From b0fdd079b2d8ebe41a9da436a55f89c1be0dbbbc Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sun, 10 May 2026 22:53:37 +0300
Subject: fix(ci): fail-fast on non-regular docs entries in PR diff
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copilot finding on .github/workflows/ai-validation.yml:86:

  The bundling loop currently *skips* non-regular tree entries
  (symlinks mode 120000, submodules 160000) with a `::warning::` and
  continues. A PR that converts a regular docs/**/*.md into a symlink
  effectively bypasses both Pass 1 (no file copied into _changed_md/)
  and Pass 2 (LLM Read/Glob/Grep sees no content) — reducing
  validation coverage on exactly the kind of change that warrants
  closer review.

Replaced the `continue` with `exit 1` on non-regular mode. The error
message instructs the PR author to convert the file back to a regular
.md (or get explicit maintainer waiver). Maintainers can still land
non-regular doc entries by adjusting the workflow, but the decision
becomes visible rather than silent.

Combined with the symlink-exfil mitigation (commit 1ea164ff): we no
longer copy symlink target content into the artifact AND we no longer
silently skip the change. Either it's a regular file we can validate,
or the workflow fails loudly.

Same change being applied to the canonical reference copy in
VyOS-Networks/vyos-docs-opus-reviewer PR #13.

Suppressed-by-Copilot finding (line 110, id-token: write):
Same pushback as previous rounds. claude-code-action@v1 uses OIDC
internally (verified via this repo's commit b18a399c). Keeping.

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/ai-validation.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/ai-validation.yml b/.github/workflows/ai-validation.yml
index e93dc886..24afad00 100644
--- a/.github/workflows/ai-validation.yml
+++ b/.github/workflows/ai-validation.yml
@@ -76,14 +76,20 @@ jobs:
               echo "::warning::Skipping unsafe path with traversal/absolute prefix: $path"
               continue
             fi
-            # Skip non-regular tree entries (symlinks, submodules) per the
-            # commit immediately preceding this one.
+            # Refuse to bundle non-regular tree entries (symlinks mode 120000,
+            # submodules 160000, etc). Skipping silently would let a PR that
+            # converts a regular docs/**/*.md into a symlink bypass both Pass 1
+            # (no file copied into _changed_md/) and Pass 2 (LLM Read/Glob/Grep
+            # tools see no content) — reducing validation coverage on exactly
+            # the PRs that warrant the closest look. Maintainers must explicitly
+            # decide to land a non-regular doc entry; failing the job here makes
+            # that decision visible.
             mode=$(git ls-tree HEAD -- "$path" | awk '{print $1}')
             case "$mode" in
               100644|100755) ;;
               *)
-                echo "::warning::Skipping non-regular file in PR diff: $path (mode=$mode)"
-                continue
+                echo "::error::Refusing to bundle non-regular tree entry: $path (mode=$mode). docs/**/*.md must be regular files; convert it back or have a maintainer waive this check."
+                exit 1
                 ;;
             esac
             mkdir -p "_changed_md/$(dirname -- "$path")"
-- 
cgit v1.2.3