#225 fixed the fail-open formatting check and wrote
scripts/verify-formatting-gate.sh to pin the fix: four cases, stubbed
runners, sentinel-checked so a broken stub cannot pass. Nothing ran it.
A repository-wide search finds exactly one file containing its name --
itself, in its own usage comment.
So the property was pinned on paper and unpinned in practice. The gate
could have regressed to fail-open a second time and every board would
have stayed green, which is the failure the script was written to
prevent, one level up.
The script is now a step in the `lint` job, placed before the step it
verifies. It uses stubs, needs no Maven and takes about a second.
GuardsAreWiredTest asserts the wiring itself, because deleting a
workflow step is invisible to every other test here: each named guard
script must appear in a workflow and must exist on disk. It asserts
wiring, not correctness -- whether a script's own assertions are any good
is that script's business. The list is explicit rather than "every .sh
under scripts/", because most scripts there are tools a human runs and
requiring those in CI would be wrong; that limitation is stated in the
class comment rather than hidden.
Verified on the branch tip, not the merge result: fmt:check reports 278
files processed, 0 non-complying, matching main's baseline of 0. The
guard passes on main today (five cases, all ok). Removing the new step
turns GuardsAreWiredTest red; restoring it turns it green.
Closes #220.
Signed-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>
Closes #220.
#220 was filed during the relicence: the
lintrequired context was fail-open, because the formatting step's retry loop broke out of both arms on attempt 1, so a real violation printed "Code formatting check skipped" under a green tick.Most of that is already fixed, by #225, and this PR does not redo it. #225 separated the two failure modes so a violation fails immediately, reformatted the 39 files the change surfaced, and wrote
scripts/verify-formatting-gate.shto pin the fix — four cases, stubbed runners, sentinel-checked so a broken stub cannot pass silently, with its own anti-vacuity reasoning in the comments. It is a good script.Nothing runs it.
One file contains its name and that file is the script. So the property #220 was filed for is pinned on paper and unpinned in practice: the gate could regress to fail-open a second time and every board would stay green — the same failure the script was written to prevent, one level up.
What this changes
1. The script runs. A step in the
lintjob, placed before the step it verifies. It uses stubs, needs no Maven, and takes about a second. It passes onmaintoday:2.
GuardsAreWiredTestasserts the wiring itself, because deleting a workflow step is invisible to every other test in this repository. Each named guard script must appear in a workflow and exist on disk — the second half matters because a workflow referencing a deleted script fails in CI with a shell error rather than a diagnosis.It asserts wiring, not correctness. Whether a script's own assertions are any good is that script's business; wiring is the property that was missing and the one nothing else observes.
GUARD_SCRIPTSis an explicit list rather than "every.shunderscripts/". Most scripts there are tools a human runs — a code generator, a baseline refresher — and requiring those to run in CI would be wrong. A new guard has to be added to the list by hand. That is a real limitation and it is stated in the class comment rather than hidden; the alternative, inferring intent from a filename, is a guess that fails in both directions.Mutation proof
theWiringCheckCanActuallyFailcovers the vacuity direction: the wiring assertion is an absence across a set that is currently complete, so it would pass identically if the membership test never matched anything. That test runs the same predicate over a name no workflow will ever contain, and a positive control over one that is present.Verification
Run on the branch tip, not the merge result — this repository's formatter gate is armed now, and a green board is evidence about the merge ref rather than the tip:
mvn com.spotify.fmt:fmt-maven-plugin:check(plugin 2.29)Processed 278 files (0 non-complying)— matching main's baseline of 0mvn -B packageTests run: 1539, Failures: 0, Errors: 0./scripts/verify-formatting-gate.shon mainGuardsAreWiredTestNo source behaviour changes: the diff is one workflow step and one new test.
Skip-runtime-e2e justification
CI configuration and one test, no
src/mainchange. The diff is two workflow files, apluginManagementversion pin, one comment line in a shell script, one shell script line, and one test class. Nothing undersrc/main/is touched at all, so there is no runtime surface for an end-to-end suite to exercise.What this PR asserts is that a guard script is actually invoked by a workflow — a property about the repository's own CI configuration, which a runtime suite cannot observe. It is pinned instead by five mutants, including the two that killed the previous version of the test.
definition-of-done.ymldropseditedfrom its triggers, so this section is inert until the title carries the marker and a new push re-fires the gate.Not merged by me
Worker does not merge. Master runs the independent R3 and merges. No
ci:tier labels exist in this repository.