Skip to content

fix(gh-aw): validate isolated bootstrap candidate against the checkout's committed registry - #2121

Closed
bradygaster wants to merge 2 commits into
devfrom
fix/bootstrap-candidate-git-root
Closed

bradygaster wants to merge 2 commits into
devfrom
fix/bootstrap-candidate-git-root

Conversation

@bradygaster

@bradygaster bradygaster commented Oct 1, 2026 •

Copy link
Copy Markdown
Collaborator

What

Fixes a regression from #2120: every squad-bootstrap run fails in Materialize validated Squad bootstrap with registry base: committed HEAD is unavailable (git rev-parse --verify HEAD … not a git repository). No Cast PR or Research Proposals issue is ever published.

Why

#2120 validates the bootstrap output in an isolated mkdtemp candidate copied without .git. squad-cast-validator.mjs committedRegistry(root) runs git rev-parse / ls-tree / show HEAD: in that root, so it can never succeed. This was found in a live trial: octodemo/zava-social-cao-ops-20260929111840#26 (run 36836179263). I rebuilt that run's payload, and it validates once committed HEAD is read from the checkout.

How

  • Thread an optional gitRoot (defaults to root, so existing callers and the CLI are unchanged) through validateBootstrapPayload → validateCastTree → parseRegistry → committedRegistry.
  • The materializer (both workflows/squad-bootstrap.md and the package copy) passes gitRoot: checkout. The candidate stays .git-less and isolated; only the committed-HEAD reads go to the checkout, whose HEAD is the base the candidate was copied from.
  • scripts/validate-gh-aw-cast.mjs kept byte-identical to the shipped resource.
  • npm run gh-aw:integrity:write refreshed the manifest and the embedded validator digests. The pinned squad lock digests in gh-aw-quality.test.ts were updated to match.
  • New regression test: .git-less candidate fails without gitRoot and passes with gitRoot: checkout.

Validation (Windows, gh-aw v0.89.21)

  • npm run gh-aw:integrity:check: current.
  • npx vitest run test/gh-aw: 1692 passed. The same 6 failures occur on unmodified c497c9c on this machine (Windows shell-script fixtures in bootstrap submit and install-staging, plus 2 quality tests). There are no new failures. Please let CI confirm on Linux.
  • eslint clean on the changed tests.

Draft: opened by an agent overnight; please review.

Breaking Changes

None. gitRoot is optional.

bradygaster and others added 2 commits October 1, 2026 02:03
…ating an isolated bootstrap candidate

The materialize step copies the checkout into a .git-less candidate (#2120),
but committedRegistry() ran git rev-parse/ls-tree/show in that candidate, so
every bootstrap failed with 'registry base: committed HEAD is unavailable'.
Thread an optional gitRoot (default root) through validateBootstrapPayload ->
validateCastTree -> parseRegistry, and pass gitRoot: checkout from the
materializer. Adds a regression test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…alidator

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@github-actions

github-actions Bot commented Oct 1, 2026 •

Copy link
Copy Markdown
Contributor

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit ce856b1

PR Scope: 🔧 Infrastructure

⚠️ 4 item(s) to address before review

Status Check Details
❌ Single commit 2 commits — consider squashing before review
❌ Not in draft PR is still in draft — mark as ready for review when done
✅ Branch up to date Up to date with dev
❌ Copilot review No Copilot review yet — it may still be processing
✅ Changeset present No source files changed — changeset not required
✅ Scope clean No .squad/ or docs/proposals/ files
✅ No merge conflicts No merge conflicts
✅ Copilot threads resolved No Copilot review threads
❌ CI passing 8 check(s) failing: sdk-exports-validation, samples-build, Policy Gates, test, docs-quality, Changeset Drift, gh-aw strict compile, Shebang EOL

Files Changed (10 files, +51 −26)

File +/−
scripts/validate-gh-aw-cast.mjs +4 −4
test/gh-aw-bootstrap-workflow.test.ts +22 −0
test/gh-aw-quality.test.ts +3 −3
workflows/package/squad-bootstrap.md +3 −2
workflows/package/squad.md +1 −1
workflows/shared/squad-bootstrap-validator.mjs +2 −1
workflows/shared/squad-cast-validator.mjs +4 −4
workflows/squad-bootstrap.md +3 −2
workflows/squad-workflows.manifest.json +8 −8
workflows/squad.md +1 −1

Total: +51 −26


This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

🟡 Impact Analysis — PR #2121

Risk tier: 🟡 MEDIUM

📊 Summary

Metric Count
Files changed 10
Files added 0
Files modified 10
Files deleted 0
Modules touched 3

🎯 Risk Factors

  • 10 files changed (6-20 → MEDIUM)
  • 3 modules touched (2-4 → MEDIUM)

📦 Modules Affected

root (7 files)
  • workflows/package/squad-bootstrap.md
  • workflows/package/squad.md
  • workflows/shared/squad-bootstrap-validator.mjs
  • workflows/shared/squad-cast-validator.mjs
  • workflows/squad-bootstrap.md
  • workflows/squad-workflows.manifest.json
  • workflows/squad.md
scripts (1 file)
  • scripts/validate-gh-aw-cast.mjs
tests (2 files)
  • test/gh-aw-bootstrap-workflow.test.ts
  • test/gh-aw-quality.test.ts

This report is generated automatically for every PR. See #733 for details.

@bradygaster

Copy link
Copy Markdown
Collaborator Author

Superseded by #2122, which merged the committed-registry gitRoot fix and equivalent isolated-candidate regression coverage. The remaining branch changes duplicate that coverage, so this draft will not be merged.

@bradygaster bradygaster closed this Oct 1, 2026
@bradygaster
bradygaster deleted the fix/bootstrap-candidate-git-root branch October 3, 2026 00:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant