Skip to content

CI: wheel-smoke checks stale PR head instead of the tested merge candidate #92

Closed
Closed
CI: wheel-smoke checks stale PR head instead of the tested merge candidate#92

Description

@andy-zen-dev
andy-zen-dev
opened on Oct 24, 2026

Confirmed release-integration CI gap (2026-10-24)

Merged PR #91 introduced an installed-wheel smoke job on release/0.6.0 at 5998723411bd2721971a7385ca2d8c8af8df055f. The job uses:

- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.pull_request.head.sha || github.sha }}
- name: Build and verify the installed wheel outside checkout
  run: python scripts/wheel_smoke.py

This overrides the normal pull_request merge-ref checkout and explicitly checks out the feature branch head. The other Python 3.12–3.14 test jobs use the default checkout, so the wheel job and source-test matrix can validate different source trees.

Concrete existing-stack reproduction from GitHub contents API (no workflow run claimed):

Impact

False or missing wheel-gate evidence for the actual release-integration candidate and an avoidable failure on pre-#91 stacked PR heads. #91's own green hosted run verified its then-current exact head and is valid for that scope, but does not establish that future PRs can pass the merge-candidate consumer gate. This is a CI consistency/release-readiness issue, not a proposed semantic policy change or a claim that Devostasis wheels are currently defective.

Proposed focused repair

Use actions/checkout@v4 without the ref: github.event.pull_request.head.sha || github.sha override in wheel-smoke, so the wheel is built from the same checked-out pull_request test merge commit (github.sha) that the standard jobs assess. For push/workflow_dispatch, retain normal checked-out trigger commit behavior. Optionally record git rev-parse HEAD and github.sha as bounded CI evidence; do not silently substitute an obsolete head. Preserve the existing isolated venv, explicit wheel admission, four negative controls, offline example verification and 10-minute timeout.

Acceptance / verification

  1. CI on a PR whose head lacks scripts/wheel_smoke.py, while the target release branch contains it, successfully executes the installed-wheel job from the PR merge result (or produces a genuine application failure, not a missing-script failure).
  2. The wheel-smoke checkout SHA equals the merge-candidate SHA used for the source matrix for pull_request; both jobs use the trigger commit on push.
  3. A base-side packaging difference relevant to wheel contents is included in the built/tested wheel. The malformed-wheel negative controls still fail closed.
  4. The exact fixing head is verified with hosted Ubuntu/Python 3.12 wheel-smoke plus 3.12–3.14 source checks and an independent later review; absence or action_required is not PASS.
  5. Do not merge directly into master: focused feature PR -> release/0.6.0. No changes to Vitals policy, historical contract, runtime dependencies or publication credentials.

Deduplication: searched existing open/closed Devostasis Issues for wheel, smoke, checkout, pull_request; #84 tracked the original wheel consumer gate and was closed after PR #91, but did not track this follow-on pull-request merge-ref regression. Related: #81, #88–#90, #91, #84.

Evidence limitation: static source/branch inspection and GitHub REST 404 comparisons only. No checkout/test/hosted CI run was executed by this review, and no failing workflow result is asserted.

Activity

  1. andy-zen-dev commented on Oct 24, 2026

    @andy-zen-dev
    andy-zen-dev
    on Oct 24, 2026 – with ChatGPT Codex Connector
    Author

    Prepared exact two-file repair for #92 (no code write is possible with the current repository push=false permission). Anchored to release/0.6.0 blobs: .github/workflows/ci.yml = ddb3739494409b94d5667eb16b73537ff58ad541, docs/wheel-verification.md = 61e33c7bedb7e750a4b559ef203667d51a5e2579.

    diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,5 +21,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Prove tested workflow revision
+        run: |
+          actual="$(git rev-parse HEAD)"
+          echo "checkout=$actual event=$GITHUB_SHA"
+          test "$actual" = "$GITHUB_SHA"
       - uses: actions/setup-python@v5
diff --git a/docs/wheel-verification.md b/docs/wheel-verification.md
--- a/docs/wheel-verification.md
+++ b/docs/wheel-verification.md
@@ -28,3 +28,7 @@
-The separate CI job targets **Ubuntu/Python 3.12** at the exact PR head (or push
-SHA), alongside the existing source-test matrix. Windows can run the same script;
+The separate CI job targets **Ubuntu/Python 3.12** and uses the default checkout:
+for `pull_request` this is the GitHub-generated merge candidate (`github.sha`),
+matching the source-test matrix; for `push` and `workflow_dispatch` it is the
+triggering commit. The job explicitly checks that checkout HEAD equals
+`GITHUB_SHA` before building the installed wheel.
+Windows can run the same script;
 only a recorded successful execution qualifies that version/platform. macOS,

    Verification performed (static, exact source blobs): original forced-ref anchor occurs once; removal leaves zero occurrences; the source-test matrix content is byte-for-byte unchanged; ten-minute job timeout and python scripts/wheel_smoke.py are preserved; the new checkout SHA guard is present. These checks do not establish a GitHub Actions PASS; no checkout, wheel build, pytest or hosted merge-candidate job was run here. A later fresh-head review and genuine PR-triggered hosted runs are required. The documentation correction matters: it currently asserts the job tests the PR head, which would become false after this CI repair.

