Uh oh!
There was an error while loading. Please reload this page.
release-train: develop -> staging - #210
Merged
Merged
Conversation
…ide (backend#1681) (#207) * fix(code-quality): make the per-job soft-fail overrides able to override (backend#1681) `action-pins-soft-fail` and `format-soft-fail` were combined with the global `soft-fail` via OR: SOFT_FAIL: ${{ (inputs.soft-fail || inputs.action-pins-soft-fail) && ... }} `soft-fail` defaults to true, so the override could only ever make a job MORE advisory -- never arm one. That is the opposite of its purpose: the input exists so a repo can arm the supply-chain check while the rest of its suite stays advisory during a migration. Measured on origin/develop: 16 of 16 callers pass `action-pins-soft-fail: false`, and docs, model-zoo, start-training and tracebloc-website carry a comment saying "Armed 2026-08-06 (backend#1492) ... Independent of soft-fail above" while passing no `soft-fail` at all -- so action-pins has been advisory in exactly the four repos that believe it is armed. Three of the four are public. Effect (truth table in the PR): the 12 repos that pass both inputs false are unchanged; the 4 above flip from advisory to armed. Verified safe before shipping with a byte-faithful replica of this job's own scanner, mutation-tested to report violations and to skip commented lines: 0 unpinned refs across all 16 repos, so no PR turns red on merge. `format-soft-fail` gets the identical fix and is behaviour-neutral today (no caller passes it; its default is true) -- it removes the same trap before it springs. Verified: YAML parses, actionlint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(code-quality): keep format soft-fail additive (only action-pins is authoritative) Bugbot: format-soft-fail defaults to false, so replacing (soft-fail || format-soft-fail) with the input alone flipped every soft-fail:true caller from an advisory format job to a hard gate. Per this input's contract it is ADDITIVE ('advisory even when soft-fail is false'), unlike action-pins-soft-fail which 16 callers arm explicitly. Revert just the format job to the OR; action-pins keeps the authoritative override that backend#1681 is actually about. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
LukasWodka
commented
Aug 11, 2026
ContributorAuthor
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit ef0dfaf. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-stagingbranch (a mirror ofdevelop), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Medium Risk
Changes CI gating for the org-wide action-pin scan; repos with
action-pins-soft-fail: falsewill start failing on unpinned refs, which is the intended fix but can redden PRs until backlogs are cleared.Overview
Corrects how the reusable code-quality workflow decides whether black and action-pins jobs block the run.
For action-pins,
SOFT_FAILnow follows onlyinputs.action-pins-soft-failinstead of(soft-fail || action-pins-soft-fail). Withsoft-faildefaulting to true, the old OR meant callers settingaction-pins-soft-fail: falsecould never hard-fail unpinned actions; repos that intended an armed supply-chain gate were still advisory (#1681).For format (black), behavior is unchanged:
SOFT_FAILremainssoft-fail || format-soft-failso migration callers with global advisory mode are not turned into a hard format gate. The PR adds inline comments explaining that intentional split between the two inputs.Reviewed by Cursor Bugbot for commit ef0dfaf. Bugbot is set up for automated code reviews on this repo. Configure here.