Conversation
COMMUNITY_EXPORT_MANIFEST.json binds every file under services/api/ to its digest, so any change there fails the audit until the manifest is rewritten. The failure named the path and nothing else, and no command in the repository produced the new manifest — the only way was to reimplement its hashing by hand. That is not a hypothetical: every dependency update touching pyproject.toml or uv.lock fails this way, and five open Dependabot pull requests are sitting on exactly this error right now. Dependabot cannot rewrite a manifest it knows nothing about. The audit gains --refresh-manifest, and the failure names it. The refresh runs every other gate first — secrets, hosted boundary, forbidden artifacts, route and table counts, packaging, runtime — and records the tree only once they pass. It can therefore record new hashes but never grant approval to a tree the audit rejects. It prints which entries it added, changed or removed, so a reviewer sees what was recorded rather than a wall of digests. Signed-off-by: L4XB <L4XB@users.noreply.github.com>
|
Thanks for the pull request. One required step is still open, and it is not one Contributor License Agreement. This project records acceptance as a public The Two further gates apply to every contribution and are described in |
|
I have read and agree to the SixSentences CLA v1.0. |
1 participant
The problem, concretely
Five Dependabot pull requests are red right now, all with the same failure:
COMMUNITY_EXPORT_MANIFEST.jsonbinds every file underservices/api/to itsdigest. A dependency bump rewrites
pyproject.tomlanduv.lock, so the auditrefuses the tree — correctly. But the message named a path and nothing else, no
command in the repository produced a new manifest, and Dependabot cannot write
one it knows nothing about. The only way through was to reimplement the hashing
by hand, which is what happened on every change to this tree so far.
What changes
--refresh-manifestrewrites the manifest for the current tree, and the failuremessage names it.
The ordering is the point: the refresh runs every other gate first — secret
and private-marker scan, hosted-boundary markers and symbols, forbidden
artifacts, the CodeQL regression guards, packaging, and the runtime contract of
400 HTTP operations, one WebSocket and 89 tables. Only once all of them pass
does it record the tree. It can therefore record new hashes, but it can never
grant approval to a tree the audit rejects.
It prints what it recorded rather than a wall of digests:
What it does not change
The manifest still carries
source_commit, still binds the exact file set, andthe release workflow still runs the audit in its verifying form. Whether a
per-pull-request digest binding is the right gate for a repository that now
takes contributions is a separate question, and this does not answer it — it
only makes the existing gate satisfiable by the person who tripped it.
Validation
Three new tests cover the failure message naming the fix, the refresh reporting
its own additions and changes, and the export identity surviving a refresh.
ruffis clean and the audit passes in its normal form.