    Integration order: apply this as a focused feature PR targeting release/0.6.0, independently review it, verify a PR merge-ref checkout on Python 3.12 with the 3.12–3.14 matrix, then re-evaluate #81 → #88 → #89 → #90. Do not merge into master from this issue.

  2. andy-zen-dev commented on Oct 25, 2026

    @andy-zen-dev
    andy-zen-dev
    on Oct 25, 2026 – with ChatGPT Codex Connector
    Author

    2026-10-25 — #92 exact-blob Git patch qualification (no upstream code write)

    Rechecked the release/0.6.0 source through the connected GitHub contents API. I reconstructed both complete source files in a disposable local Git mirror and verified that the original Git blob SHA-1s exactly equal the upstream GitHub blobs:

    • .github/workflows/ci.yml: ddb3739494409b94d5667eb16b73537ff58ad541
    • docs/wheel-verification.md: 61e33c7bedb7e750a4b559ef203667d51a5e2579

    I materialized the previously proposed minimal repair (see comment #6388867273) as a 37-line, ordinary Git unified diff: exactly 2 files, +11/-4. This is an exact-context patch, not merely an illustrative code fragment.

    Actually executed in the disposable full-file mirror: git diff --check PASS; reset to original blobs; git apply --check PASS; git apply PASS; git apply --reverse --check PASS. Eight post-application static assertions passed: head-only checkout override absent, GITHUB_SHA guard present, existing wheel invocation and ten-minute timeout intact, Python 3.12–3.14 source matrix intact, and docs describe PR merge-candidate rather than source-head qualification. Patch SHA-256: feabcdaa8885229dcdac7fafa28d236d6a5b8cdbda81498b40a0b29bbb01b01c.

    Important boundaries: a local mirror of these two verified blobs is not a full Devostasis checkout or an upstream commit; no hosted PR merge-ref checkout, installed-wheel smoke, pytest or GitHub Actions run was performed. The repair is prepared but not integrated: connected andy-zen-dev permissions remain pull=true, push=false, triage=false, maintain=false, admin=false. Do not mark #92 resolved or release 0.6.0 until an authorized contributor applies the patch on a feature branch targeting release/0.6.0, opens a PR, verifies the actual PR merge candidate with green wheel-smoke and Python 3.12–3.14 checks, and obtains an independent later review.

  3. andy-zen-dev commented on Oct 25, 2026

    @andy-zen-dev
    andy-zen-dev
    on Oct 25, 2026 – with ChatGPT Codex Connector
    Author

    2026-10-25 — #92 regression-guard increment (RED/GREEN; not integrated)

    New, bounded contribution: added an implementation-local tests/test_ci_checkout_provenance.py guard to the already-prepared two-file wheel-smoke checkout fix. The new test checks both wheel-smoke and test jobs use the event's default checkout (rather than forcing pull_request.head.sha), checks that the wheel job compares git rev-parse HEAD with GITHUB_SHA, and preserves its 10-minute limit/command plus the Python 3.12–3.14 source matrix. Two negative controls inject the original head-only ref override or remove the checkout-SHA guard and require a test failure. No runtime/Vitals/contract modification.

    Exact base: release/0.6.0 blobs .github/workflows/ci.yml=ddb3739494409b94d5667eb16b73537ff58ad541, docs/wheel-verification.md=61e33c7bedb7e750a4b559ef203667d51a5e2579. Reconstructed complete files locally, checked their Git SHA-1s against GitHub, then qualified a three-file Git patch (+88/-5, including the new 76-line test) against that exact original tree.

    Executed: before applying the change, the new regression module ran with 1 PASS / 2 expected FAIL on the actual old YAML; after applying it, 3/3 PASS. A fresh mirror from the base was used for git apply --check PASS, git apply PASS, git diff --check PASS, reverse-apply check PASS, and 3/3 PASS once again. Patched combined diff SHA-256: b88f0dc0b57a85d71e5c23113d19946568fed1516f3f2ca7f20c6fbc24ad8815. The earlier exact two-file repair is in comment #6388867273; this update adds a repeatable automated regression guard rather than duplicating that fix.

