From 6027b7d774436aeddbfee77e78ed3a1310318a41 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 26 Aug 2026 18:27:31 +0100 Subject: [PATCH] fix: drift detector must skip commented-out uses: lines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The detector matched 'uses: owner/repo@ref' anywhere in a workflow, including inside comments. metadatastician/_pathroot's e2e.yml carries ten commented-out '# - uses: actions/checkout@34e11487...' lines from a disabled job block; the LIVE line already uses @v7.0.1 correctly. So the tool reported drift on dead code. That is the false-positive class that gets a detector ignored, which would be worse than not shipping it. Strips comment lines before matching. Verified both ways: * _pathroot: 1 false positive -> clean * hypatia pre-fix fixture: still finds the real drift (regression held) Found while using the detector in anger on metadatastician-governance#24 — it correctly identified the four dead workflows in _pathroot (ts-blocker, guix-nix-policy, npm-bun-blocker, jekyll-gh-pages) before this false positive surfaced alongside them. Co-Authored-By: Claude Opus 5 --- scripts/check-lockfile-drift.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/check-lockfile-drift.sh b/scripts/check-lockfile-drift.sh index 83c95c6f..67be4bf7 100755 --- a/scripts/check-lockfile-drift.sh +++ b/scripts/check-lockfile-drift.sh @@ -68,7 +68,10 @@ for wf in "$WFDIR"/*.yml "$WFDIR"/*.yaml; do # those legitimately carry a bare `[]` entry and are not drift # * strip sub-action paths: `github/codeql-action/init@v1` is recorded in # the lockfile as `github/codeql-action@v1` - grep -oE "uses:[[:space:]]*[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+@[A-Za-z0-9._-]+" "$wf" 2>/dev/null \ + # Strip comments FIRST. A commented-out `# - uses: foo@sha` is dead code; + # flagging it is a false positive, and a detector that cries wolf is ignored. + sed -E 's/^[[:space:]]*#.*$//' "$wf" 2>/dev/null \ + | grep -oE "uses:[[:space:]]*[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+@[A-Za-z0-9._-]+" 2>/dev/null \ | sed -E 's/uses:[[:space:]]*//' \ | grep -v '/\.github/workflows/' \ | sed -E 's#^([^/]+/[^/@]+)(/[^@]*)?@#\1@#' \