What happened
Build and Release went red on dev at 1af897b9b — a commit containing zero Go files (4 markdown docs + one skill file). The previous 7 consecutive dev runs were green, including 2629ad8fa four minutes earlier.
Failing job: Build macos-latest (log).
=== RUN TestGitCache_Resolve_RealRepo
Cloning into '/var/folders/.../TestGitCache_Resolve_RealRepo3737643185/001/5faa0ceb07d1e86a'...
fatal: could not read Username for 'https://github.com': Device not configured
fatal: expected flush after ref listing
gitcache_test.go:61: Resolve failed: git clone failed for
https://github.com/sunholo-data/ailang-packages: exit status 128
--- FAIL: TestGitCache_Resolve_RealRepo (0.58s)
FAIL github.com/sunholo-data/ailang/internal/pkg 2.580s
Because the build matrix is fail-fast, the macOS failure cancelled Build ubuntu-latest and Build windows-latest, so one network hiccup presents as three non-success checks.
Root cause
internal/pkg/gitcache_test.go:48 clones the live sunholo-data/ailang-packages repo over the network:
func TestGitCache_Resolve_RealRepo(t *testing.T) {
if testing.Short() { t.Skip("skipping integration test in short mode") }
cache := &GitCache{baseDir: t.TempDir()}
// Use the actual ailang-packages repoIts only guard is testing.Short(), which CI does not set. So any transient network or credential-helper condition on a runner turns into a red dev. The could not read Username line means git fell through to an interactive auth prompt — an environment condition, not a code defect.
Why this matters beyond one flake
A red dev outranks the mission queue, so each occurrence costs a triage slot and, left unexplained, reads to external viewers as an unresolved regression (the concern behind #417). This is the same class as #561 (make test is network-dependent locally: TestNetHttpPost fails on an httpbin.org 5xx) — a test whose verdict depends on a third party. #561 is about local runs; this one reaches CI and gates releases.
Suggested fix (pick one)
- Gate the test behind an explicit opt-in env var (e.g.
AILANG_NET_TESTS=1) so CI runs it only where the network is guaranteed, and it fails loudly rather than silently skipping when enabled — a silent skip would be this repo's vacuous-pass class.
- Point it at a fixture/bare repo created in
t.TempDir() instead of a live remote — the code under test is the cache/resolve logic, not GitHub's availability.
- Keep it live but retry with backoff and force non-interactive git (
GIT_TERMINAL_PROMPT=0), so an auth prompt fails fast and distinguishably rather than looking like a clone error.
Option 2 is the only one that removes the third-party dependency entirely; options 1 and 3 keep genuine integration coverage.
Also worth considering separately: fail-fast on the build matrix converts one platform's flake into three red checks, which obscures the diagnosis.
Provenance
Diagnosed first-party by the iteration-137 mission loop. The --- FAIL grep was paired with a known-positive control (13,115 --- PASS lines in the same log) so the single hit is a measurement, not a broken pattern. Failed jobs have been re-run.
Related: #561, #417.
🤖 Generated with Claude Code
What happened
Build and Releasewent red ondevat1af897b9b— a commit containing zero Go files (4 markdown docs + one skill file). The previous 7 consecutive dev runs were green, including2629ad8fafour minutes earlier.Failing job:
Build macos-latest(log).Because the build matrix is fail-fast, the macOS failure cancelled
Build ubuntu-latestandBuild windows-latest, so one network hiccup presents as three non-success checks.Root cause
internal/pkg/gitcache_test.go:48clones the livesunholo-data/ailang-packagesrepo over the network:Its only guard is
testing.Short(), which CI does not set. So any transient network or credential-helper condition on a runner turns into a reddev. Thecould not read Usernameline means git fell through to an interactive auth prompt — an environment condition, not a code defect.Why this matters beyond one flake
A red
devoutranks the mission queue, so each occurrence costs a triage slot and, left unexplained, reads to external viewers as an unresolved regression (the concern behind #417). This is the same class as #561 (make testis network-dependent locally:TestNetHttpPostfails on an httpbin.org 5xx) — a test whose verdict depends on a third party. #561 is about local runs; this one reaches CI and gates releases.Suggested fix (pick one)
AILANG_NET_TESTS=1) so CI runs it only where the network is guaranteed, and it fails loudly rather than silently skipping when enabled — a silent skip would be this repo's vacuous-pass class.t.TempDir()instead of a live remote — the code under test is the cache/resolve logic, not GitHub's availability.GIT_TERMINAL_PROMPT=0), so an auth prompt fails fast and distinguishably rather than looking like a clone error.Option 2 is the only one that removes the third-party dependency entirely; options 1 and 3 keep genuine integration coverage.
Also worth considering separately:
fail-faston the build matrix converts one platform's flake into three red checks, which obscures the diagnosis.Provenance
Diagnosed first-party by the iteration-137 mission loop. The
--- FAILgrep was paired with a known-positive control (13,115--- PASSlines in the same log) so the single hit is a measurement, not a broken pattern. Failed jobs have been re-run.Related: #561, #417.
🤖 Generated with Claude Code