Repository navigation
test: verify v0.2.0 dependency scope on isolated base - #2496
Closed
groupthinking wants to merge 1 commit into
Closed
groupthinking wants to merge 1 commit into
groupthinking wants to merge 1 commit into
Conversation
(cherry picked from commit b358718)
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
✅ E2E Test Results: ALL TESTS PASSED
Test Output |
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
This was referenced Oct 28, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Temporary v0.2.0 scope diagnostic — do not merge
Refs #2490 and draft fix #2492. This draft tests whether the current component-detection action v0.2.0 reports the right scope when the same package version is development in one lockfile and runtime in another. It is a controlled off-main test and must be closed unmerged after recording the result. It does not prove snapshot parity against
main.The temporary base branch at
08243c5fb5db042d2ff5ae0113f752adce796ee0descends from #2492 headbb083e0a05d13bf4e1e1718221703619ad423a96and adds only a push trigger for this diagnostic branch plus its test expectation. That lets the base submit a full-tree snapshot using the draft's v0.2.0 pin. The head at8d8d2c4274306e8359fdf7f6b5513fab96080019changes onlypackage-lock.json: fast-uri 3.1.7 → 3.1.9 in six lockfile lines, preservingdev: trueon both root entries. The docs fetch-MCP lockfile keeps fast-uri 3.1.7 as a runtime dependency.Local validation: 16 focused dependency workflow tests passed on the base; the exact base-to-head diff contains one lockfile and passes
git diff --check.Evidence to inspect
08243c5f; snapshot submission passed.8d8d2c42; snapshot submission, dependency review, evidence recording and artifact upload passed.Warningheader and exactly two entries inpackage-lock.json: fast-uri 3.1.7 removed and 3.1.9 added, bothscope: development, no vulnerabilities, and no unrelated removals. The API response exactly matches the hosted evidence artifact; its SHA-256 matchesreview.json. Both root lockfiles havedev: true; the unchanged docs fetch-MCP lockfile has fast-uri 3.1.7 as runtime.main.The temporary push trigger may make unrelated repository guard checks fail, as in earlier canary #2495. Those failures are diagnostic setup effects and do not establish a dependency verdict. A passing workflow-code check on this draft also cannot establish main-based parity; #2490 remains open.
Result and limit
The v0.2.0 cross-manifest scope test passed on this isolated base/head pair. It resolves the specific v0.1.6 scope mismatch seen in #2495 for this fixture. It does not prove parity when comparing a real dependency PR against current
main, nor does it clear #2490, #2487 or draft #2492 for merge. The independent comparison was read at 2026-10-28 15:16 UTC.