Skip to content

fix: the audit's token scope was one folded string, so both tokens were empty #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MarketDataApp merged 1 commit into from
Sep 22, 2026
Merged

fix: the audit's token scope was one folded string, so both tokens were empty #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/audit-callers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ jobs:
# code-review-bot is here as well as `api` because BOTH audits
# resolve each caller's pinned ref against this repository's
# .github/workflows/review.yml.
repositories: >-
repositories: |
api
code-review-bot

Expand All @@ -119,7 +119,7 @@ jobs:
app-id: ${{ secrets.CODE_REVIEW_APP_ID }}
private-key: ${{ secrets.CODE_REVIEW_APP_PRIVATE_KEY }}
owner: MarketDataApp
repositories: >-
repositories: |
sdk-py
sdk-go
sdk-js
Expand Down
20 changes: 19 additions & 1 deletion tests/test_callers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -571,11 +571,29 @@
steps = audit_workflow["jobs"]["audit"]["steps"]
tokens = [s for s in steps if "create-github-app-token" in str(s.get("uses", ""))]
assert tokens, "no token steps found"

# SPLIT THE WAY THE ACTION DOES -- on newlines and commas, never on
# spaces. `repositories: >-` folds its lines into one space-joined string,
# which the action reads as a SINGLE repository name; it asked GitHub for
# "MarketData-App/api code-review-bot" and got a 404, leaving both tokens
# empty. Splitting on whitespace here passed for the broken form and the
# correct one alike, so the test has to use the action's own separators.
def as_action_reads_it(value):

Check notice on line 581 in tests/test_callers.py

View check run for this annotation

marketdata-code-review / Code review

Move incident history out of the test 

The new comment records the specific 404 incident and empty-token outcome rather than only the parsing constraint. Keep the separator rationale in the test and leave the incident narrative in the pull request or commit message.
parts = str(value).replace(",", "\n").split("\n")
return {p.strip() for p in parts if p.strip()}

scoped = {
s["with"]["owner"]: set(str(s["with"]["repositories"]).split())
s["with"]["owner"]: as_action_reads_it(s["with"]["repositories"])
for s in tokens
if s["with"].get("repositories")
}
for step in tokens:
value = str(step["with"].get("repositories", ""))
for line in value.replace(",", "\n").split("\n"):
assert " " not in line.strip(), (
f"{step['with']['owner']}: {line.strip()!r} is not one repository name; "
f"`>-` folds the list into a single string"
)
assert len(scoped) == len(tokens), "a token step has no `repositories:` restriction"
env = audit_workflow["env"]
for owner, key in (("MarketData-App", "ORG_REPOS"), ("MarketDataApp", "USER_REPOS")):
Expand Down
Loading