From a6df06c3494106a154767d3abf3aea720202c22c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 21:34:05 +0900 Subject: [PATCH 1/3] test(ci): require full verification on stacked pull requests --- scripts/test_ci_workflow_stack_coverage.py | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 scripts/test_ci_workflow_stack_coverage.py diff --git a/scripts/test_ci_workflow_stack_coverage.py b/scripts/test_ci_workflow_stack_coverage.py new file mode 100644 index 000000000..8a3af8b7e --- /dev/null +++ b/scripts/test_ci_workflow_stack_coverage.py @@ -0,0 +1,24 @@ +from pathlib import Path + + +REPOSITORY_ROOT = Path(__file__).resolve().parents[1] +CI_WORKFLOW = REPOSITORY_ROOT / ".github" / "workflows" / "ci.yml" + + +def test_ci_runs_for_every_pull_request_base() -> None: + """Stacked pull requests must receive the same exact-head CI as main-bound PRs.""" + workflow = CI_WORKFLOW.read_text(encoding="utf-8") + + assert " pull_request: {}" in workflow + assert " pull_request:\n branches: [main]" not in workflow + + +def test_ci_preserves_exact_head_and_synthetic_merge_evidence() -> None: + """Broadening PR coverage must not weaken exact-head or merge verification.""" + workflow = CI_WORKFLOW.read_text(encoding="utf-8") + + exact_head_expression = "github.event.pull_request.head.sha || github.sha" + assert workflow.count(exact_head_expression) >= 4 + assert 'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"' in workflow + assert "name: Maven merge compatibility" in workflow + assert "name: Buyer-readiness script tests" in workflow From c1239e20b048a582b19cb9eeb90f2c29f7c8f814 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 21:34:39 +0900 Subject: [PATCH 2/3] fix(ci): verify stacked pull requests without weakening gates --- .github/workflows/ci.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 52499d2b5..6bbdcb0a2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,8 +3,9 @@ name: CI on: push: branches: [main] - pull_request: - branches: [main] + # Every pull request target, including immutable stack branches, receives the + # same exact-head, synthetic-merge, and buyer-readiness acceptance evidence. + pull_request: {} permissions: contents: read From ed3863209109cd24a3cf1f1d6bdcd51db16fbef1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 7 Aug 2026 01:20:15 +0900 Subject: [PATCH 3/3] test(ci): support standard script discovery --- scripts/test_ci_workflow_stack_coverage.py | 35 ++++++++++++++-------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/scripts/test_ci_workflow_stack_coverage.py b/scripts/test_ci_workflow_stack_coverage.py index 8a3af8b7e..2183cb5a6 100644 --- a/scripts/test_ci_workflow_stack_coverage.py +++ b/scripts/test_ci_workflow_stack_coverage.py @@ -1,24 +1,33 @@ +"""Verify that stacked pull requests retain the complete CI acceptance contract.""" + from pathlib import Path +import unittest REPOSITORY_ROOT = Path(__file__).resolve().parents[1] CI_WORKFLOW = REPOSITORY_ROOT / ".github" / "workflows" / "ci.yml" -def test_ci_runs_for_every_pull_request_base() -> None: - """Stacked pull requests must receive the same exact-head CI as main-bound PRs.""" - workflow = CI_WORKFLOW.read_text(encoding="utf-8") +class CiWorkflowStackCoverageTest(unittest.TestCase): + """Exercises the stacked-pull-request workflow contract with standard discovery.""" + + def test_ci_runs_for_every_pull_request_base(self) -> None: + """Stacked pull requests must receive the same exact-head CI as main-bound PRs.""" + workflow = CI_WORKFLOW.read_text(encoding="utf-8") + + self.assertIn(" pull_request: {}", workflow) + self.assertNotIn(" pull_request:\n branches: [main]", workflow) - assert " pull_request: {}" in workflow - assert " pull_request:\n branches: [main]" not in workflow + def test_ci_preserves_exact_head_and_synthetic_merge_evidence(self) -> None: + """Broadening PR coverage must not weaken exact-head or merge verification.""" + workflow = CI_WORKFLOW.read_text(encoding="utf-8") + exact_head_expression = "github.event.pull_request.head.sha || github.sha" + self.assertGreaterEqual(workflow.count(exact_head_expression), 4) + self.assertIn('test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"', workflow) + self.assertIn("name: Maven merge compatibility", workflow) + self.assertIn("name: Buyer-readiness script tests", workflow) -def test_ci_preserves_exact_head_and_synthetic_merge_evidence() -> None: - """Broadening PR coverage must not weaken exact-head or merge verification.""" - workflow = CI_WORKFLOW.read_text(encoding="utf-8") - exact_head_expression = "github.event.pull_request.head.sha || github.sha" - assert workflow.count(exact_head_expression) >= 4 - assert 'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"' in workflow - assert "name: Maven merge compatibility" in workflow - assert "name: Buyer-readiness script tests" in workflow +if __name__ == "__main__": + unittest.main()