Repository navigation
test: verify dependency snapshots on clean temporary base - #2495
Closed
groupthinking wants to merge 1 commit into
Closed
groupthinking wants to merge 1 commit into
groupthinking wants to merge 1 commit into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
This was referenced Oct 28, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Result — failed off-main diagnostic, closed unmerged
The temporary base push run 40673726423 completed and submitted a full-tree snapshot for
15ec6562630fd8362a694f2b872946d6063e3040. The draft PR run 40674075576 submitted a head snapshot forb358718206353a5479554cee1bc36c39762672f6and the dependency-review action displayed only the expectedpackage-lock.jsonfast-uri 3.1.7 → 3.1.9 replacement, with no detected moderate-or-higher vulnerability or denied package.The independent compare API still returned “No snapshots were found for the head SHA” more than five minutes after submission. It returned the two expected change records, but the snapshot warning means the result cannot be accepted as complete evidence. The evidence recorder rejected it and uploaded no artifact. The dependency-review check failed.
Hosted checks finished 23 passed, 12 skipped, 5 failed. Three other failures (
test (Python 3.11),test (Python 3.12), andGenerate and Upload Coverage) came from the deliberate temporary push-trigger widening, which violated the repository guard that limits push workflows tomain/develop; this trigger was solely for the diagnostic branch. The issue-closing check failed by design because the canary does not close #2490.This branch-to-branch test does not establish what will happen against
main; whether the non-default base affects snapshot indexing is unverified. The canary is closed without merging. Issue #2490 and draft fix #2492 remain open, and no warning-free real update againstmainhas been proven.Original diagnostic plan
Diagnostic purpose
Refs #2490 and draft fix #2492. Temporary draft test; do not merge. This tests the full-tree dependency submission proposal against a newly created base SHA, separately from the inconsistent
mainsnapshot state.The base branch at
15ec6562630fd8362a694f2b872946d6063e3040contains #2487's evidence recorder, #2492's full-tree scan change, and a temporary push trigger for this base branch. The head atb358718206353a5479554cee1bc36c39762672f6changes onlypackage-lock.json, updating fast-uri 3.1.7 to 3.1.9 with the same three-line lockfile delta as bot PR #2452. The temporary branch trigger and its unit expectation will not be merged intomain.Validation and required readback
This experiment does not establish that the current
maindependency graph is clean; #2490 remains open until a real update againstmainis verified.