feat(action): publish reports through the git-data API - #328
Merged
Conversation
Fallow audit reportNo GitHub PR/MR findings. Generated by fallow. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| /** One publish attempt against the current branch tip. Throws | ||
| * ReportPublishApiError with status 422 when the ref moved under us. */ | ||
| async function publishOnce( |
There was a problem hiding this comment.
warn fallow/high-cognitive-complexity: 'publishOnce' has cognitive complexity 18 (threshold: 15)
🗺️ StyleProof report📊 View the side-by-side visual report →Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; visual approval cannot clear this failure. |
BenSheridanEdwards
force-pushed
the
feat/api-report-publish
branch
from
July 21, 2026 16:40
9548d79 to
7318616
Compare
added 3 commits
July 21, 2026 17:44
The publish step cloned the report branch to add one pr-<n>/ folder, so every publish cost the size of the whole branch. With one folder per PR the branch grows without bound, and once it reaches a few gigabytes the clone dies mid-transfer and publish fails on every PR in the repository. A blobless clone does not help: git push re-fetches the retained blobs to build its pack. Publish now uploads the report blobs, grafts the folder onto the current tip tree server-side, and fast-forwards the ref, so it costs the size of this report and never downloads report bytes. The fast-forward race against concurrent publishes retries against the fresh tip, first runs create the branch as an orphan with the README, and the run receipt is embedded and verified at the published commit exactly as before, fail closed. Publish also measures the branch's blob size from the tree listing and logs a workflow warning when it passes 1 GB, so consumers hear about growth long before anything breaks.
The one-function publish attempt crossed the complexity gate, and the README constant leaked into the public surface. Tip read, blob upload, tree grafting, ref advance, and size telemetry are now separate small functions; behaviour is unchanged and covered by the existing tests.
BenSheridanEdwards
force-pushed
the
feat/api-report-publish
branch
from
July 21, 2026 16:45
7318616 to
2e167fd
Compare
This was referenced Jul 22, 2026
BenSheridanEdwards
added a commit
that referenced
this pull request
Jul 22, 2026
Cut 4.7.0 from the six commits merged since 4.6.3. Two are feature work, so this is a minor bump; the version bump is the Release workflow's signal to tag, publish to npm, and cut the GitHub Release on merge. Added - Reports publish through the git-data API (#328). - styleproof-init prunes reports by API with a retention + size-budget sweep (#329). - CERTIFICATION_FAILED dogfooded end-to-end (#327). Security - Cleared two high-severity transitive advisories: brace-expansion 5.0.6→5.0.7 (#330) and fast-uri 3.1.3→3.1.4, GHSA-v2hh-gcrm-f6hx (#331). Verified locally: build, typecheck, lint, format:check, privacy:check all clean; full node --test suite 630/630 with a complete install. Co-authored-by: StyleProof Test <styleproof@example.test> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why does this feature exist?
So publishing a report keeps working no matter how large the report branch grows. The publish step cloned the whole report branch to add one
pr-<n>/folder, so every publish cost the size of every report ever kept. Once the branch reached a few gigabytes, the clone started dying mid-transfer (curl 18 ... invalid index-pack output) and the publish step failed on every PR in the repository, after the gate had already reached its verdict. Publish now costs the size of the report being published, so branch growth can never break it again.A blobless clone cannot fix this:
git pushre-fetches the retained blobs to build its pack, so--filter=blob:nonemoves the cost from clone time to push time instead of removing it.What changed?
src/report-publish.tsandbin/styleproof-publish-report.mjs(registered inpackage.jsonbin): publish through the GitHub git-data API. Upload the report blobs (report.mdplus everycrops/*.png), build one tree on the current tip (delete this PR's stale folder if present, seed the README if missing), create the commit, and fast-forward the ref withforce: false. A rejected update means another publish advanced the branch; the attempt retries against the fresh tip, up to 5 times with backoff. First runs create the branch as an orphan; a racing first run loses the ref create and retries onto the winner's branch.action.ymlpublish step: the clone/commit/push loop is replaced by one call to the new command. Report generation, the receipt embedded inreport.md, the fail-closed read-back at the exact published commit, and thesha/url/raw-baseoutputs are unchanged contracts.test/action.test.mjs: the five contracts that pinned the old bash internals now assert the same guarantees at their new home, including that the publish step never runsgit cloneorgit push.Behavioural Proof (with video and screenshots)
Not applicable: this is CI plumbing with no rendered surface. Behavioural proof is the Action dogfood workflow on this PR, which runs the real composite action end to end — it published its report through the new API path and passed.
test/report-publish.test.mjsadditionally drives the publisher against an in-memory git-data API double: existing-branch publish with zero report bytes downloaded, wholesale folder replacement leaving other folders untouched, orphan first run with README, README seeding, the fast-forward race retrying then succeeding, the attempt budget surfacing a persistent race, immediate failure on non-retryable client errors, the size warning above threshold, truncated listings skipping size telemetry, and receipt verification passing and failing closed.Verification Summary
npm test(build + full suite): 620 pass, 0 fail on this branch.npm run format:check: clean.