What
The PR-comment upsert step in action.yml (still using gh api -f body=@$BODY until #2 lands) is only covered by the composite-smoke job, which runs on push events. The if: github.event_name == 'pull_request' guard means the PR-comment path is never exercised in CI — bugs in that path slip through until a real live PR.
That's how the body-as-literal-string bug (#2) survived from v0.1.0 to v0.1.1.
Why it matters
The PR comment + paste-back approval snippet IS the wedge versus competing hash-pinning tools. A regression in this path silently destroys the differentiator. We need an actual CI gate.
Fix sketch
Two options, pick one:
(a) Synthetic PR fixture. A workflow_dispatch job that opens a self-PR against a ci-fixture/* branch, runs the composite, asserts the comment posted contains the expected marker and at least one capability-delta row, then closes the PR.
(b) Mock the gh API. Wrap the upsert step so its gh api calls go through a thin shim that can be intercepted in CI. Less faithful but cheaper.
Recommend (a). It's slightly heavier but tests the real path including auth + permissions.
Acceptance
composite-smoke (or a new job) fails if the PR comment posts as a literal @/path/... string or any other malformed body.- Fails fast (< 90 s) so it can run on every PR.
Linked to: #2 (fixes the latent bug); this issue prevents the next one.
What
The PR-comment upsert step in
action.yml(still usinggh api -f body=@$BODYuntil #2 lands) is only covered by thecomposite-smokejob, which runs onpushevents. Theif: github.event_name == 'pull_request'guard means the PR-comment path is never exercised in CI — bugs in that path slip through until a real live PR.That's how the body-as-literal-string bug (#2) survived from v0.1.0 to v0.1.1.
Why it matters
The PR comment + paste-back approval snippet IS the wedge versus competing hash-pinning tools. A regression in this path silently destroys the differentiator. We need an actual CI gate.
Fix sketch
Two options, pick one:
(a) Synthetic PR fixture. A
workflow_dispatchjob that opens a self-PR against aci-fixture/*branch, runs the composite, asserts the comment posted contains the expected marker and at least one capability-delta row, then closes the PR.(b) Mock the gh API. Wrap the upsert step so its
gh apicalls go through a thin shim that can be intercepted in CI. Less faithful but cheaper.Recommend (a). It's slightly heavier but tests the real path including auth + permissions.
Acceptance
composite-smoke(or a new job) fails if the PR comment posts as a literal@/path/...string or any other malformed body.Linked to: #2 (fixes the latent bug); this issue prevents the next one.