8000 ci(threat-model): stop threat-model PRs conflicting on prose_version by adeelahmad · Pull Request #525 · adeelahmad/lense · GitHub
[go: up one dir, main page]
Skip to content

ci(threat-model): stop threat-model PRs conflicting on prose_version - #525

Merged
adeelahmad merged 1 commit into
mainfrom
claude/project-thread-dp62qj
Oct 17, 2026
Merged

ci(threat-model): stop threat-model PRs conflicting on prose_version#525
adeelahmad merged 1 commit into
mainfrom
claude/project-thread-dp62qj

Conversation

@adeelahmad
@adeelahmad adeelahmad commented Oct 17, 2026 •
edited
Loading
Copy link
Copy Markdown
Owner

Requested by Adeel · project thread

Description

Before: threat-model.yaml kept prose_version: "threat-model.md@sha256:<hash of the whole prose>", so any two pull requests that changed threat-model.md both rewrote that one line, and whichever merged second conflicted. A conflicted PR gets no CI, so it had to merge main, recompute the hash and wait out CI again (#400 three times, #508 six).

After: prose_version is "threat-model.md@same-commit", a value no change edits. What the hash enforced, that a change to the prose is regenerated into the companions, is now checked per change: ci/validate_threat_model.py --base REF fails when threat-model.md changed since REF but neither threat-model.yaml nor threat-model.json did. CI passes --base HEAD^1 (the merge commit's base on a PR, the previous main on a push) with fetch-depth: 2. The id, Q-number and snapshot checks are unchanged.

How: the validator drops the hash comparison, requires the fixed prose_version, and adds changed_since() (git merge-base, then a diff against the working tree so uncommitted edits count locally). The workflow also runs the new ci/test_validate_threat_model.py.

Motivation and Context

Fixes #507.

Evidence:

  • test_two_changes_to_the_prose_merge_cleanly builds two branches that each add a property to the prose and companions in their own place, merges them, and validates the result. Re-run with the old whole-prose hash, the same test fails with CONFLICT (content): Merge conflict in threat-model.yaml. With this change it merges and passes.
  • I simulated CI in a --depth 2 clone of this branch merged into main: --base HEAD^1 passes. After adding a commit that changes only threat-model.md, it fails with threat-model.md changed since HEAD^1 but neither threat-model.yaml nor threat-model.json did.
  • ci/validate_threat_model.py --base origin/main passes on this branch, and so do the 8 validator tests, pre-commit (ruff, actionlint, check-yaml) and make requirements. ci/local-ci.sh --pr 525 --jobs pre-commit,title also passes (no backend or frontend code changed).

Open PRs that still carry a hash, such as #508, will conflict on this line one last time. Take main's "threat-model.md@same-commit".

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change; ! in the title)

Checklist:

  • The title is a Conventional Commit.
  • My code follows the code style of this project (make hooks checks it on commit).
  • I added or updated tests.
  • My change requires documentation updates, and I have updated docs/ accordingly. (docs/requirements.md row, threat-model.md §1.19, DEVLOG note)
  • Users need more than the title to understand it, so I wrote it under ## Unreleased in CHANGELOG.md. (n/a: CI-only)

Done questions (AGENTS.md)

  • Goal: removes the shared conflicting line; merged on green CI.
  • Agents: n/a, a contributor CI check, not a product feature; agents run the same command.
  • Zero setup: n/a, nothing changes for installs.
  • Fewest clicks and keystrokes: one fewer step per threat-model change (no hash to recompute).
  • Configurable: n/a, no settings.
  • Light: n/a, CI only.
  • Private and secure: the threat-model check isn't loosened. A prose change still has to come with a companion change, and the id agreement checks are unchanged.
  • Cost: n/a, no model calls.
  • User decides: n/a, no defaults changed.
  • Upgrades: n/a, no stored data.
  • Honest: §1.19 says what CI checks.
  • Tests, docs and generated files updated.
  • Open standards; dependencies keep Lens MIT (git and pyyaml, already used).
  • Result reported with evidence. Refine later: hash-only updates let the YAML fall behind the prose. §1.9 has 7 dependency rows that dependencies lacks, and §1.8 outputs and §1.7 entry points also have rows the YAML lacks. ci: threat-model.yaml and .json lag the prose's tables; check row coverage #526 tracks backfilling them and adding a row-coverage check.
  • Reuse: plain git and the existing validator.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bwc5go44W4hjHKu329MepB

@claude
ci(threat-model): stop every pair of threat-model PRs conflicting on …
d8fbd75 
…prose_version

threat-model.yaml kept a sha256 of the whole prose, so any two pull requests
that changed threat-model.md both rewrote that one line and the second to merge
conflicted (#400, #508). The YAML's prose_version now names the prose in the
same commit, and the validator's new --base check (run by CI against the merge
commit's parent) fails a change to the prose that changes neither companion,
which is what the hash enforced, without a line every change edits. Adds tests,
including two branches that change the prose in different places merging
cleanly and still validating.

Fixes #507

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bwc5go44W4hjHKu329MepB
@adeelahmad adeelahmad self-assigned this Oct 17, 2026
@adeelahmad adeelahmad mentioned this pull request Oct 17, 2026
Open
@adeelahmad
adeelahmad merged commit c7238d8 into main Oct 17, 2026
11 checks passed
@adeelahmad
adeelahmad deleted the claude/project-thread-dp62qj branch October 17, 2026 09:22
adeelahmad pushed a commit that referenced this pull request Oct 18, 2026
@claude
Merge origin/main into claude/project-thread-s4wlc9
1d218b1 
Brings in #525: prose_version no longer hashes the prose.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YHrWfYDCaCbKKDX4w9at9C
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@adeelahmad adeelahmad

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ci: threat-model.yaml prose_version conflicts on every pair of PRs that touch threat-model.md

2 participants

@adeelahmad @claude
0