diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 22:53:37 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-10 22:53:37 +0300 |
| commit | b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc (patch) | |
| tree | 7d82bb7ae89442bda3dcacb6373791773b83ce7f /docs/make.bat | |
| parent | 112f9594594b7081860be0cc86471ae7c7e2a5a4 (diff) | |
| download | vyos-documentation-b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc.tar.gz vyos-documentation-b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc.zip | |
fix(ci): fail-fast on non-regular docs entries in PR diff
Copilot finding on .github/workflows/ai-validation.yml:86:
The bundling loop currently *skips* non-regular tree entries
(symlinks mode 120000, submodules 160000) with a `::warning::` and
continues. A PR that converts a regular docs/**/*.md into a symlink
effectively bypasses both Pass 1 (no file copied into _changed_md/)
and Pass 2 (LLM Read/Glob/Grep sees no content) — reducing
validation coverage on exactly the kind of change that warrants
closer review.
Replaced the `continue` with `exit 1` on non-regular mode. The error
message instructs the PR author to convert the file back to a regular
.md (or get explicit maintainer waiver). Maintainers can still land
non-regular doc entries by adjusting the workflow, but the decision
becomes visible rather than silent.
Combined with the symlink-exfil mitigation (commit 1ea164ff): we no
longer copy symlink target content into the artifact AND we no longer
silently skip the change. Either it's a regular file we can validate,
or the workflow fails loudly.
Same change being applied to the canonical reference copy in
VyOS-Networks/vyos-docs-opus-reviewer PR #13.
Suppressed-by-Copilot finding (line 110, id-token: write):
Same pushback as previous rounds. claude-code-action@v1 uses OIDC
internally (verified via this repo's commit b18a399c). Keeping.
🤖 Generated by [robots](https://vyos.io)
Diffstat (limited to 'docs/make.bat')
0 files changed, 0 insertions, 0 deletions
