Repository navigation
test(ci): scope trusted-publishing guards to the owning job (#332) - #364
Merged
Merged
Conversation
…e step TrustedPublishingWorkflowTests still read StepWithId/StepCondition against the whole workflow file, so a claim about the nupkg job's login step could be answered by the release-please job and a legal duplicate id/name across the two jobs would redden the suite (#302). Give it the job scoping #255 already gave TestReportingTests: JobOf resolves the owning job via WorkflowSource.JobsOf, and the step helpers hold every claim against that slice, naming the (workflow, job) pair on failure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
TryStepNamed and StepWithId's remarks pointed the "a whole-file scope can see two legitimate matches from two different jobs" caveat at #198, which never accepted the job-scoping work — it created this test file but does not own scoping it. #332 finished that scoping, so repoint both remarks at it and note that no in-repo caller now passes a whole file to either step scan. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…-publishing-guards-to-job
phmatray
marked this pull request as ready for review
September 23, 2026 18:10
TryStepNamed's remark said "no in-repo caller passes a whole file to either step scan any more" and then, one sentence later, "WorkflowSourceTests does pass whole files" — contradicting itself. Scope the first claim to guard suites (WorkflowSourceTests exists to test the reader directly, not to guard a workflow, so it deliberately keeps the whole-file risk). Also fixes a garbled clause in the same paragraph and tightens TrustedPublishingWorkflowTests' overload description. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
phmatray
deleted the
feat/332-scope-trusted-publishing-guards-to-job
branch
September 23, 2026 18:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #332.
Summary
TrustedPublishingWorkflowTestsasserted its claims against the wholerelease-please.ymlfile, even though the file has two jobs(
release-please,nupkg). #255 already gave the siblingTestReportingTestsjob-scoping throughWorkflowSource.JobsOffor exactlythis reason — a file-wide scan can't tell which job a matched step belongs
to, and since #302 made an ambiguous match loud, a legal duplicate
id:orname:across the two jobs would redden the suite on a valid workflow. ThisPR gives
TrustedPublishingWorkflowTeststhe same scoping.JobOf(workflowFile, jobName), resolving a job's slice viaWorkflowSource.JobsOfand asserting it exists.StepWithId/StepConditionnow take ajobNameand hold every claimagainst that job's slice, naming the
"<workflow> / <job>"pair onfailure.
"nupkg"— the job carryingid: login.ReleaseWorkflow_Step_Lookup_Should_Be_Scoped_To_The_Owning_Job,pinning that the
release-pleasejob'sid: releasestep is notreachable when the scope is
nupkg.id: loginstep to therelease-pleasejob — the suite stayed green(the duplicate is outside the
nupkgscope) — then reverted.#198cross-references inWorkflowSource.cs(
TryStepNamed,StepWithIdremarks) at TrustedPublishingWorkflowTests still asserts file-wide, so a claim can be answered by the wrong job #332, since Prove NuGet Trusted Publishing end-to-end and retire the long-lived NUGET_API_KEY #198 never ownedthis work despite being cited three times.
No workflow file,
build/Build.cs, or library code changed — testinfrastructure only, and every existing assertion's claim is unchanged;
only the text it is held against is scoped.
Test plan
dotnet build -c Release— 0 warnings, 0 errorsFormCraft.UnitTestsCinamespace (103 tests) — green./build.sh Format— clean (CI gate)dotnet test -c Release— all three assemblies green (888 + 163 + 588,1 skipped, 0 failed)
🤖 Generated with Claude Code