fix: spec-author 钉源 ciw_ref 输入（ADR-0043 模式，W0-C4 #133） - #48
Conversation
|
Warning Review limit reached
Next review available in: 1 minute Limit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Comment |
a33ea93 to
39f1c32
Compare
PR Summary by QodoFix spec-author reusable workflow pinning by requiring ciw_ref (ADR-0043)
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
There was a problem hiding this comment.
Pull request overview
Updates spec-author to use a caller-provided, validated ciw_ref SHA for repository checkout.
Changes:
- Adds
ciw_refinputs for reusable and manual runs. - Validates the 40-character SHA fail-closed.
- Checks out the repository at the validated SHA.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # 必须显式拉本仓（CI-Workflows）且 ref=github.action_ref（调用方钉定的 | ||
| # SHA，自引用钉点——被调方永远执行自己被钉定的版本，#143 实测教训） |
Code Review by Qodo
1. ciw_ref 命名不一致
|
| run: | | ||
| [[ "$CIW_REF" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::ciw_ref 缺失或非 40 位 SHA（caller 必须把 uses: pin 的 SHA 同时作为 ciw_ref 传入——ADR-0043 钉源模式）"; exit 1; } |
There was a problem hiding this comment.
1. Sha 大写被拒 🐞 Bug ≡ Correctness
钉源校验只允许 [0-9a-f]{40}，会把合法但包含大写 A-F 的 SHA（或上游工具输出大写）误判为无效并直接失败。结果是调用方即使传入了有效 commit id，也会在校验步骤
fail-closed。
Agent Prompt
### Issue description
The workflow validates `inputs.ciw_ref` with `^[0-9a-f]{40}$`, rejecting uppercase hex digits. Git object IDs are hex strings and may be represented with A–F; rejecting them can cause valid calls to fail.
### Issue Context
This is a fail-closed guard for the ADR-0043 pinning mode. It should validate “40 hex chars” rather than “40 lowercase hex chars”, or normalize to lowercase before validating.
### Fix Focus Areas
- .github/workflows/spec-author.yml[51-60]
### Suggested fix
- Change the regex to accept both cases: `^[0-9a-fA-F]{40}$`, OR
- Normalize `CIW_REF=$(echo "$CIW_REF" | tr '[:upper:]' '[:lower:]')` then validate with lowercase regex.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| # 钉源自证（ADR-0043 同款，check.yml ciw-ref 模式）：必须与 caller 的 uses: pin | ||
| # 同值（40 位 SHA）——空或非 40 位 = fail-closed 红。github.action_ref 在 | ||
| # caller 上下文不可靠（实测解析成 checkout action 的 SHA） | ||
| ciw_ref: { type: string, required: true, default: "" } |
There was a problem hiding this comment.
2. Ciw_ref 命名不一致 🐞 Bug ☼ Reliability
该工作流把输入命名为 ciw_ref，但注释明确引用了 check.yml 的 ciw-ref 模式；调用方若按 ADR/check.yml 习惯传 ciw-ref 将不会映射到 inputs.ciw_ref，导致校验失败并阻断 workflow。
Agent Prompt
### Issue description
The reusable workflow input is named `ciw_ref`, but the repo’s established convention (e.g., `check.yml`) and comments reference `ciw-ref`. Callers that follow the existing pattern may pass `ciw-ref`, which will not populate `inputs.ciw_ref`, causing the new fail-closed guard to trip.
### Issue Context
This workflow is invoked cross-repo (caller/callee). Input name mismatches are a common source of hard-to-debug failures.
### Fix Focus Areas
- .github/workflows/spec-author.yml[14-17]
- .github/workflows/spec-author.yml[51-60]
### Suggested fix
Pick one naming scheme and make it consistent end-to-end:
- Preferred for consistency with existing ADR/check workflow: rename the input key to `ciw-ref` (and update all references to `${{ inputs.ciw-ref }}` and error messages).
- Or keep `ciw_ref`, but update comments to stop mentioning `ciw-ref` and ensure all callers are updated accordingly.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
github.action_ref 在 caller 上下文实测解析错误（指向 checkout action 的 SHA → not our ref）。改用本仓 check.yml 已有的 ciw-ref 钉源模式（ADR-0043/P2-9）：caller 把 uses: pin 的 40 位 SHA 作为 ciw_ref 传入，被调方 fail-closed 校验后按该 SHA checkout 本仓。