    Limits: execution was on an isolated mirror containing the two exact upstream source files and this test, not a full Devostasis checkout. The tests prove configuration invariants, not GitHub-hosted PR merge-ref semantics or wheel correctness. Full repository pytest, actual installed-wheel smoke, and Python 3.12–3.14 hosted checks on a fixing head are NOT_RUN. GitHub login andy-zen-dev currently has pull=true, push=false, triage=false, maintain=false, admin=false: no commit, branch, PR, merge or release is claimed. Integrate as focused PR to release/0.6.0 and verify the real PR merge candidate, preferably with a head lacking scripts/wheel_smoke.py as the acceptance case. Leave #92 open until green hosted proof and later independent review.

  4. drevendev commented on Oct 25, 2026

    @drevendev
    drevendev
    on Oct 25, 2026 – with ChatGPT Codex Connector
    Owner

    Starting the owner-authorized full cycle for #92 on ci/92-merge-candidate-wheel, from release/0.6.0 at 5998723411bd2721971a7385ca2d8c8af8df055f. Current repository identity/permissions and open PRs rechecked; the prior prepared repair is not integrated. Scope: remove the wheel head-only checkout, prove event SHA in wheel/source jobs, correct verification docs, preserve existing smoke/negative controls and all source checks. I will run local checks, real hosted CI and a separate-agent exact-head review before an expected-SHA merge into release/0.6.0. A task-owned temporary proof PR will exercise a stale head lacking scripts/wheel_smoke.py against the fixed base; it will be closed without merge. No other PRs or releases will be merged/published.

  5. drevendev
    added a commit that references this issue on Oct 25, 2026

    Merge PR #93: verify wheel from the tested merge candidate (#92)

    6d935ee

  6. drevendev commented on Oct 25, 2026

    @drevendev
    drevendev
    on Oct 25, 2026 – with ChatGPT Codex Connector
    Owner

    DONE — #92 implemented and verified via PR #93, merged into release/0.6.0 with expected fixing head 7450dbb9261a07854ddc32f52e5775fa315a0a07. Confirmed merge SHA: 6d935ee111e2efab7a5f7d7c8f8d050af8d35567. Merge tree equals the checked head and PR candidate tree: d1e452749f116b3c7e4141f7d821eddf41c32121.

    Actual verification, 2026-10-25:

    • Fixing PR CI: Ubuntu/Python3.12 installed wheel + Python3.12/3.13/3.14 source jobs all PASS on candidate 489679474463fcf399815d5e590abdb2bc4db2bb, with identical checkout/GITHUB_SHA in all four jobs.
    • Stale-head proof #94, hosted CI: all four jobs PASS on candidate 8aaac6f678628ca978f5d38d70f41738ebe90ca7. Its head lacks scripts/wheel_smoke.py and declares0.1.9; the merge actually built/installed base-supplied wheel0.6.0. All seven offline commands and four corrupt-wheel refusals passed. Proof PR CLOSED WITHOUT MERGE.
    • Merge push CI: all four jobs and every step PASS; checkout/GITHUB_SHA equals merge 6d935ee111e2efab7a5f7d7c8f8d050af8d35567 in all jobs. This verifies push behavior too.
    • Native Windows/Python3.14.7/pytest9.1.1 at fixing head: full2385 tests PASS,0 failures/errors/skips;148 vectors PASS; real isolated-wheel smoke PASS, wheel0.6.0/fresh venv/four malformed-wheel controls; diff clean.
    • Later separate-agent review at exact fixing head: no actionable findings; independently12 wheel tests PASS, matching-SHA guard exit0/mismatched-SHA guard exit1, workflow preservation and live8-job APIs verified. Same host/shared credentials; procedural review, not external approval. Report SHA256:655aab8b2d2672aacdaf6e0ed467e02604c241be57b01f2a7e476a6ee6b3719d.

    Selected local release/0.6.0 fast-forwarded to the merge SHA, clean and equal to origin. Both task-owned temporary worktrees and both local/remote task branches removed after exact SHA/path/cleanliness/inactive-use checks; remote deletion used atomic expected-SHA leases. Fixing commit is retained by merge ancestry; the unmerged probe commit is retained in a verified complete-history recovery bundle.

    All #92 criteria fulfilled. No remaining #92 work. Other PRs/releases were not merged or published; their existing release acceptance remains outside this repair.

  7. drevendev
    closed this as completedon Oct 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions