[WRONG BRANCH] release: promote frozen tip 2606f6f922 to main as 2.93.0

.github/actions/setup-project-bun/action.yml

@@ -8,8 +8,8 @@ description: >-
 # (#6713 run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9). It moved from 1.4.0 to
 # 1.4.3 for oven-sh/bun#44581: 1.4.0's Bun.spawnSync could lose a child's exit after
 # finalizers ran inside an earlier call and spin past its own timeout (#4956).
-# Rejoin only after the upstream runner crash is fixed and a green lane=all
-# dispatch proves the unified version; then delete testRunnerBun and this role input.
+# Both roles now default to the package's 1.4.4 security transition, retaining role validation.
+# Promotion requires a green full cross-platform lane=all run on the exact candidate head.
 inputs:
   role:
     description: Bun role to install (runtime or test-runner).

.github/scripts/enforce-pr-target.test.cjs

@@ -94,7 +94,9 @@ describe("enforce-pr-target workflow", () => {
 
   it("writes exactly one consolidated comment via a single upsert helper", () => {
     assert.match(workflow, /GATE_MARKER,/);
-    assert.match(workflow, /comment\.body\?\.includes\(GATE_MARKER\)/);
+    // The gate comment is the bot comment that starts with GATE_MARKER; a
+    // marker echoed inside another comment does not classify it.
+    assert.match(workflow, /comments\.find\(isGateComment\)/);
     assert.match(workflow, /upsertGateComment/);
     assert.match(workflow, /buildGateCommentBody/);
     // No legacy two-comment write path remains.

.github/scripts/pr-hygiene.cjs

@@ -292,6 +292,109 @@ const HYGIENE_GATE_LABELS = [
   "attribution-approved",
 ];
 
+/**
+ * Exception approvals vouch for one revision of the change. Each counts only
+ * while the head the hygiene workflow last recorded is still the head being
+ * evaluated and nothing has rewritten the branch since. Sponsorship
+ * (`maintainer-sponsored`) is about which surfaces change, not about one
+ * revision, so it is not head-bound.
+ */
+const HEAD_BOUND_APPROVAL_LABELS = [
+  "test-exception-approved",
+  "suppression-approved",
+  "generated-change-approved",
+  "dependency-change-approved",
+  "attribution-approved",
+];
+
+/** Issue events after which the head can point at an earlier commit again. */
+const HEAD_REWRITE_EVENTS = ["head_ref_force_pushed", "head_ref_restored"];
+
+const APPROVAL_RECORD_TOKEN = "pr-hygiene-approvals";
+const APPROVAL_RECORD_LINE = /^<!-- pr-hygiene-approvals (\{.*\}) -->$/;
+const FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+
+function isRewriteCount(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+
+/**
+ * Read the head binding the hygiene workflow wrote as the last line of its
+ * own section. The token must occur exactly once in `source` and sit on that
+ * last line, so echoed text (a changed path can contain newlines) can only
+ * make the record unreadable, never stand in for it.
+ * @returns {{ head: string, headRewrites: number | null } | null}
+ */
+function parseApprovalRecord(source) {
+  if (typeof source !== "string") return null;
+  if (source.split(APPROVAL_RECORD_TOKEN).length !== 2) return null;
+  const lines = source.split("\n").map((line) => line.trim()).filter(Boolean);
+  const match = lines.at(-1)?.match(APPROVAL_RECORD_LINE);
+  if (!match) return null;
+  let value;
+  try {
+    value = JSON.parse(match[1]);
+  } catch {
+    return null;
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  if (Object.keys(value).sort().join(",") !== "head,headRewrites") return null;
+  if (typeof value.head !== "string" || !FULL_SHA.test(value.head)) return null;
+  if (value.headRewrites !== null && !isRewriteCount(value.headRewrites)) return null;
+  return { head: value.head, headRewrites: value.headRewrites };
+}
+
+/** `headRewrites` is null when the history read failed: nothing is confirmed. */
+function formatApprovalRecord({ head, headRewrites }) {
+  const value = { head, headRewrites: isRewriteCount(headRewrites) ? headRewrites : null };
+  return "<!-- " + APPROVAL_RECORD_TOKEN + " " + JSON.stringify(value) + " -->";
+}
+
+function countHeadRewrites(events) {
+  return (events ?? []).filter((entry) => HEAD_REWRITE_EVENTS.includes(entry?.event)).length;
+}
+
+function presentHeadBoundApprovals(labels) {
+  return HEAD_BOUND_APPROVAL_LABELS.filter((label) => labels.includes(label));
+}
+
+/** True when a current rewrite count could still confirm an approval. */
+function needsHeadRewriteCount({ labels = [], headSha, record = null, eventAction }) {
+  return (
+    eventAction !== "synchronize" &&
+    record !== null &&
+    record.head === headSha &&
+    isRewriteCount(record.headRewrites) &&
+    presentHeadBoundApprovals(labels).length > 0
+  );
+}
+
+/**
+ * Split the head-bound approvals on the pull request into the ones that still
+ * describe the evaluated head and the ones that do not. They are kept only
+ * when the last recorded evaluation saw this same head and the rewrite count,
+ * read before that evaluation's snapshot and again after this one's, has not
+ * changed. Without a rewrite, fast-forward pushes cannot bring the recorded
+ * head back, so the head has not moved since that evaluation, which removed
+ * every approval it could not confirm. A synchronize event, a missing record,
+ * or an unknown count confirms nothing.
+ * @returns {{ kept: string[], stale: string[] }}
+ */
+function reconcileHeadBoundApprovals({
+  labels = [],
+  headSha,
+  record = null,
+  eventAction,
+  headRewriteCount = null,
+}) {
+  const present = presentHeadBoundApprovals(labels);
+  const current =
+    needsHeadRewriteCount({ labels, headSha, record, eventAction }) &&
+    isRewriteCount(headRewriteCount) &&
+    headRewriteCount === record.headRewrites;
+  return current ? { kept: present, stale: [] } : { kept: [], stale: present };
+}
+
 /**
  * Combine patch-hygiene and sponsored-surface failures into one list so the
  * hygiene workflow and the PR quality gate cannot disagree about Ready.
@@ -340,13 +443,20 @@ module.exports = {
   addedLines,
   assessHygiene,
   collectDeterministicHygieneFailures,
+  countHeadRewrites,
+  formatApprovalRecord,
+  HEAD_BOUND_APPROVAL_LABELS,
+  HEAD_REWRITE_EVENTS,
   HYGIENE_FAILURE_HINTS,
   HYGIENE_GATE_LABELS,
   hasEmptyCatch,
   hasDeletions,
   isBehaviorPath,
   isGeneratedPath,
   isTestPath,
+  needsHeadRewriteCount,
+  parseApprovalRecord,
+  reconcileHeadBoundApprovals,
   resultLines,
   resultLinesByHunk,
 };

.github/scripts/pr-hygiene.test.cjs

@@ -6,9 +6,15 @@ const {
   addedLines,
   assessHygiene,
   collectDeterministicHygieneFailures,
+  countHeadRewrites,
+  formatApprovalRecord,
+  HEAD_BOUND_APPROVAL_LABELS,
   HYGIENE_FAILURE_HINTS,
   HYGIENE_GATE_LABELS,
   hasEmptyCatch,
+  needsHeadRewriteCount,
+  parseApprovalRecord,
+  reconcileHeadBoundApprovals,
   resultLines,
   resultLinesByHunk,
 } = require("./pr-hygiene.cjs");
@@ -391,3 +397,100 @@ describe("pr-hygiene workflow trust boundary", () => {
     );
   });
 });
+
+describe("head-bound approvals", () => {
+  const HEAD = "c".repeat(40);
+  const OTHER = "d".repeat(40);
+  const record = (head, headRewrites) =>
+    "<!-- pr-hygiene-approvals " + JSON.stringify({ head, headRewrites }) + " -->";
+
+  it("covers exactly the exception approvals, not sponsorship", () => {
+    assert.deepEqual(
+      [...HEAD_BOUND_APPROVAL_LABELS].sort(),
+      HYGIENE_GATE_LABELS.filter(
+        (label) => label !== "intake: hygiene-blocked" && label !== "maintainer-sponsored",
+      ).sort(),
+    );
+  });
+
+  it("round-trips a record, including an unknown rewrite count", () => {
+    const line = formatApprovalRecord({ head: HEAD, headRewrites: 2 });
+    assert.equal(line, record(HEAD, 2));
+    assert.deepEqual(parseApprovalRecord("status\n\n" + line), { head: HEAD, headRewrites: 2 });
+    assert.deepEqual(parseApprovalRecord(formatApprovalRecord({ head: HEAD, headRewrites: undefined })), {
+      head: HEAD,
+      headRewrites: null,
+    });
+    assert.deepEqual(parseApprovalRecord(record("e".repeat(64), 0)), { head: "e".repeat(64), headRewrites: 0 });
+  });
+
+  it("rejects anything but one well-formed record on the last line", () => {
+    for (const source of [
+      null,
+      "",
+      record(HEAD, 0) + "\nlater line",
+      record(HEAD, 0) + "\n" + record(HEAD, 0),
+      "mentions pr-hygiene-approvals elsewhere\n" + record(HEAD, 0),
+      "<!-- pr-hygiene-approvals {not json} -->",
+      "<!-- pr-hygiene-approvals " + JSON.stringify({ head: HEAD, headRewrites: 0, approvals: [] }) + " -->",
+      "<!-- pr-hygiene-approvals " + JSON.stringify({ head: HEAD }) + " -->",
+      "<!-- pr-hygiene-approvals [1] -->",
+      record("abc", 0),
+      record(HEAD.toUpperCase(), 0),
+      record(HEAD, -1),
+      record(HEAD, 1.5),
+      record(HEAD, "1"),
+    ]) {
+      assert.equal(parseApprovalRecord(source), null, String(source));
+    }
+  });
+
+  it("counts only head rewrite events", () => {
+    assert.equal(
+      countHeadRewrites([
+        { event: "head_ref_force_pushed" },
+        { event: "labeled" },
+        { event: "head_ref_restored" },
+        null,
+      ]),
+      2,
+    );
+    assert.equal(countHeadRewrites(undefined), 0);
+  });
+
+  it("keeps approvals only under an unchanged head and rewrite count", () => {
+    const labels = ["test-exception-approved", "maintainer-sponsored"];
+    const base = { labels, headSha: HEAD, record: { head: HEAD, headRewrites: 1 }, eventAction: "edited" };
+    const kept = { kept: ["test-exception-approved"], stale: [] };
+    const stale = { kept: [], stale: ["test-exception-approved"] };
+    assert.deepEqual(reconcileHeadBoundApprovals({ ...base, headRewriteCount: 1 }), kept);
+    assert.deepEqual(reconcileHeadBoundApprovals({ ...base, headRewriteCount: 2 }), stale);
+    assert.deepEqual(reconcileHeadBoundApprovals({ ...base, headRewriteCount: null }), stale);
+    assert.deepEqual(reconcileHeadBoundApprovals({ ...base, headRewriteCount: 1, eventAction: "synchronize" }), stale);
+    assert.deepEqual(reconcileHeadBoundApprovals({ ...base, headRewriteCount: 1, headSha: OTHER }), stale);
+    assert.deepEqual(reconcileHeadBoundApprovals({ ...base, headRewriteCount: 1, record: null }), stale);
+    assert.deepEqual(
+      reconcileHeadBoundApprovals({ ...base, headRewriteCount: 1, record: { head: HEAD, headRewrites: null } }),
+      stale,
+    );
+    assert.deepEqual(
+      reconcileHeadBoundApprovals({ ...base, labels: ["maintainer-sponsored"], headRewriteCount: 1 }),
+      { kept: [], stale: [] },
+    );
+  });
+
+  it("asks for a rewrite count only when one could confirm an approval", () => {
+    const base = {
+      labels: ["suppression-approved"],
+      headSha: HEAD,
+      record: { head: HEAD, headRewrites: 0 },
+      eventAction: "labeled",
+    };
+    assert.equal(needsHeadRewriteCount(base), true);
+    assert.equal(needsHeadRewriteCount({ ...base, labels: [] }), false);
+    assert.equal(needsHeadRewriteCount({ ...base, eventAction: "synchronize" }), false);
+    assert.equal(needsHeadRewriteCount({ ...base, headSha: OTHER }), false);
+    assert.equal(needsHeadRewriteCount({ ...base, record: null }), false);
+    assert.equal(needsHeadRewriteCount({ ...base, record: { head: HEAD, headRewrites: null } }), false);
+  });
+});