feat(tcfeed): refresh open requests to the current pack - #123
Merged
Conversation
The pack is read live from sh1pt precisely so a corrected workflow reaches repositories, and that was only ever true of requests not yet sent. Thirty-three went out carrying `npm install -g "…@latest"`, the pack was fixed an hour later, and all twenty-four still open kept showing the defective version to anyone who looked at them. Three reviewers found it independently, which is as clear a signal as this gets. SonarCloud failed a quality gate on it (githubactions:S8543). CodeRabbit scored a request Moderate for "an unpinned scanner with access to a write-scoped job". Haven's maintainer declined on exactly that ground — "whoever can publish that package can run code in this repository's CI from that point on, forever, without a further PR" — while noting the project hash-pins thirteen tarballs in its ffmpeg stack alone. That is a maintainer applying their own published bar to us and finding us under it. `check --refresh` rewrites the two files on every open request to whatever the pack currently renders, and says "already current" when there is nothing to do, so it can be run after any pack change without churning commits. Written against the contents API rather than a clone: the open requests include seastar and lightning, and cloning a kernel-sized repository to rewrite two files under .github is minutes of transfer for a diff that fits on a screen. It also cannot carry anything else along by accident, which on somebody else's review is the more important half. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan67 finding(s) HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1
…and 17 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #120. The half of #122 that missed the merge —
check --refreshwas pushed to that branch after it was squashed, soTCFEED_PR_STANDINGlanded on master andrefreshOnedid not.The 24 open requests are already fixed — I ran this before the merge — but the tool that fixed them is not in the tree, so it cannot be run again after the next pack change. This restores it.
Why it exists
The pack is read live from sh1pt so a corrected workflow reaches repositories. That was only ever true of requests not yet sent. 33 went out carrying
npm install -g "…@latest", the pack was fixed an hour later, and all 24 still open kept showing the defective version to anyone who looked.Three reviewers found it independently:
SonarCloud — failed a quality gate,
githubactions:S8543CodeRabbit — scored a request 🟡 Moderate for "an unpinned scanner with access to a write-scoped job"
GlassHaven/Haven#532 — declined on exactly that ground:
while noting the project hash-pins 13 tarballs in its ffmpeg stack alone. That is a maintainer applying their own published bar to us and finding us under it.
What it does
tcfeed check --refreshrewrites both pack files on every open request to whatever the pack currently renders, and reportsalready currentwhen there is nothing to do — safe to run after any pack change without churning commits.Written against the contents API rather than a clone: the open requests include
seastarandlightning, and cloning a kernel-sized repository to rewrite two files under.githubis minutes of transfer for a diff that fits on a screen. It also cannot carry anything else along by accident, which on somebody else's review is the more important half.One detail worth flagging for review: the contents API wraps its base64 at 60 columns, so the newlines have to be stripped before decoding. Without that the decoded string never equals the file on disk and every run rewrites both files forever.
Verified
tsc --strict --noEmitclean. Run against all 24 open requests before the merge — 22 updated, 2 already current:Independently re-verified afterwards by decoding the file straight from each fork — 24/24 carry the pinned spec,
--ignore-scriptsandpersist-credentials: false, with no@latestanywhere:Idempotency checked by running twice on the same repo: the second run reports
already currentand pushes nothing.🤖 Generated with Claude Code