[tannevaled]

A scheduled lane reported success without testing the commit it was given. Found while auditing the build and CI surface for the security review in #768.

What was there

Both remote scripts in native-arch.yml — the cfarm job and the s390x job, with the same two lines — ended their checkout with:

git fetch --depth 50 origin "$COMMIT" || true
git checkout -q "$COMMIT" || echo "== commit $COMMIT not reachable; testing default branch HEAD"

Each remote block opens with set -euo pipefail (:179, :255), so those two suffixes were defeating it deliberately.

The consequence is not the message. It is what happens next: the job went on to run go vet ./... and go test ./... against whatever the default branch pointed at, then printed

== native $GOARCH validation OK

and exited 0. Nothing downstream can distinguish that from a real pass. This is the lane that stands in for riscv64, loong64, ppc64le and s390x, which have no other native coverage — ci.yml's per-PR arch gate is amd64 + arm64 by design, and the QEMU nightly is emulation. So the one place those four are exercised on real hardware was free to report on the wrong tree.

Three ways $COMMIT goes unreachable, none of them exotic:

• the clone is --depth 50, so a commit further back is simply absent;
• a force-push can orphan it;
• a workflow_dispatch off a branch passes a SHA the default branch never had.

What it is now

git fetch --depth 1 origin "$COMMIT"
git checkout -q --detach "$COMMIT"
head="$(git rev-parse HEAD)"
if [ "$head" != "$COMMIT" ]; then
  echo "== HEAD is $head but \$COMMIT is $COMMIT -- refusing to report on the wrong tree"
  exit 1
fi
echo "== testing $head"

Fetch and checkout are now fatal (the set -e above was always willing to do this), and the assertion is there because the fetch succeeding is not the same as HEAD being right — a checkout can land elsewhere and still exit 0. It names both values on failure, so the log says which tree it refused.

Applied to both sites identically. A fix to one would have left the other reporting on the wrong tree, which is the kind of half-fix this class of defect invites: the two blocks are near-duplicates 75 lines apart.

Not fixed here, deliberately

Two further findings in this same file are left for their own change, because they are different decisions and one of them needs a judgement call about the shared academic hosts:

• the Go toolchain is fetched with curl -fsSL https://go.dev/dl/$tarball and extracted with no SHA256 check before go from it is executed (:196, :272);
• the file documents the cfarm account, node names and the LinuxONE host address in a public repo (:36, :46-49, :137-140, :227-228) — not a credential, but it names the targets.

Verified

native-arch.yml still parses (jobs: guard, native-cfarm, native-s390x; top-level permissions: contents: read unchanged). The lane itself is schedule + workflow_dispatch only, so this change cannot be exercised by this PR's checks — it is reviewed by reading, which is why the diff is deliberately small and the two sites are identical.

🤖 Generated with Claude Code