Repository navigation
ci: isolate acceptance verification on a fresh runner - #850
Merged
Merged
Conversation
1 task done
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The acceptance verifier shared a writable runner workspace with the source under test, despite being checked out at the workflow revision. Move verification to a fresh job that checks out only the workflow SHA and reads current-run artifacts as data. This also resolves the CodeQL cache-poisoning findings raised by the new verifier steps in #849.
This is the v3 counterpart to the update on #849; #848 is already merged. No runtime, fixture, bound, or verifier-parser changes. Cache access stays disabled. Refs #837.
Validation
66962f56ddc75303eebe247159d915afa4420a23tested v3 sourcea2ac9545be7ee9bb62ca2d50ccd7b8bd6241ee3f; the verifier confirmed ten passing tests and nine measured RSS records.66962f56dwith no new alerts.Notes for reviewer
The verifier runs even if an acceptance job fails and explicitly rejects that result. It skips only when acceptance is unavailable or the workflow is cancelled. Downloaded artifacts cannot replace the trusted verifier checkout. No heavy local or bench work was run.