fix(self-deploy): drift-resilient checkout for #4914 — CI guard + accurate reference doc - #4926
Open
rysweet wants to merge 3 commits into
Open
Conversation
…iant (#4914) The self-deploy checkout wedged every Overseer cycle because the tracked .github/hooks/amplihack-hooks.json drifted, aborting 'git checkout --detach' with 'your local changes would be overwritten'. The reset-before-checkout repair shipped in #4878; this adds the durable CI regression guard for the drift *source*: - hooks_manifest_and_scripts_are_git_tracked: the manifest (and its hook scripts) must stay git-tracked — untracking/gitignoring is NOT the fix (SR-P1-2, supply-chain integrity). - hooks_dir_has_no_untracked_drift_in_a_clean_checkout: a fresh checkout must leave .github/hooks/ pristine, so a reappearing unconditional manifest rewrite turns CI red instead of silently re-wedging self-deploy. Skips cleanly outside a git work tree (vendored/packaged builds). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The self-deploy checkout wedged every Overseer cycle because a tracked-file drift (.github/hooks/amplihack-hooks.json, rewritten out-of-band each session) aborted 'git checkout --detach' with 'your local changes would be overwritten'. The code repair shipped in #4878 (reset+clean the disposable canonical checkout before checkout, fail-closed canonical-only gate) and its CI regression guard in #4914 (tests/self_deploy_hooks_tracked_invariant.rs). This adds the reference doc for that shipped fix. Zero-BS: the doc describes ONLY code that exists. It documents the shipped reset_source_tree scrub on both prepare paths, the double-canonicalized is_canonical_src_repo gate, the remove_stale_checkout clone-clean recovery, and the git-tracked / drift-free invariant test — and lists only the real tests in src/self_deploy/tests_source_prep.rs and the invariant target. No invented write_manifest_if_changed / checkout_detached_with_retry / gate_uncertain / dirty_retry symbols. Added to mkdocs nav for discoverability. Verified: cargo test --test docs_integrity (green), the 33 tests_source_prep tests (green), and the 2 hooks-tracked invariant tests (green). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…variant (#4914) CI's `clippy --all-targets --all-features` reds on `tracked_files.iter().any(|f| *f == MANIFEST_REL)` (manual_contains); the commit-stage `clippy --no-deps` (lib only) did not cover the test target. Use the idiomatic `Vec::contains` so the branch's #4914 regression guard is clippy-clean under the full CI gate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (#4914)
Self-deploy checkout wedged every Overseer cycle for hours, leaving the running binary commits behind merged
mainand firingProcessHealthooda.log tail contains recent ERROR line(s). Root cause:A prior deploy left the disposable canonical checkout with a locally-modified tracked file (
.github/hooks/amplihack-hooks.json, rewritten out-of-band each session), which abortsgit checkout --detach <merged_sha>— a self-reinforcing wedge.What shipped where
main, [creative-idea] Add a self-deploy pre-flight that verifies the running binary path is present and readable before the backup snapshot, and re-execs from the installed path first when the inode has been unlinked by a previous swap. #4878):reset_source_tree(git reset --hard+git clean -fd, never-x) runs beforecheckout --detachon both the fetch and skip-fetch prepare paths, strictly gated to the canonical throwaway checkout by a double-canonicalizedis_canonical_src_repo(fail-closed — aSIMARD_SELF_DEPLOY_REPOoverride is never scrubbed).remove_stale_checkoutrecovers an absent/invalid checkout by re-cloning pristine.tests/self_deploy_hooks_tracked_invariant.rs— CI regression guard:.github/hooks/stays git-tracked and a clean checkout carries no untracked drift (a reappearing unconditional manifest rewrite reds CI instead of silently re-wedging).docs/reference/self-deploy-drift-resilient-checkout.mddescribing only the shipped code (added to mkdocs nav + index.md).manual_contains) in the invariant test so the full--all-targetsCI gate is clean.Zero-BS note
The reference doc documents only symbols and tests that exist. Earlier draft artifacts describing non-existent
write_manifest_if_changed/checkout_detached_with_retry/gate_uncertain/dirty_retrysymbols, and out-of-scope docs for separate issues (overseer OODA self-healing, PR-dedup pre-flight), were removed from this branch.Verification
cargo test --test docs_integrity— green (links + nav integrity)self_deploy::tests_source_preptests — green (dirty-tree reset, skip-fetch path, warm-dir preservation, override-not-reset gate)self_deploy_hooks_tracked_invarianttests — greenclippy --all-targets --all-features --locked -D warnings— greenClosing #4914 itself is an operational Overseer action.
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com