fix(tests): the signing pins assert the guarantee where #558 moved it, and one they missed - #559
Merged
Conversation
…, and one they missed `main` is red because I merged #558 without running the suite. Three tests in `test_desktop_packaging.py` assert the signing gates by looking for `secrets.X != ''` inside each step's `if:` -- the exact expression #558 had to remove, because GitHub rejects `secrets` in an `if:` at parse time. The GUARANTEE is unchanged and is still pinned: all five Apple credentials or none, both Windows credentials or none, and each skip notice firing on the exact complement of its sign step. What moved is where that is decided -- from four `if:` conditions into one `signing` step whose outputs the conditions read -- so the assertions move with it. ── AND A PIN FOR THE FAILURE THESE TESTS COULD NOT SEE ──────────────────────── The old tests asserted that a string appeared in a condition. That says nothing about whether GitHub can PARSE the file, which is why they were green for the three days the workflow was undispatchable. Two new pins close that: * no `secrets` in any `if:`, in any job or step -- the thing that made the whole workflow invalid; * no signing credential in a job-level `env:` -- the obvious fix for the first one, and the wrong one, because it exposes every certificate to `uv sync`, the PyInstaller build and every other step in the job. All three are mutation-checked: restoring a secret to an `if:` fails two tests, dropping one credential from the gate fails a third, and hoisting a secret to job-level env fails the fourth. ── THE PROCESS FAILURE, RECORDED ────────────────────────────────────────────── I validated #558's YAML, checked its structure, and let GitHub's own parser confirm the fix -- and did not run `pytest`, because it was "only a workflow file". This repository pins its workflows WITH tests; that is the whole reason those three existed. The suite is not optional on a workflow change here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T6yA5khYnJ2qzheArRToQ2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainis red because I merged #558 without running the suite. This fixes it.What broke
Three tests in
tests/test_desktop_packaging.pyassert the signing gates by looking forsecrets.X != ''inside each step'sif:— the exact expression #558 had to remove, becauseGitHub rejects the
secretscontext in anif:at parse time.The guarantee is unchanged and still pinned: all five Apple credentials or none, both Windows
credentials or none, and each skip notice firing on the exact complement of its sign step. What
moved is where that is decided — from four
if:conditions into onesigningstep whose outputsthe conditions read — so the assertions move with it.
And a pin for the failure these tests could not see
The old tests asserted that a string appeared in a condition. That says nothing about whether
GitHub can parse the file, which is exactly why they stayed green for the three days the
workflow was undispatchable. Two new pins close that gap:
secretsin anyif:, in any job or step — the thing that made the whole workflowinvalid.
env:— the obvious fix for the first one, and thewrong one, because it exposes every certificate to
uv sync, the PyInstaller build, and everyother step in the job. That is the exposure the
signingenvironment exists to prevent.Verification
Full suite green (4274 passed, 3 skipped), ruff and mypy clean.
All three pins mutation-checked — a test that cannot fail is not a pin:
secrets.WINDOWS_CERT_PASSWORD != ''to anif:APP_STORE_CONNECT_ISSUER_IDfrom the gate stepMACOS_CERT_PASSWORDto job-levelenv:The process failure, recorded
I validated #558's YAML, checked its structure, and let GitHub's own parser confirm the fix — and
did not run
pytest, because it was "only a workflow file". This repository pins its workflowswith tests; that is the entire reason those three existed. The suite is not optional on a
workflow change here, and I'll treat it that way.
🤖 Generated with Claude Code
https://claude.ai/code/session_01T6yA5khYnJ2qzheArRToQ2