Uh oh!
There was an error while loading. Please reload this page.
release-train: develop -> staging - #232
Merged
Merged
Conversation
…pipe to head (#228) `jq ... /tmp/gitleaks.json | head -50` builds the gitleaks findings table for the step summary. The step runs `set -uo pipefail`, and Actions launches every `run:` block as `bash -e {0}` — so errexit is ON despite the `set -uo` reading as though it were off. `head` closes the pipe after row 50, jq takes SIGPIPE once the output no longer fits the pipe buffer, pipefail turns that into a pipeline status of 141, and errexit aborts the step mid-summary. The short table is the least of it. The abort happens before the `::error::`/`::warning::` annotations are emitted and before the soft-fail `exit 0`, so a repo configured `soft-fail: true` HARD-fails instead of reporting — and the summary loses the "rotate it first" remediation guidance entirely. Capture the rows into a variable and slice the capture with a here-string, so jq always runs to completion and the exit status is its own. The emit is guarded on a non-empty capture, because `head <<<""` would print one blank line where the pipeline printed nothing. Latent, not live: it needs roughly 700+ findings to fill a 64K pipe buffer, and gitleaks findings normally sit at zero. Measured on darwin it tips from ~250 findings (~24K of rows), nondeterministically right at the boundary because it is a race. Verified against the real step body extracted from this workflow: at 0/1/50/ 51/200 findings old and new produce byte-identical summaries, the same exit code and the same annotation count; at 1000 findings old returns 141 with 0 annotations, new returns 0 with all 1000. actionlint 1.7.12 (the version CI pins) reports zero findings. Refs: backend#1778 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
LukasWodka
commented
Aug 12, 2026
ContributorAuthor
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit d75a1e9. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-stagingbranch (a mirror ofdevelop), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Low Risk
Small CI shell fix to summary formatting only; scan logic and soft-fail contract are unchanged aside from preventing a rare premature abort.
Overview
Fixes a latent soft-fail → hard-fail bug in the gitleaks job summary: piping
jqintohead -50could SIGPIPE underpipefailwhen findings were large enough to fill the pipe buffer, aborting the step before annotations and the soft-failexit 0.The table rows are now fully captured from
jqfirst, then truncated with a here-string (head -50 <<<"$ROWS"), sojqalways completes and soft-fail repos keep reporting instead of failing closed.Reviewed by Cursor Bugbot for commit d75a1e9. Bugbot is set up for automated code reviews on this repo. Configure here.