Repository navigation
fix: the audit's token scope was one folded string, so both tokens were empty - #22
Merged
Merged
Conversation
…re empty
The first real run of the fleet audit failed, and it failed for the whole run
rather than for one repository.
`repositories: >-` is a FOLDED scalar: YAML joins its lines with spaces. The
action splits that input on newlines and commas, never on spaces, so it read
the list as a single repository name and asked GitHub for
"MarketData-App/api code-review-bot". That is a 404, both token steps failed,
and the audit then ran with GITHUB_TOKEN empty:
Failed to create token for "MarketData-App/api code-review-bot": Not Found
reviewbot: error: GITHUB_TOKEN is not set
`|` keeps the newlines, which is what the action expects.
The bug arrived with the `repositories:` scoping and no test caught it,
because the test split the value on WHITESPACE -- which yields the right set
for the broken form and the correct form alike. It now splits the way the
action does, on newlines and commas, and additionally rejects any entry
containing a space. Reverting the workflow to `>-` fails that test.
Caught by the push-to-main trigger added in the same pull request, on its
first run, which is the trigger doing exactly what it was added for.
✅ Ready — Code reviewThis change switches both GitHub App repository lists from folded to literal YAML scalars so the token action receives separate repository names. The regression test now parses the values using the action's separators and rejects folded, space-joined names. Rating patch 5/6 (solid) · proof 5/6 (reproducible) · overall 5/6 FindingsNit
Reviewed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fleet audit's first real run failed, and failed for the whole run rather than one repository.
Cause
repositories: >-is a folded scalar — YAML joins its lines with spaces.create-github-app-tokensplits that input on newlines and commas, never spaces, so it read the whole list as one repository name:Both token steps 404ed, and the audit then ran with an empty token:
|keeps the newlines.Why no test caught it
The bug arrived with the
repositories:scoping and the test passed throughout, because it split the value on whitespace — which yields the correct set for the broken form and the fixed form alike.The test now splits the way the action does (newlines and commas) and rejects any entry containing a space. Reverting the workflow to
>-makes it fail:How it surfaced
The push-to-main trigger, added in #21 for exactly this reason, caught it on the first merge rather than at 07:00 tomorrow.
733 tests pass, ruff clean.