From db6e53c3bde37c4e6a2e845cde23c75e0a14a6f0 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 21 Aug 2026 12:22:15 +0000 Subject: [PATCH] docs(ci): correct the shard-classifier comment to describe the post-#6589 classifier The "Compute this shard's package set" step explained its `git cat-file -e` spelling with three claims about check-shard-attestation.mjs, all of which describe the classifier as it stood BEFORE #6589: - "the job's joined `run:` text" -> classification is `jobInvokes`, applied per STEP; the joined text is built only after a job is already classified a gate, to extract its --leg tokens. - the flag counts "as a bare substring" -> `invokesScript()` tokenises each command and requires the flag to be an exact argument token following the script's own name IN THE SAME COMMAND. - "including in a comment, since comments are part of `run:`" -> the `shellCommands()` lexer drops `#` comments outright. The comment was authored in e4737b6ac2 (#6195); the classifier was rewritten later the same day in 4e271b2c67 (#6589), so it has described a classifier that no longer exists ever since. The step's behaviour is untouched: `git cat-file -e` stays. Only its stated reason changes, because the hazard it cites is now closed by construction. The corrected comment deliberately spells `--verify` literally, which the old comment avoided. That is the load-bearing check: under the pre-#6589 co-occurrence rule this text would reclassify job `test` as an aggregate gate, and `pnpm check:shard-attestation` reports the identical verdict before and after -- "2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s)". Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt --- .github/workflows/ci.yml | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c65b76c856..da3b144937 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -403,19 +403,25 @@ jobs: # the guard for the day that changes, not the normal path. # # `git cat-file -e` rather than the more idiomatic strict - # `git rev-parse` spelling, and the reason is not style. - # check-shard-attestation.mjs classifies a job as an aggregate GATE - # when the job's joined `run:` text contains BOTH the string - # "check-shard-attestation.mjs" and, as a bare substring, that - # script's own dash-dash-verify flag. This job already carries the - # first (its --emit step at the bottom), so spelling that flag - # anywhere in this step — including in a comment, since comments - # are part of `run:` — silently reclassifies the shard job as a - # gate. The drift guard then fails with two complaints that name - # nothing to do with the real edit ("its job-level if: is not - # always()", "never downloads the shard attestations it claims to - # count"). Measured both ways on this very change; do not "tidy" - # this back. + # `git rev-parse --verify` spelling. That is history rather than + # style, and it is written down because it used to be a live + # hazard: the pre-#6589 check-shard-attestation.mjs classified a + # job as an aggregate GATE when the script's basename and its + # `--verify` flag merely CO-OCCURRED as substrings anywhere in + # the job's joined `run:` text. This job always carries the + # basename (its `--emit` step at the bottom), so spelling + # `--verify` anywhere in this step — comments included, since + # they were part of `run:` — silently reclassified the shard job + # as a gate. + # + # #6589 closed that by construction. Classification is now by + # INVOCATION: within one command the flag must follow the + # script's own name as an argument, the test is applied per STEP + # and never over the job's joined text, and the lexer drops shell + # comments — all three pinned by that script's `--self-test`, + # which is why this comment can now name the flag at all. Either + # spelling is safe here; `git cat-file -e` stays because + # churning it would buy nothing. if ! git cat-file -e "refs/remotes/origin/$BASE_REF^{commit}" 2>/dev/null; then git fetch --no-tags --quiet origin "+refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF" \ || echo "::warning::Could not fetch origin/$BASE_REF; the merge-base resolution below will decide."