Skip to content

build(ci): align branch-name validator runtime and harden gitleaks checkout - #2502

Open
ashleyshaw with Copilot wants to merge 5 commits into
developfrom
copilot/featagent-testing-v2
Open

build(ci): align branch-name validator runtime and harden gitleaks checkout#2502
ashleyshaw with Copilot wants to merge 5 commits into
developfrom
copilot/featagent-testing-v2

Conversation

CopilotAI commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

Build/CI Pull Request

CI was failing on production-ready changes due to validation/runtime mismatch and checkout behaviour, not feature correctness. This update removes two failure modes that were causing branch-name and gitleaks checks to fail inconsistently.

This PR Template enforces pipelines, linting, changelog, release, and label automation for all PRs and issues.
See the organisation-wide Automation Governance & Release Strategy for required rules.

Linked issues

Build/CI change

  • Branch validation parity (local vs CI)
    • Defined BRANCH_PATTERN in scripts/validation/validate-branch-name.cjs as an alias of the active standard regex.
    • Exported BRANCH_PATTERN so existing consumers/tests relying on that symbol remain stable.
  • Gitleaks checkout hardening
    • Set submodules: false in .github/workflows/gitleaks-reusable.yml checkout step to prevent submodule/gitlink initialisation in fixture-like paths.
  • Net effect
    • Removes a CI-only validator crash path and prevents gitleaks checkout from tripping on unintended gitlink/submodule handling.
// scripts/validation/validate-branch-name.cjsconstBRANCH_PATTERN=BRANCH_PATTERN_STANDARD;
# .github/workflows/gitleaks-reusable.ymlwith:
fetch-depth: ${{ inputs.full-history && '0' || '1' }}persist-credentials: falsesubmodules: false

Baseline & Target

  • Before: valid branch names could fail CI validation due to runtime symbol mismatch; gitleaks could fail with submodule/gitlink initialisation errors.
  • After: validator uses a consistent exported pattern symbol; gitleaks checkout does not initialise submodules, avoiding fixture path submodule failures.

Rollback

  • Plan: revert the single commit touching:
    • /home/runner/work/.github/.github/scripts/validation/validate-branch-name.cjs
    • /home/runner/work/.github/.github/.github/workflows/gitleaks-reusable.yml

Notes

  • No secrets/credential handling changes.
  • No permission scope expansion.

Changelog

Added

Changed

  • Normalised branch-validator runtime symbol usage (BRANCH_PATTERN) to match debug/logging and consumer expectations.
  • Hardened gitleaks reusable workflow checkout config to avoid unintended submodule behaviour.

Fixed

  • CI branch-name validation false failures caused by runtime ReferenceError path in validate-branch-name.cjs.
  • Gitleaks scan failures caused by submodule/gitlink initialisation against fixture directories.

Removed


Checklist (Global DoD / PR)

  • All AC met and demonstrated
  • Tests added/updated (unit/E2E as appropriate)
  • Accessibility checklist completed (where relevant):
    • Semantic HTML and heading order verified
    • Keyboard navigation and visible focus states verified
    • ARIA used only where needed
    • Contrast and non-colour cues reviewed (WCAG 2.1 AA or higher)
  • Docs/readme/changelog updated (if user-facing)
  • Security checklist completed (where relevant):
    • Untrusted input validated and sanitised
    • Output escaped for its rendering context
    • Privileged actions enforce nonce and capability checks
    • No secrets/sensitive data introduced; OWASP risks reviewed
  • Code/design reviews approved
  • CI green; linked issues closed; release notes prepared (if shipping)

CopilotAI changed the title [WIP] Fix CI validation issues with branch namingbuild(ci): align branch-name validator runtime and harden gitleaks checkoutAug 29, 2026
CopilotAI requested a review from ashleyshawAugust 29, 2026 15:35
@ashleyshaw
ashleyshaw requested a lite review from CopilotAugust 29, 2026 16:20

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The changes are small, targeted, and reduce CI flakiness without altering validation outcomes or expanding workflow permissions.

Pull request overview

This PR removes CI-only failure modes by aligning the branch-name validator’s exported runtime symbol with its debug/logging usage, and by hardening the gitleaks reusable workflow checkout configuration to avoid unintended submodule/gitlink initialisation.

Changes:

  • Added and exported BRANCH_PATTERN in validate-branch-name.cjs as an alias for the active standard branch regex.
  • Set submodules: false on the actions/checkout step in the gitleaks reusable workflow to prevent submodule handling during scans.
File summaries
FileDescription
scripts/validation/validate-branch-name.cjsDefines/exports BRANCH_PATTERN to prevent runtime ReferenceError paths and keep consumers stable.
.github/workflows/gitleaks-reusable.ymlDisables submodule checkout to avoid gitleaks failures caused by fixture-like gitlink/submodule behaviour.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

const BRANCH_PATTERN_STANDARD = new RegExp(
`^(${ALLOWED_TYPES.filter(t => t !== 'release').join('|')})/([a-z0-9]+(?:-[a-z0-9]+)*)-([a-z0-9]+(?:-[a-z0-9]+)*)$`
);
const BRANCH_PATTERN = BRANCH_PATTERN_STANDARD;

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the latest commit. printPattern() now documents the standard and release patterns separately — it shows BRANCH_PATTERN_STANDARD (non-release types), then the two release-specific patterns (BRANCH_PATTERN_RELEASE_SEMVER and BRANCH_PATTERN_RELEASE_STANDARD) with their accepted formats. The DEBUG_VALIDATION logging has also been updated to log all three pattern constants and their individual match results, so it's no longer misleading for release branches.

@ashleyshaw
ashleyshaw marked this pull request as ready for review August 29, 2026 16:28
@github-actions

Copy link
Copy Markdown
Contributor

🔍 Reviewer Summary for PR #2502

CI Status:pending
Files changed: 2

Recommendations

  • CI checks not green

1 similar comment
@github-actions

Copy link
Copy Markdown
Contributor

🔍 Reviewer Summary for PR #2502

CI Status:pending
Files changed: 2

Recommendations

  • CI checks not green

@github-actions

github-actionsBot commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

⚠️ PR Governance Issues

❌ Milestone Issue

No milestone assigned. Please select a milestone from the right sidebar.


View PR Governance Check

@github-actions

github-actionsBot commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

🚫 This PR description is missing required template content.

Missing required section(s): Linked issues, Global DoD checklist

Please update the PR body using one of the repository PR templates:

Empty placeholders, unchecked checklist boxes, and stub issue references do not count.

CopilotAIand others added 2 commits August 29, 2026 16:44
…IDATION
Co-authored-by: ashleyshaw <1805352+ashleyshaw@users.noreply.github.com>
Co-authored-by: ashleyshaw <1805352+ashleyshaw@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI Validation Issues: Branch Naming & Gitleaks Discrepancies

3 participants

@ashleyshaw