Repository navigation
ci(manifest): drift sensor for registry↔manifest - #60
Conversation
manifest-sync's push is blocked by branch protection (GH006), so registry->manifest divergence was only visible when someone regenerated by hand. Add a PR-time drift-check job that re-exports the registry and byte-diffs it against the committed manifest. Runs on every PR because registry-side drift arrives without touching this repo. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| schedule: | ||
| - cron: "44 7 * * 2" # Tuesdays 07:44 UTC | ||
| workflow_dispatch: | ||
| pull_request: # drift sensor — the sync job can't push to protected main |
There was a problem hiding this comment.
🟡 Registry drift escapes green pull requests
When the registry changes after a PR passes, drift-check does not rerun. The PR can merge a stale manifest, and protected main blocks the weekly sync from correcting it.
Learn more
The PR check compares the manifest with the registry only when a pull-request event starts the workflow. A later registry commit produces no event in this repository, so the existing green check remains valid. The weekly sync job attempts to push the new manifest, but protected main rejects its push. A PR can therefore merge after the registry changes without anyone seeing a failed drift check.
Example: A PR passes at 09:00 against registry v30. The registry advances to v31 at 10:00 without changes to the PR. The PR merges at 11:00 with its green check and v30 manifest, despite v31 being current.
Recommended fix: Add a registry-triggered mechanism that checks this repository when the upstream registry changes, and ensure the merge gate uses a fresh check or a PR updating the manifest. A scheduled check alone cannot invalidate a previously green PR check without a corresponding gating mechanism.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Addressed in efd1d65 — the sync job no longer pushes to protected main (the GH006 dead letter). It now opens or refreshes a chore/manifest-sync PR via PR_BOT_TOKEN, so registry drift flows through the reviewed channel. Combined with drift-check: stale manifests go red on new PRs, and drift arriving after a green PR still produces a fix PR rather than waiting for manual regen.
There was a problem hiding this comment.
Fixed in 0a20576 — checkout uses PR_BOT_TOKEN so pushes trigger CI on refreshed PRs, token absence fails closed, and the pr-list result is captured before branching (a failed lookup can no longer strand the push). Static coverage added in test_manifest_sync.py.
There was a problem hiding this comment.
The residual window is documented on the trigger comment (latest push): post-green registry drift cannot invalidate a merged-ready check, but it also cannot persist — the weekly sync now opens a fix PR instead of hitting GH006, so stale manifests get corrected through the same reviewed channel within one cycle.
GH006 made the sync a dead letter — drift could only reach main through manual regen. The job now pushes chore/manifest-sync and opens (or refreshes) a PR via PR_BOT_TOKEN, so registry changes flow through the reviewed channel like any other change. Pairs with drift-check: PRs see stale manifests red, and the weekly sync produces a fix PR instead of failing silently. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Two bugs in the sync-PR leg: the branch push used the checkout's GITHUB_TOKEN (CI never runs on those pushes, so a refreshed sync PR would carry unchecked commits), and a failed `gh pr list` inside the condition took the "already open" path, stranding the push. Checkout now uses PR_BOT_TOKEN, the token is asserted non-empty, and the lookup is captured before the branch. Structural tests pin all of it. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
1 participant
Summary
manifest-synccan't push to protectedmain(GH006, pre-existing) — registry→manifest divergence was only caught by manual regendrift-checkjob runs on every PR: re-exportsdevin-powerups/registry.jsonand byte-diffs against the committedmanifest.json; fails with the regen command on divergenceTest plan
Generated with Devin