From a6df06c3494106a154767d3abf3aea720202c22c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 21:34:05 +0900 Subject: [PATCH 1/2] test(ci): require full verification on stacked pull requests --- scripts/test_ci_workflow_stack_coverage.py | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 scripts/test_ci_workflow_stack_coverage.py diff --git a/scripts/test_ci_workflow_stack_coverage.py b/scripts/test_ci_workflow_stack_coverage.py new file mode 100644 index 00000000..8a3af8b7 --- /dev/null +++ b/scripts/test_ci_workflow_stack_coverage.py @@ -0,0 +1,24 @@ +from pathlib import Path + + +REPOSITORY_ROOT = Path(__file__).resolve().parents[1] +CI_WORKFLOW = REPOSITORY_ROOT / ".github" / "workflows" / "ci.yml" + + +def test_ci_runs_for_every_pull_request_base() -> None: + """Stacked pull requests must receive the same exact-head CI as main-bound PRs.""" + workflow = CI_WORKFLOW.read_text(encoding="utf-8") + + assert " pull_request: {}" in workflow + assert " pull_request:\n branches: [main]" not in workflow + + +def test_ci_preserves_exact_head_and_synthetic_merge_evidence() -> None: + """Broadening PR coverage must not weaken exact-head or merge verification.""" + workflow = CI_WORKFLOW.read_text(encoding="utf-8") + + exact_head_expression = "github.event.pull_request.head.sha || github.sha" + assert workflow.count(exact_head_expression) >= 4 + assert 'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"' in workflow + assert "name: Maven merge compatibility" in workflow + assert "name: Buyer-readiness script tests" in workflow From c1239e20b048a582b19cb9eeb90f2c29f7c8f814 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 6 Aug 2026 21:34:39 +0900 Subject: [PATCH 2/2] fix(ci): verify stacked pull requests without weakening gates --- .github/workflows/ci.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 52499d2b..6bbdcb0a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,8 +3,9 @@ name: CI on: push: branches: [main] - pull_request: - branches: [main] + # Every pull request target, including immutable stack branches, receives the + # same exact-head, synthetic-merge, and buyer-readiness acceptance evidence. + pull_request: {} permissions: contents: read