ci: guard release version-stamp seds (ast.parse + exact-stamp check) - #236
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Jammy2211
added
the
pending-release
Jammy2211
added a commit
that referenced
this pull request
Aug 18, 2026
The PyAutoHands leg of the tenant-firewall arc (PyAutoMind#198), deferred at the time because PyAutoHands was claimed by the version-stamp task (#235). That merged as #236, so the leg is unblocked. This is the last of the 9 findings. With it, a four-organ `repos_sync.py --check` reports `tenant firewall (organ code): OK`. - tests/test_pre_build_staging.py: derive the five arbitrary repo literals from the already-parsed SPECS, the mechanism the file adopted precisely so its fixtures cannot drift from pre_build.sh. The three tests that already used SPECS[i][0] are untouched — only the hand-written names change. The `pyautobase` fixture root becomes a neutral name; pre_build.sh derives PYAUTOBASE from its own location, so the root is never matched by name. Fixture assert tightened to `len(SPECS) > 1`, which the missing-checkout test now relies on (it removes one repo and asserts against another). - .github/workflows/tests.yml: check Hands out at `path: PyAutoHands` beside a pinned PyAutoMind, move pytest under `working-directory:`, and add the `--only "tenant firewall (organ code)"` gate step — the same shape PyAutoBrain and PyAutoHeart already carry. Every firewall finding to date merged through a green PR because no PR CI ran the check; this closes that hole for Hands. The header's "deliberately ONLY pytest" paragraph is updated rather than left contradicting the new step. Verification: `--only "tenant firewall (organ code)"` against a four-organ root → OK, exit 0. Negative probe: injecting a bogus manifest name into the genericised file is flagged (exit 1) and removing it returns OK, so the check is not weakened. pytest unchanged against pristine main in this container — 302 passed / 4 skipped / 7 failed both before and after, the 7 being an environment gap (ipynb-py-convert has no wheel here), not a regression. Follow-up owed on PyAutoMind: add the PyAutoHands checkout to `firewall_gate.yml`, which deliberately omitted it while Hands main still carried this finding. That must merge after this PR. Claude-Session: https://claude.ai/code/session_013xP1c7XRVQJzxoWAoH92GQ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds loud-failure guards around the two
__version__stamp seds inrelease.yml(the rehearsalBuildjob and the liveStamp version in build treestep):$VERSIONin the live step (the rehearsal job already refused; the live step did not);ast.parseevery*/__init__.pyit touched and require that any file carrying a__version__line carries exactly__version__ = "$VERSION", with at least one stamped file — failing the job with::error::otherwise.The sed pattern
[\."\'0-9]*is unanchored and zero-or-more, so a reshaped assignment (e.g. a futuretry/exceptversion block) would be corrupted into a SyntaxError and could previously ship an unimportable wheel silently — verified empirically. The guard converts that silent failure mode into a loud build failure.Part of #235 (six sibling PRs: five library stamp syncs + this guard).
API Changes
None — internal changes only (CI workflow).
See full details below.
Test Plan
release.ymlstill valid YAML__init__.pys without a stamp are tolerated), fails loudly on a corrupted non-literal assignmentFull API Changes (for automation & release notes)
Changed Behaviour
release.ymlrehearsal Build + live Stamp steps — post-sed parse/exact-stamp verification; live step now refuses empty$VERSIONGenerated by the PyAutoLabs agent workflow.