From 834e62bbf38ea71e003e73680c5618f62de12aea Mon Sep 17 00:00:00 2001
From: chodeus <dhoges90@icloud.com>
Date: Tue, 11 Aug 2026 18:33:48 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20develop-invariant=20guard=20?=
 =?UTF-8?q?=E2=80=94=20pure-insertion=20Dockerfile=20check,=20not=20byte-p?=
 =?UTF-8?q?refix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CL2K blocks are inserted mid-file (per build stage), which the documented
invariant allows (pure-insertion hunks). The byte-prefix check false-failed
every develop-bound ref, blocking the sync PR and develop image publishing.
---
 .github/workflows/codeql-lint.yml | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/codeql-lint.yml b/.github/workflows/codeql-lint.yml
index 805e6fc6..32b369b2 100644
--- a/.github/workflows/codeql-lint.yml
+++ b/.github/workflows/codeql-lint.yml
@@ -279,21 +279,17 @@ jobs:
             | grep -Ev '^A[[:space:]]' \
             | grep -Ev '^M[[:space:]]+deploy/docker/Dockerfile$' || true)
           if [ -n "$bad" ]; then
-            echo "::error::develop diverges from main beyond added files + an append-only Dockerfile:"
+            echo "::error::develop diverges from main beyond added files + an insertion-only Dockerfile:"
             echo "$bad"
             exit 1
           fi
-          # Append-only = main's Dockerfile is an exact byte-PREFIX of develop's; a
-          # mid-file insertion adds no `-` line, so a diff `^-` check would miss it.
-          base="$(git merge-base origin/main HEAD)"
-          base_df="$(mktemp)"
-          git show "$base:deploy/docker/Dockerfile" > "$base_df"
-          n=$(wc -c < "$base_df")
-          if ! head -c "$n" deploy/docker/Dockerfile | cmp -s "$base_df" -; then
-            echo "::error::deploy/docker/Dockerfile is not append-only vs main (mid-file edit or removal); develop must only append CL2K layers."
+          # Pure-insertion hunks: no main line removed or edited. CL2K blocks are
+          # inserted MID-FILE (per build stage), so a byte-prefix check would false-fail.
+          if git diff origin/main...HEAD -- deploy/docker/Dockerfile | grep -q '^-[^-]'; then
+            echo "::error::deploy/docker/Dockerfile removes or edits lines present on main; develop may only insert CL2K blocks."
             exit 1
           fi
-          echo "OK: develop differs from main only by added files + append-only Dockerfile."
+          echo "OK: develop differs from main only by added files + an insertion-only Dockerfile."
 
   # ---- Docker Build (gated by all quality checks) ----
   docker-validate: