Skip to content

Read a number qualified with another repository as that repository's - #156

Merged
iderex merged 1 commit into
mainfrom
ci/a-qualified-reference-is-not-ours
Aug 17, 2026
Merged

Read a number qualified with another repository as that repository's#156
iderex merged 1 commit into
mainfrom
ci/a-qualified-reference-is-not-ours

Conversation

@iderex

@iderex iderex commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

The issue this belongs to

Closes #155

What changed

issue_refs in .github/pr-hygiene/hygiene.sh took anything after a hash as an
issue on this board. It now reads the qualifier in front of the number and
compares it. Equal to the repository being judged, the number is ours. Different,
it is not. Absent, the reference is bare and is read exactly as before, so a
qualifier with no slash in it is not a repository and issue#12 in a sentence
stays what it was.

Failing closed on a bare number that does not resolve is unchanged. That one is a
claim about this board and a lookup that could not be made is still an error.

What failure it prevents

The check refusing evidence for containing evidence. A claim here carries the
command that produced it, and a body could not paste a command whose output named
an issue on another repository, because every hash-then-digits in a body was a
question about this one.

This is a guard, so what it refuses and the proof it bites are below rather than
here.

What a guard here refuses, and the proof it bites

It refuses reading owner/repo#123 as an issue on this repository, while still
reading #123 and Flowfin/core#123 as ones.

Five fixtures were added, and each direction of the condition has one that reddens
when its clause is deleted.

Removing the qualifier condition entirely, so every number is read as before:

sed 's|if (index(qualifier, "/") == 0 || qualifier == self) {|if (1) {|' .github/pr-hygiene/hygiene.sh > /tmp/h-a.sh
bash /tmp/h-a.sh selftest
FAIL  bites: a number qualified with another repository
        expected:
        actual:   263
FAIL  passes: a bare reference beside a qualified one, which is what pasted evidence looks like
        expected: 83|151
        actual:   83|151|263
FAIL  bites: an address whose fragment is digits
        expected:
        actual:   12

Removing only the comparison against the repository being judged, so every
qualified reference is passed over including this board's own:

sed 's|if (index(qualifier, "/") == 0 || qualifier == self) {|if (index(qualifier, "/") == 0) {|' .github/pr-hygiene/hygiene.sh > /tmp/h-b.sh
bash /tmp/h-b.sh selftest
FAIL  passes: the same number qualified with the repository being judged
        expected: 151
        actual:

And the file as it stands:

bash .github/pr-hygiene/hygiene.sh selftest
ok    bites: the template's own reference, with no number after the hash
ok    passes: the same body one character longer
ok    passes: named without a closing keyword, which is this board's practice
ok    bites: a reference only inside an HTML comment
ok    bites: a heading is not a reference
ok    passes: several issues, deduplicated and in order
ok    bites: a number qualified with another repository
ok    passes: the same number qualified with the repository being judged
ok    passes: a bare reference beside a qualified one, which is what pasted evidence looks like
ok    bites: an address whose fragment is digits
ok    passes: a word before the hash that is not a repository

Run at the commit being pushed, abab7d58d36b3ebcae742856f52aa8ededcfc844.

Evidence

The body you are reading is the end-to-end proof, and it is deliberate. This
sentence names Flowfin/jellyfin-plugin-sso#263, which is the number that stopped
the run on the earlier pull request. The check on this pull request reads the
merge ref, so the code being judged is the code in this change; a green
names-an-issue here is that reference being read as somebody else's rather than
looked up as ours.

The failing run this is written against, with its numbers elided because the
sentence around them is a description of the problem rather than a reference:

gh run view 31998919414 --repo Flowfin/core --log-failed | grep -E 'Could not read|Process completed' | sed 's/^.*Z //' | sed 's/#[0-9][0-9]*/#N/g'
##[error]Could not read issue #N. The scope comparison cannot be made, and this run will not pass in place of it.
##[error]Process completed with exit code 1.

What that run read out of the body, from the run on the body one edit before
this sentence was added to it:

gh run view 32000361612 --repo Flowfin/core --log | grep 'Prove the rules' | sed 's/^.*Z //' | grep 'ok    names:'
ok    names: 12 123 155

Three numbers, and 263 is not among them. The two illustrative ones are read
because they are written bare in the paragraph above, and 155 is the issue this
belongs to.

The other check on this machine is untouched by this change and still green:

bash .github/doc-paths/doc-paths.sh check >/dev/null; echo "exit=$?"
exit=0

What this does not cover

The awk on this machine is gawk and the awk on the runner is mawk, so the fixtures
above were proven under one of the two here. The selftest runs on the runner
before the check judges anything, so the run on this pull request is where the
other one is proven, and I did not install a second awk to prove it locally.

body_prose splits on a slash and therefore still reads a qualified reference as
prose rather than as a reference-only line. That is a different rule with a
different purpose, a line that is only a reference is not the case this change is
about, and I have not touched it.

The rule still cannot tell a number quoted inside pasted output from one written
as a claim, where both are bare. Nothing here reaches that, and the elision above
is what a body carrying such a paste still has to do.

Who has read it

Nobody other than me. The evidence above stands in place of a second reader
rather than the question being left open.

The hygiene check took anything after a hash as an issue on this board, looked it
up, and failed closed when it did not resolve. A body quoting another
repository's issue number was therefore refused whatever the sentence around it
said, and so was a body pasting the output of a command that happened to contain
one. It bit once, on the pull request whose evidence was a grep over
.github/workflows while three of the references there named another repository.

The qualifier in front of a number is now read and compared. Equal to the
repository being judged, the number is ours. Different, it is not. Absent, the
reference is bare and is read exactly as before, so a qualifier with no slash in
it is not a repository and issue#12 in a sentence stays what it was. Failing
closed on a bare number that does not resolve is unchanged, because that one is a
claim about this board.

Five fixtures, and each direction has one that reddens when its clause is
deleted. Removing the qualifier condition entirely reddens the three that ask for
a qualified reference and an address fragment to be passed over. Removing only
the comparison against the repository being judged reddens the one that asks for
this board's own qualified reference to be read.

The qualifier is walked out character by character against a literal set rather
than cut off with a regular expression. The obvious form, a sub over a negated
class anchored at the start, matches nothing at all under one of the two awks
this file already warns about, which was found by watching the fixture for a
mixed line drop a reference it should have kept.

Prevents the check refusing evidence for containing evidence. A claim here
carries the command that produced it, and a body could not paste one whose output
named an issue somewhere else.

Closes #155

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
@iderex
iderex merged commit ee1820b into main Aug 17, 2026
10 checks passed
@iderex
iderex deleted the ci/a-qualified-reference-is-not-ours branch August 17, 2026 06:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Read a reference to another repository as one, rather than as an issue here that does not exist

1 participant