Skip to content

Verify merged bot source against trusted main - #27

Merged
flemming-n-larsen merged 1 commit into
mainfrom
fix/catalog-source-tree-verification
Oct 21, 2026
Merged

flemming-n-larsen merged 1 commit into
mainfrom
fix/catalog-source-tree-verification

Conversation

@flemming-n-larsen

Copy link
Copy Markdown
Contributor

The Publisher App opened catalog PR #26 after test bot PR #22 was merged. Verification checked the merged source PR's merge commit, but GitHub's current API version returned a null merge_commit_sha for that PR. The verifier now compares the source bot directory at the PR head with trusted main, which confirms the merged bot files directly and fails closed if they differ.

Validation: 47 Python tests passed (2 platform skips); git diff --check passed. Live evidence: Publisher App opened PR #26; verification completed but escalated on the null merge SHA. After merge, rerun publication for PR #22.

@tank-royale-rumble-moderator

Copy link
Copy Markdown
Contributor

@flemming-n-larsen Moderation needs your decision for d17d3b6a3383: Non-bot or protected file changed: moderation/verify_catalog.py

The required check stays pending. After reviewing, use /moderation approve <reason> or request changes.

@flemming-n-larsen
flemming-n-larsen merged commit 89ebc9e into main Oct 21, 2026
3 of 4 checks passed
@flemming-n-larsen
flemming-n-larsen deleted the fix/catalog-source-tree-verification branch October 21, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant