fix(ci): stop Telegram release checks from fetching history (#105219)

* fix(ci): bound Telegram provenance lookups

* docs(agents): note linked worktree invocations
This commit is contained in:
Peter Steinberger
2026-07-12 10:18:39 +01:00
committed by GitHub
parent 25f00f9881
commit 4efe056d32
3 changed files with 69 additions and 45 deletions
@@ -211,9 +211,6 @@ describe("release Telegram QA workflow", () => {
const source = readFileSync(WORKFLOW_PATH, "utf8");
expect(source.match(/associatedPullRequests\(first:10\)/gu)).toHaveLength(2);
expect(source.match(/for-each-ref --format='%\(refname\)' 'refs\/tags\/v\*'/gu)).toHaveLength(
2,
);
expect(source.match(/if \.signature == null then "missing"/gu)).toHaveLength(2);
expect(source.match(/\$signature_status" == "invalid"/gu)).toHaveLength(2);
expect(
@@ -226,13 +223,28 @@ describe("release Telegram QA workflow", () => {
2,
);
expect(source.match(/collaborators\/\$\{permission_actor\}\/permission/gu)).toHaveLength(2);
expect(
(source.match(/refs\/remotes\/origin\/extended-stable/gu) ?? []).length,
).toBeGreaterThanOrEqual(2);
expect((source.match(/extended-stable\/\[0-9\]/gu) ?? []).length).toBeGreaterThanOrEqual(2);
expect(source).not.toContain("collaborators/${signer}/permission");
});
it("resolves only candidate-specific provenance refs without fetching histories", () => {
const source = readFileSync(WORKFLOW_PATH, "utf8");
expect(source.match(/branches-where-head/gu)).toHaveLength(2);
expect(source.match(/gh api --paginate/gu)).toHaveLength(2);
expect(
source.match(/git(?: -C \.candidate)? ls-remote --exit-code --refs origin/gu),
).toHaveLength(2);
expect(
source.match(/git(?: -C \.candidate)? ls-remote origin 'refs\/tags\/v\*'/gu),
).toHaveLength(2);
expect(source).not.toContain("'+refs/heads/release/*:refs/remotes/origin/release/*'");
expect(source).not.toContain(
"'+refs/heads/extended-stable/*:refs/remotes/origin/extended-stable/*'",
);
expect(source).not.toContain("'+refs/tags/v*:refs/tags/v*'");
});
it("dispatches one accepted trusted-main child from release checks", () => {
const releaseSource = readFileSync(RELEASE_CHECKS_PATH, "utf8");
const reusableSource = readFileSync(WORKFLOW_PATH, "utf8");