicitly + # decide to land a non-regular doc entry; failing the job here makes + # that decision visible. mode=$(git ls-tree HEAD -- "$path" | awk '{print $1}') case "$mode" in 100644|100755) ;; *) - echo "::warning::Skipping non-regular file in PR diff: $path (mode=$mode)" - continue + echo "::error::Refusing to bundle non-regular tree entry: $path (mode=$mode). docs/**/*.md must be regular files; convert it back or have a maintainer waive this check." + exit 1 ;; esac mkdir -p "_changed_md/$(dirname -- "$path")" |