From f9a19122be6033334dedf684f2e9399bb76fc2ee Mon Sep 17 00:00:00 2001
From: tannevaled <tannevaled@users.noreply.github.com>
Date: Sun, 4 Oct 2026 21:22:39 +0200
Subject: [PATCH] ci(native-arch): a lane that cannot check out the commit must
 fail, not report OK

Both remote scripts ended their checkout with

    git fetch --depth 50 origin "$COMMIT" || true
    git checkout -q "$COMMIT" || echo "== commit $COMMIT not reachable; testing default branch HEAD"

Each block opens with `set -euo pipefail`, so those two suffixes were defeating
it deliberately. The consequence is not the message: it is that the job then ran
`go vet` and `go test` against whatever the default branch pointed at, and
finished by printing `== native $GOARCH validation OK` and exiting 0. A lane that
reports success without testing its subject is worse than one that fails,
because nothing downstream can tell the two apart -- and this is the lane that
stands in for four architectures with no other native coverage.

Three ways $COMMIT goes unreachable, none exotic: the clone is `--depth 50`, so
a commit further back is simply absent; a force-push can orphan it; and a
`workflow_dispatch` off a branch passes a SHA the default branch never had.

Now it fetches the SHA, checks it out detached, and asserts `git rev-parse HEAD`
equals $COMMIT before testing, naming both values when it does not. Applied to
both sites identically -- the cfarm job and the s390x job carried the same two
lines, so a fix to one would have left the other reporting on the wrong tree.

Found while auditing the build and CI surface for the security review in #768.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/native-arch.yml | 36 +++++++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/native-arch.yml b/.github/workflows/native-arch.yml
index 630431c0..da54af26 100644
--- a/.github/workflows/native-arch.yml
+++ b/.github/workflows/native-arch.yml
@@ -203,8 +203,22 @@ jobs:
           src="$(mktemp -d)"
           git clone --depth 50 https://github.com/go-embedded-ruby/ruby "$src/ruby"
           cd "$src/ruby"
-          git fetch --depth 50 origin "$COMMIT" || true
-          git checkout -q "$COMMIT" || echo "== commit $COMMIT not reachable; testing default branch HEAD"
+          # Fail closed. These two lines used to end in `|| true` and
+          # `|| echo "... testing default branch HEAD"`, which defeated the
+          # `set -euo pipefail` above on purpose: an unreachable $COMMIT -- a
+          # --depth miss, a force-push, or a workflow_dispatch off a branch --
+          # left the clone on whatever the default branch pointed at, ran the
+          # suite against THAT, and still printed "validation OK" at the end.
+          # A green tick that did not test its subject is worse than a red one,
+          # because nothing downstream can tell the difference.
+          git fetch --depth 1 origin "$COMMIT"
+          git checkout -q --detach "$COMMIT"
+          head="$(git rev-parse HEAD)"
+          if [ "$head" != "$COMMIT" ]; then
+            echo "== HEAD is $head but \$COMMIT is $COMMIT -- refusing to report on the wrong tree"
+            exit 1
+          fi
+          echo "== testing $head"
 
           # ---- native validation --------------------------------------------------
           export GOWORK=off CGO_ENABLED=0
@@ -279,8 +293,22 @@ jobs:
           src="$(mktemp -d)"
           git clone --depth 50 https://github.com/go-embedded-ruby/ruby "$src/ruby"
           cd "$src/ruby"
-          git fetch --depth 50 origin "$COMMIT" || true
-          git checkout -q "$COMMIT" || echo "== commit $COMMIT not reachable; testing default branch HEAD"
+          # Fail closed. These two lines used to end in `|| true` and
+          # `|| echo "... testing default branch HEAD"`, which defeated the
+          # `set -euo pipefail` above on purpose: an unreachable $COMMIT -- a
+          # --depth miss, a force-push, or a workflow_dispatch off a branch --
+          # left the clone on whatever the default branch pointed at, ran the
+          # suite against THAT, and still printed "validation OK" at the end.
+          # A green tick that did not test its subject is worse than a red one,
+          # because nothing downstream can tell the difference.
+          git fetch --depth 1 origin "$COMMIT"
+          git checkout -q --detach "$COMMIT"
+          head="$(git rev-parse HEAD)"
+          if [ "$head" != "$COMMIT" ]; then
+            echo "== HEAD is $head but \$COMMIT is $COMMIT -- refusing to report on the wrong tree"
+            exit 1
+          fi
+          echo "== testing $head"
 
           # ---- native validation --------------------------------------------------
           export GOWORK=off CGO_ENABLED=0