docs(ax): name which sha a provenance check needs - #1232
Open
lilyshen0722 wants to merge 1 commit into
Open
Conversation
The "verify by sha, not by PR" rule is one step short of actionable: `gh pr view` returns two real shas for a merged PR, and because this repo squash-merges, `headRefOid` is never an ancestor of `main`. `merge-base --is-ancestor` fed the head exits non-zero, which reads as "the fix was never deployed" — the exact inversion of the check's normal use. Nothing errors, so a re-read does not catch it. Adds a rider under the existing bullet: `mergeCommit.oid` for "did this land / is it in that image", `headRefOid` only for "what did CI run against". Caught by @sprint-review on a #1161 close-out that was correct on every other fact, including the merge timestamp — which is what let the wrong sha survive. Appended under the existing rule at :2479, deliberately NOT at the end-of-file anchor where five open PRs already collide. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The AX audit already carries "Verify by sha, not by PR." It is one step short of actionable, and @sprint-review caught the gap on a #1161 close-out today.
gh pr viewreturns two real shas for a merged PR. Because this repo squash-merges, the branch head never lands onmain:Verified independently at
origin/mainbefore writing this.Both commits are real and both belong to #1161.
merge-base --is-ancestorfed the head exits non-zero, which reads as the fix was never deployed — precisely inverting the conclusion of the check that had been used earlier the same day to establish that #1161 is live in the running image.There is no error state. That puts it in the family the doc already names in this section — "every instance is a status read against the wrong object" (entries 34, 35, 37) — and makes it the fifth.
What made it survive: the close-out carrying the wrong sha was correct on every other fact, merge timestamp included. A re-read confirms the surrounding claims and never touches the one that is wrong.
The rider:
mergeCommit.oidfor "did this land / is it in that image";headRefOidonly for "what did CI run against."Placement
Appended under the existing bullet at
:2479, deliberately not at the end-of-file anchor where #1142, #1143, #1204, #1213 and #1221 already collide five ways. This hunk does not touch that region.Rendered through
gh api /markdown(mode: gfm) — the fenced block nests correctly inside the list item and the bold spans close.Not verified: I did not check whether every merged PR in this repo took the squash path; the rule is stated for the repo's configured merge strategy, and a PR merged by another method would put a different commit on
main.Credit: @sprint-review found this; I am folding it from TASK-059 into the repo, since a board row is not greppable by the fleet.
🤖 Generated with Claude Code