|
| 1 | +--- |
| 2 | +phase: quick-260611-v0x |
| 3 | +plan: 01 |
| 4 | +status: complete |
| 5 | +subsystem: ci/docs |
| 6 | +tags: [rev-17, rev-08, rev-10, rev-13, github-actions, node-24, security] |
| 7 | +commits: |
| 8 | + - hash: 73d575b |
| 9 | + message: "chore(sync): REV-17 bump actions to Node 24 + SHA-pin; REV-08 null xargs; REV-10 drop dead check" |
| 10 | + files: [.github/workflows/sync-master.yml] |
| 11 | + - hash: fcb0135 |
| 12 | + message: "docs(claude-md): REV-13 note that release tags reference dev commits, not master" |
| 13 | + files: [CLAUDE.md] |
| 14 | +dependency_graph: |
| 15 | + requires: [] |
| 16 | + provides: [hardened-sync-workflow, rev-13-doc-bullet] |
| 17 | + affects: [.github/workflows/sync-master.yml, CLAUDE.md] |
| 18 | +tech_stack: |
| 19 | + added: [] |
| 20 | + patterns: [sha-pinned-actions, null-delimited-xargs] |
| 21 | +key_files: |
| 22 | + modified: |
| 23 | + - .github/workflows/sync-master.yml |
| 24 | + - CLAUDE.md |
| 25 | +decisions: |
| 26 | + - "node-version bump 20→24 added to scope (Node 20 EOL 2026-04-30, Node 24 LTS since Oct 2025); keeps step name + action runtime + installed version consistent" |
| 27 | + - "app-id input not renamed despite v3.1.0 deprecation — orchestrator pre-confirmed it still works at v3.2.0" |
| 28 | +metrics: |
| 29 | + duration: ~5m |
| 30 | + completed: 2026-06-11 |
| 31 | + tasks_completed: 2 |
| 32 | + files_modified: 2 |
| 33 | +--- |
| 34 | + |
| 35 | +# Phase quick-260611-v0x Plan 01: REV-17/REV-08/REV-10/REV-13 Hardening Summary |
| 36 | + |
| 37 | +**One-liner:** SHA-pinned three GitHub Actions to Node-24-compatible versions, hardened FEEDBACK strip with null-delimited xargs, removed unreachable idempotency block, documented release-tag/master-commit mismatch in CLAUDE.md. |
| 38 | + |
| 39 | +## Tasks Completed |
| 40 | + |
| 41 | +| # | Task | Commit | Files | |
| 42 | +|---|------|--------|-------| |
| 43 | +| 1 | Apply REV-17 + REV-08 + REV-10 to sync-master.yml | `73d575b` | `.github/workflows/sync-master.yml` | |
| 44 | +| 2 | Apply REV-13 doc bullet to CLAUDE.md | `fcb0135` | `CLAUDE.md` | |
| 45 | + |
| 46 | +## Changes Applied |
| 47 | + |
| 48 | +### Task 1: sync-master.yml |
| 49 | + |
| 50 | +**REV-17 — action pins (Node-24-compatible, SHA-pinned):** |
| 51 | +- `actions/create-github-app-token`: `fee1f7d` (v2.2.2) → `bcd2ba49` (v3.2.0) |
| 52 | +- `actions/checkout`: `@v4` → `93cb6efe` (v6.0.3) |
| 53 | +- `actions/setup-node`: `@v4` → `a0853c24` (v6.4.0); step renamed "Set up Node 24" |
| 54 | +- `node-version`: `"20"` → `"24"` (added to plan scope — Node 20 past EOL, keeps workflow internally consistent) |
| 55 | + |
| 56 | +**REV-08 — null-delimited FEEDBACK/HANDOVER strip:** |
| 57 | +- Before: `git ls-files | grep -E ... | xargs --no-run-if-empty git rm --quiet` |
| 58 | +- After: `git ls-files -z | grep -zE ... | xargs -0 --no-run-if-empty git rm --quiet` |
| 59 | +- Prevents false splits on filenames with spaces/special chars; GNU grep -z supported on ubuntu-latest |
| 60 | + |
| 61 | +**REV-10 — dead idempotency block removed:** |
| 62 | +- Removed 7-line block (`# If nothing changed after strip` comment + STAGED/UNSTAGED vars + if/echo/exit/fi) |
| 63 | +- Block was unreachable: `git rm` always stages deletions; the `git commit` following it already handles the "nothing to commit" case gracefully via exit code |
| 64 | + |
| 65 | +### Task 2: CLAUDE.md |
| 66 | + |
| 67 | +**REV-13 — new bullet in Branch model Rules list:** |
| 68 | +- Inserted after "`master` is NOT a git ancestor of `dev`" bullet |
| 69 | +- Content: `Release tags reference dev commits, not master — \`git tag --contains HEAD\` on a master checkout finds nothing.` |
| 70 | + |
| 71 | +## Deviations from Plan |
| 72 | + |
| 73 | +### Auto-extended scope |
| 74 | + |
| 75 | +**1. [Rule 2 - Consistency] node-version: "20" → "24" added** |
| 76 | +- Found during: Task 1 planning |
| 77 | +- Issue: plan notes explicitly called for this as an amendment; step name rename to "Set up Node 24" would be inconsistent with `node-version: "20"` remaining |
| 78 | +- Fix: bumped node-version alongside action runtime and step name |
| 79 | +- Files modified: `.github/workflows/sync-master.yml` (line 103) |
| 80 | +- Commit: `73d575b` |
| 81 | + |
| 82 | +None beyond the above scope addition — plan executed as written. |
| 83 | + |
| 84 | +## Verification Results |
| 85 | + |
| 86 | +| Check | Result | |
| 87 | +|-------|--------| |
| 88 | +| `create-github-app-token@bcd2ba49` present | line 46 | |
| 89 | +| `checkout@93cb6efe` present | line 55 | |
| 90 | +| `setup-node@a0853c24` present | line 101 | |
| 91 | +| `node-version: "24"` present | line 103 | |
| 92 | +| `git ls-files -z` count = 1 | 1 | |
| 93 | +| `No changes after strip` count = 0 | 0 | |
| 94 | +| `Release tags reference dev` in CLAUDE.md | present | |
| 95 | +| `npm test` | 15/15 pass | |
| 96 | + |
| 97 | +## Phase 2 Master Ruleset — handed off to user |
| 98 | + |
| 99 | +Orchestrator prepared the `gh api` POST body for the master branch ruleset (locks master to App-only pushes, bypass list: kleros-skills-sync App / OrganizationAdmin / RepositoryRole 5). User opted to apply the admin action manually outside this session (noted: `enforcement=evaluate` is Enterprise-only and would not work for org `kleros`). |
| 100 | + |
| 101 | +**Ready-to-run command** captured in the orchestration trace. Rules: creation / update / deletion / non_fast_forward. Bypass actors target the same pattern as the existing `release tags` ruleset (id 17422938) plus the App. |
| 102 | + |
| 103 | +**Verification after manual application:** `gh api repos/kleros/kleros-skills/rulesets --jq '.[] | {id, name, target, enforcement}'` should show two active rulesets (`release tags` + `lock master to sync App`). |
| 104 | + |
| 105 | +## Self-Check: PASSED |
| 106 | + |
| 107 | +- `73d575b` exists in git log |
| 108 | +- `fcb0135` exists in git log |
| 109 | +- `.github/workflows/sync-master.yml` modified (8 insertions, 14 deletions) |
| 110 | +- `CLAUDE.md` modified (1 insertion) |
| 111 | +- No file deletions in either commit |
0 commit comments