Fail activation on stale provenance workflows · github/gh-aw@2c3ec8a · GitHub
Skip to content

Commit 2c3ec8a

Browse files
Copilotpelikhan
Copilot
and
pelikhan
authored
Fail activation on stale provenance workflows
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
1 parent 0b659e5 commit 2c3ec8a

4 files changed

Lines changed: 58 additions & 13 deletions

File tree

‎.changeset/patch-check-run-provenance-compatibility.md‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎actions/setup/js/check_version_updates.cjs‎

Lines changed: 12 additions & 0 deletions

‎actions/setup/js/check_version_updates.test.cjs‎

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,32 @@ describe("check_version_updates", () => {
169169
expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Could not fetch update configuration"));
170170
});
171171

172+
it("should reject workflows older than the provenance requirement before fetching remote config", async () => {
173+
process.env.GH_AW_COMPILED_VERSION = "v0.88.7";
174+
mockFetchError(new Error("ECONNREFUSED"));
175+
await runMain();
176+
expect(mockFetch).not.toHaveBeenCalled();
177+
expect(mockCore.setFailed).toHaveBeenCalledWith(expect.stringContaining("v0.91.10 or newer"));
178+
expect(mockCore.summary.addRaw).toHaveBeenCalledWith(expect.stringContaining("run `gh aw compile`"));
179+
expect(mockCore.summary.write).toHaveBeenCalled();
180+
});
181+
182+
it("should accept the first compiler version that supplies safe-output provenance", async () => {
183+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
184+
mockFetchSuccess(JSON.stringify({}));
185+
await runMain();
186+
expect(mockCore.setFailed).not.toHaveBeenCalled();
187+
expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Version check passed"));
188+
});
189+
190+
it("should accept a provenance-compatible workflow when remote config is unavailable", async () => {
191+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
192+
mockFetchError(new Error("ECONNREFUSED"));
193+
await runMain();
194+
expect(mockCore.setFailed).not.toHaveBeenCalled();
195+
expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Could not fetch update configuration"));
196+
});
197+
172198
it("should retry and succeed when fetch fails transiently", async () => {
173199
process.env.GH_AW_COMPILED_VERSION = "v1.2.0";
174200
// First call fails transiently; second call succeeds
@@ -493,11 +519,11 @@ describe("check_version_updates", () => {
493519
// ---------------------------------------------------------------------------
494520

495521
it("should fail when version is below minimum", async () => {
496-
process.env.GH_AW_COMPILED_VERSION = "v0.8.0";
522+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
497523
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "v1.0.0" }));
498524
await runMain();
499525
expect(mockCore.setFailed).toHaveBeenCalledWith(expect.stringContaining("Outdated compile-agentic version"));
500-
expect(mockCore.setFailed).toHaveBeenCalledWith(expect.stringContaining("v0.8.0"));
526+
expect(mockCore.setFailed).toHaveBeenCalledWith(expect.stringContaining("v0.91.10"));
501527
});
502528

503529
it("should fail when major version is older (v0.x.x vs min v1.0.0)", async () => {
@@ -522,14 +548,14 @@ describe("check_version_updates", () => {
522548
});
523549

524550
it("should skip minimum check when minimumVersion is empty string", async () => {
525-
process.env.GH_AW_COMPILED_VERSION = "v0.1.0";
551+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
526552
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "" }));
527553
await runMain();
528554
expect(mockCore.setFailed).not.toHaveBeenCalled();
529555
});
530556

531557
it("should skip minimum check when minimumVersion has no 'v' prefix (unknown format — ignore)", async () => {
532-
process.env.GH_AW_COMPILED_VERSION = "v0.1.0";
558+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
533559
// minimumVersion "2.0.0" has no v prefix — should be ignored
534560
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "2.0.0" }));
535561
await runMain();
@@ -538,15 +564,15 @@ describe("check_version_updates", () => {
538564
});
539565

540566
it("should skip minimum check when minimumVersion is a garbage string", async () => {
541-
process.env.GH_AW_COMPILED_VERSION = "v0.1.0";
567+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
542568
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "latest" }));
543569
await runMain();
544570
expect(mockCore.setFailed).not.toHaveBeenCalled();
545571
expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Version check passed"));
546572
});
547573

548574
it("should write summary when version is below minimum", async () => {
549-
process.env.GH_AW_COMPILED_VERSION = "v0.8.0";
575+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
550576
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "v1.0.0" }));
551577
await runMain();
552578
expect(mockCore.summary.addRaw).toHaveBeenCalledWith(expect.stringContaining("Outdated compile-agentic version"));
@@ -605,12 +631,12 @@ describe("check_version_updates", () => {
605631
// ---------------------------------------------------------------------------
606632

607633
it("should warn when version is below minRecommendedVersion", async () => {
608-
process.env.GH_AW_COMPILED_VERSION = "v0.9.0";
634+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
609635
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "", minRecommendedVersion: "v1.0.0" }));
610636
await runMain();
611637
expect(mockCore.setFailed).not.toHaveBeenCalled();
612638
expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("Recommended upgrade"));
613-
expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("v0.9.0"));
639+
expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("v0.91.10"));
614640
expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining("v1.0.0"));
615641
});
616642

@@ -631,39 +657,39 @@ describe("check_version_updates", () => {
631657
});
632658

633659
it("should skip recommended check when minRecommendedVersion is empty string", async () => {
634-
process.env.GH_AW_COMPILED_VERSION = "v0.5.0";
660+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
635661
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "", minRecommendedVersion: "" }));
636662
await runMain();
637663
expect(mockCore.setFailed).not.toHaveBeenCalled();
638664
expect(mockCore.warning).not.toHaveBeenCalled();
639665
});
640666

641667
it("should skip recommended check when minRecommendedVersion has no 'v' prefix (unknown format — ignore)", async () => {
642-
process.env.GH_AW_COMPILED_VERSION = "v0.5.0";
668+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
643669
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "", minRecommendedVersion: "2.0.0" }));
644670
await runMain();
645671
expect(mockCore.setFailed).not.toHaveBeenCalled();
646672
expect(mockCore.warning).not.toHaveBeenCalled();
647673
});
648674

649675
it("should skip recommended check when minRecommendedVersion is a garbage string", async () => {
650-
process.env.GH_AW_COMPILED_VERSION = "v0.5.0";
676+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
651677
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "", minRecommendedVersion: "latest" }));
652678
await runMain();
653679
expect(mockCore.setFailed).not.toHaveBeenCalled();
654680
expect(mockCore.warning).not.toHaveBeenCalled();
655681
});
656682

657683
it("should skip recommended check when minRecommendedVersion is null (treated as missing)", async () => {
658-
process.env.GH_AW_COMPILED_VERSION = "v0.5.0";
684+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
659685
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "", minRecommendedVersion: null }));
660686
await runMain();
661687
expect(mockCore.setFailed).not.toHaveBeenCalled();
662688
expect(mockCore.warning).not.toHaveBeenCalled();
663689
});
664690

665691
it("should fail hard (not just warn) when version is also below minimumVersion", async () => {
666-
process.env.GH_AW_COMPILED_VERSION = "v0.8.0";
692+
process.env.GH_AW_COMPILED_VERSION = "v0.91.10";
667693
mockFetchSuccess(JSON.stringify({ blockedVersions: [], minimumVersion: "v1.0.0", minRecommendedVersion: "v1.0.0" }));
668694
await runMain();
669695
// Should fail, not just warn

‎docs/src/content/docs/reference/releases.md‎

Lines changed: 2 additions & 0 deletions

0 commit comments

Comments
 (0)