Skip to content

Fail fast on bad inputs and harden PR metadata fetching - #3

Merged
lm-sousa merged 3 commits into
mainfrom
t3code/harden-resolver
Sep 4, 2026
Merged

lm-sousa merged 3 commits into
mainfrom
t3code/harden-resolver

Conversation

@lm-sousa

@lm-sousa lm-sousa commented Sep 4, 2026

Copy link
Copy Markdown
Member

Same changes as #2, which was accidentally merged into the stale t3code/fix-stacked-branch-resolver branch instead of main; this PR targets main directly.

The resolver had several silent failure modes: a shallow source checkout (missing fetch-depth: 0) made it quietly resolve dependencies against terminal branches, a dependency repository lacking the root branch aborted the entire run even though its evidence was optional, duplicate output prefixes silently overwrote each other, and a failed PR metadata fetch (network blip, missing tooling, restricted token) degraded without explanation and surfaced later as a confusing ambiguity error.

This makes the resolver fail loudly and cheaply instead:

  • Fail fast when the source directory is not a usable git repository (shallow clone hint included).
  • Skip evidence from dependency repositories without the root branch instead of aborting.
  • Reject duplicate output prefixes at parse time.
  • Retry PR fetches with a timeout, write response bodies to a file so retry attempts stay parseable, and warn with the HTTP status; 403/404 point at the pull-requests: read permission.
  • Ambiguity errors list the required stack levels; terminal fallbacks log why they triggered.
  • CI runs shellcheck; tests cover the shallow, no-root and duplicate-prefix cases.

A shallow source checkout could silently resolve dependencies against
terminal branches, and a dependency lacking the root branch aborted the
whole run even though its evidence was optional. The PR metadata fetch
also degraded silently on network errors or missing token permissions.

Fail fast when the source is a shallow clone, reject duplicate output
prefixes, skip evidence from dependencies without the root branch, and
retry PR fetches with a timeout while reporting the HTTP status.
Ambiguity errors now list the required stack levels, terminal fallbacks
log why, and CI runs shellcheck. Tests cover the shallow, no-root and
duplicate-prefix cases.
With curl --retry, the bodies of failed attempts remain concatenated in
captured stdout, so a successful retry parsed as HTTP 200 with a body jq
could not read and PR evidence was discarded. curl truncates the -o
output file on every attempt, so capture the body there and the final
status code on stdout.
@lm-sousa
lm-sousa merged commit 59ead01 into main Sep 4, 2026
4 checks passed
@lm-sousa
lm-sousa deleted the t3code/harden-resolver branch September 4, 2026 15:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant