From 91ea48cdf32c6f41a872bda3edd95663c74fbf7c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 09:37:31 +0000 Subject: [PATCH] ci(lint): run os-regen-merge's --self-test, mirroring the verify-lock step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `scripts/pm/os-regen-merge.sh` ships a 23-case `--self-test` and nothing in `.github/workflows/` ran it. The script itself has no CI path by design — it is run by hand inside a feature branch's worktree, on a merge that exists only there — but its self-test needs only `git` and a temp dir, and two of the 23 cases are source scans of the script's own text (step 2 must keep the non-staging `git restore --source` spelling, never the staging `git checkout` one) that a future refactor would invalidate in silence. One step in the `Lint & Repo Gates` job, mirroring the existing `Verify-lock entry-point self-test` step 1:1. Unconditional and un-`if:`-ed, like every self-test around it. No job names change, so no required context name changes. Co-Authored-By: Claude --- .github/workflows/lint.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 63f4fe9f16..76e2eb3bbb 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1037,6 +1037,40 @@ jobs: - name: PM ci-failure self-test run: node scripts/pm/ci-failure.mjs --self-test + # os-regen-merge self-test (#12893). Mirrors the `Verify-lock entry-point + # self-test` step above 1:1 — same directory, same split between the tool + # and its self-test. `scripts/pm/os-regen-merge.sh` is the mechanized merge + # sequence for a branch touching os-regen-driven generated artifacts, and it + # has NO CI path at all: it is run BY HAND inside a feature branch's + # worktree, on a merge that exists only there. Its header says so, and that + # is deliberate. + # + # The SELF-TEST is a different animal from the script it tests. It needs no + # worktree, no remote and no merge — only `git` and a temp dir — and it + # builds five small fixture repos to pin 23 cases: the PER-FILE merge-side + # selection and its per-path notices, the staged-diff sentence, the + # uncommitted-hand-off refusal, and the four pre-existing refusals. A few + # seconds, no network. + # + # Left unwired it rots the way this repo has already recorded and fixed + # twice (#11514, #6008): the next refactor of the script reds nothing. Two + # of the 23 cases are SOURCE SCANS of the script's own text — they assert + # step 2 keeps the non-staging `git restore --source` spelling and never the + # staging `git checkout` one — which is to say they are precisely the rows a + # future edit invalidates silently and precisely the rows no reviewer reads. + # Nothing but this step is an instrument for them. + # + # Unconditional and un-`if:`-ed, like every self-test around it — an + # exemption is precisely what a self-test must not have, or the gap simply + # moves. One `--self-test` per `run:` block, deliberately: the masking shape + # `check-step-collectors.mjs` guards is a block driving TWO OR MORE distinct + # scripts. A discovery collector over `scripts/pm/*.sh --self-test` — which + # would also catch the next such script arriving unwired — is ruled out of + # this card: two literal steps do not yet justify the machinery, and a third + # is when to revisit it. + - name: os-regen-merge self-test + run: bash scripts/pm/os-regen-merge.sh --self-test + # Claude hook guard self-tests (#11514, objectstack half of # objectstack-ai/objectui#5754). `.claude/hooks/` holds the enforcement # behind the two rules whose violation is most expensive in this repo —