Skip to content

[MrBot] Enforce c-build-tools GitHub Actions gitlink parity - #470

Open
Parth Aggarwal (parth21999) wants to merge 5 commits into
masterfrom
paaggarwal-microsoft-cuddly-goggles
Open

[MrBot] Enforce c-build-tools GitHub Actions gitlink parity#470
Parth Aggarwal (parth21999) wants to merge 5 commits into
masterfrom
paaggarwal-microsoft-cuddly-goggles

Conversation

@parth21999

@parth21999 Parth Aggarwal (parth21999) commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • Extend c_build_tools_ref so every uses: Azure/c-build-tools/...@<ref> in .github/workflows/ and in composite action.yml/action.yaml files (including hidden directories such as .ci/) must pin the exact SHA of the deps/c-build-tools gitlink (mode 160000) in HEAD.
  • Branches, tags, short SHAs and mismatched SHAs fail. --fix rewrites only the ref text, preserving quotes, comments, line endings and # inside refs such as refs/heads/feature#1.
  • Refs are reported with file and line when there is no matching deps/c-build-tools submodule or gitlink, and fix mode still fails. Repositories with neither refs nor the submodule pass.
  • The existing Azure DevOps resources.repositories ref validation is unchanged. Workflow templates, non-composite action metadata and commented-out lines are ignored.

Minimal-diff revision

  • No new dependencies: Cargo.toml and Cargo.lock match master. uses: lines are scanned line by line, like the existing ADO check.
  • c_build_tools_ref.rs is an additive change (+121/-12); master's ADO logic is untouched apart from sharing the file walk.
  • No update_deps changes; propagating the pin on dependency updates is tracked by the separate EBS task.

Validation

  • Focused CTest validate_c_build_tools_ref_test and validate_c_build_tools_ref_failures_test: 2/2 passed (existing ADO fixtures plus new GitHub clean, detection and fix targets, and the real-git test).
  • test_gitlink_parity.ps1 (real git, no SHA override) passes under PowerShell 7 and Windows PowerShell 5.1. It fails as expected when # is treated as the end of a ref or when the gitlink mode check is removed.
  • The full validator passes every check with the known baseline exclusions.

Rollout note

.github/workflow-templates/two-human-reviewers.caller.yml ships with @master. Consumers that deployed it will need to run validation with fix mode, or pin the SHA, once they pick up this check.

@parth21999
[MrBot] Enforce c-build-tools ref parity
e50af62 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: abfe1ed1-d850-4e1e-b9e8-0a5aa16e4cee
@azure-pipelines

azure-pipelines Bot commented Oct 20, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

/azp run Azure-C-Build-Tools-Gate

@azure-pipelines

azure-pipelines Bot commented Oct 20, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@parth21999
[MrBot] Scope pin parity to executable GitHub Actions
6558ebc 
Require the exact Azure deps/c-build-tools gitlink, leave Azure DevOps resources untouched, and preserve quotes and comments during validation fixes and propagated dependency updates.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 515afe3e-e331-436e-b7c5-1423b037fff3
@parth21999 Parth Aggarwal (parth21999) changed the title [MrBot] Enforce c-build-tools ref parity [MrBot] Enforce c-build-tools GitHub Actions gitlink parity Oct 20, 2026
@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

/azp run Azure-C-Build-Tools-Gate

@azure-pipelines

azure-pipelines Bot commented Oct 20, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

@parth21999
[MrBot] Cover hash refs, hidden actions and PowerShell 5.1
f38e4cb 
Parse YAML comments without truncating valid hash-bearing Git refs, discover composite actions in hidden directories, and run propagation regressions under both PowerShell runtimes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 515afe3e-e331-436e-b7c5-1423b037fff3
@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

/azp run Azure-C-Build-Tools-Gate

@azure-pipelines

azure-pipelines Bot commented Oct 20, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

parth21999
Parth Aggarwal (parth21999) commented Oct 20, 2026
View reviewed changes
Comment thread update_deps/helper_scripts/git_operations.ps1 Outdated
@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

// Licensed under the MIT license. See LICENSE file in the project root for full license information.

why is there so much diff? can this be done in a more stable way? #Closed

Refers to: repo_validation/src_rust/src/checks/c_build_tools_ref.rs:2 in e50af62. [](commit_id = e50af62, deletion_comment = False)

@parth21999
[MrBot] Focus pin validation and use YAML source spans
75defc3 
Remove deprecated propagation changes, retain standalone gitlink regressions, and replace handwritten YAML parsing with structure-aware source-span edits.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 515afe3e-e331-436e-b7c5-1423b037fff3
@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

🤖 MrBot: Addressed #470 (comment) in 75defc3: replaced the handwritten YAML scanner with Saphyr structure-aware parsing and literal source-span edits, reducing the validator from 653 to 340 lines including unit tests. Fixes replace only ref bytes, not serialized YAML, so quotes/comments/Unicode/CRLF remain unchanged; unsafe nonliteral fixes fail explicitly. Restored baseline fixture names and removed all deprecated update_deps changes. Focused CTest 4/4 and standalone real-gitlink coverage under Windows PowerShell 5.1 pass. The unrelated full-validator baseline violations remain untouched and are documented in the refreshed PR body.

@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

/azp run Azure-C-Build-Tools-Gate

@azure-pipelines

azure-pipelines Bot commented Oct 20, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

parth21999
Parth Aggarwal (parth21999) commented Oct 20, 2026
View reviewed changes
Comment thread repo_validation/src_rust/Cargo.lock Outdated
@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

why is there so much diff to this file? is all this needed? Make minimal changes to acheive the goal

Refers to: repo_validation/src_rust/src/checks/c_build_tools_ref.rs:341 in 75defc3. [](commit_id = 75defc3, deletion_comment = False)

@parth21999
[MrBot] Minimize GitHub Actions pin parity change
c45e62a 
Drop the saphyr dependency and keep master's Azure DevOps ref logic unchanged; add line-based uses: pin checks, a gitlink-only SHA lookup for them, and compact tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 515afe3e-e331-436e-b7c5-1423b037fff3
@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

[MrBot] Addressed #470 (comment) in c45e62a. c_build_tools_ref.rs is now an additive change to master (+121/-12, down from +214/-218 plus 134 Cargo.lock lines). master's Azure DevOps ref logic is untouched. The GitHub Actions pin check is one line-scanning helper, a per-file check, and a gitlink-only flag on get_expected_sha. The whole PR is now +319/-12 across 10 files. Focused CTest (2/2) and the real-git test pass.

@parth21999

Parth Aggarwal (parth21999) commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

/azp run Azure-C-Build-Tools-Gate

@azure-pipelines

azure-pipelines Bot commented Oct 20, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anporumb anporumb Awaiting requested review from anporumb

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@parth21999