Pin split_tests to a checksummed release + auto-bump workflow - #12
Merged
Conversation
action.yml previously fetched split_tests from /latest/download/ on every run, unauthenticated and unpinned - two runs of the same workflow could silently execute different splitting logic with no corresponding commit in this repo. - Pin to split_tests v0.5.0 and verify a sha256 checksum before use; the install step now fails loudly (with the actual hash) on a mismatch instead of accepting whatever the URL currently serves. - Add .github/workflows/bump-split-tests.yaml: a weekly scheduled (+ workflow_dispatch) workflow that checks upstream for a new release, downloads and hashes it, and opens a PR updating both SPLIT_TESTS_VERSION and SPLIT_TESTS_SHA256 together. A plain Dependabot/Renovate version bump can't compute a checksum for an arbitrary release binary, so this is a small purpose-built workflow instead - no third-party Action dependency, just git/gh, both preinstalled on GitHub-hosted runners.
…on-and-renovate # Conflicts: # action.yml
scruplelesswizard
added a commit
that referenced
this pull request
Jul 31, 2026
Adds smoke-test-correctness: runs the default file-count split across all three split-index values with split-total=3, then asserts partitions are non-empty, pairwise disjoint, and their union covers the full glob exactly. Closes the repo's own long-standing 'Test output for correctness' TODO. Its own CI run also caught two real regressions along the way (JUnit ruby-version bug from #6 -> fixed in #17; gunzip overwrite bug from #12 -> fixed in #18).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up from the maintainer audit in REVIEW.adoc — closes the "unpinned
/latest/download/fetch" architectural finding, and adds the automated-bump mechanism requested alongside it.The problem:
action.ymlfetchedsplit_testsfrom/latest/download/on every single run, unauthenticated and with no integrity check. Two runs of the identical caller workflow, a week apart, could execute two different versions of the actual splitting logic with no corresponding commit in this repo — the pinned@v1tag on this action wasn't actually a reproducible artifact.The fix:
action.ymlnow pinsSPLIT_TESTS_VERSIONto a specific release (v0.5.0) and verifies aSPLIT_TESTS_SHA256checksum before treating the download as usable. A mismatch fails the job loudly and prints the actual hash, rather than silently accepting whatever the URL happens to serve..github/workflows/bump-split-tests.yaml: runs weekly (and on-demand viaworkflow_dispatch), checks the upstream repo's latest release, and — if it's newer — downloads it, computes the checksum itself, and opens a PR bumping bothSPLIT_TESTS_VERSIONandSPLIT_TESTS_SHA256together.Why not Dependabot/Renovate: both are excellent at bumping a version string, but neither can compute a sha256 for an arbitrary GitHub release binary asset — that's not something their datasources expose. A Renovate regex manager could auto-bump the version and leave the checksum for a human to paste in, which defeats the point of pinning by checksum in the first place. This workflow does both atomically, using only
git/gh(already on every GitHub-hosted runner) — no new third-party Action dependency.Once #10 (ARM64 support) is ready to move forward, its per-arch download logic should layer on top of this pinning approach rather than reverting to an unpinned fetch.