From 2df4872312b6fe32795141a7db24c2b58e102d35 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sun, 1 Nov 2026 08:31:16 -0800 Subject: [PATCH] quest: plan rebuilding conflicted lockfiles from the base's copy A land fixer merge on moq-dev/moq#7318 rebuilt bun.lock from the PR's side, undoing main's glob/minimatch advisory fix (moq-dev/moq#7443). Plan the fixer prompt rule that starts from the base's lockfile and regenerates with the package manager. Co-Authored-By: Claude Opus 5.5 --- quest/m0/land-fixer/README.md | 8 ++++- quest/m0/land-fixer/lockfile.md | 56 +++++++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 quest/m0/land-fixer/lockfile.md diff --git a/quest/m0/land-fixer/README.md b/quest/m0/land-fixer/README.md index 73786284..f7f05f65 100644 --- a/quest/m0/land-fixer/README.md +++ b/quest/m0/land-fixer/README.md @@ -12,7 +12,8 @@ before anything else happens. The gate merges locally instead of trusting GitHub's mergeability, reruns a failed module before blaming, and disables a flaky test with a follow-up quest. The fixer builds and tests with access to package registries, edits protected paths when the edit is -mechanical, and spends a pick's single attempt only on a fix that failed. +mechanical, rebuilds a conflicted lockfile from the base's copy, and spends +a pick's single attempt only on a fix that failed. When GitHub refuses its push to a fork, it hands back a ready commit. Non-goals: design conflicts. A PR whose merge needs a behavior decision is @@ -60,6 +61,10 @@ Decision prompts, selected options marked ✅: disables auto-merge. [Batch triage](/quest/m0/land-fixer/triage.md) and [Local mergeability](/quest/m0/land-fixer/mergeability.md) follow this rule. +- Amended 2026-11-01 (maintainer, /quest-plan in moq-dev/moq): a fixer merge + on [moq-dev/moq#7318](https://github.com/moq-dev/moq/pull/7318) rebuilt + `bun.lock` from the PR's side and undid the base's advisory fix; see + [Lockfile merges](/quest/m0/land-fixer/lockfile.md). The README's landing section and `CONTRIBUTING.md` list what the fixer resolves itself and what it hands back; that docs update finishes the epic. @@ -68,6 +73,7 @@ resolves itself and what it hands back; that docs update finishes the epic. - [Attempt budget](/quest/m0/land-fixer/attempts.md) - only a fix that fails again spends a pick's single attempt - [Registry network](/quest/m0/land-fixer/network.md) - the fixer fetches dependencies, so it builds and tests what it requeues +- [Lockfile merges](/quest/m0/land-fixer/lockfile.md) - a conflicted lockfile is rebuilt from the base's copy, so a fix never reverts the base's dependency changes - [Batch triage](/quest/m0/land-fixer/triage.md) - the fixer blames the failing PR before ejection, and a red base halts the queue - [Flaky tests](/quest/m0/land-fixer/flaky.md) - the gate reruns a failed module, disables a flaky test in the next batch, and files a follow-up - [Local mergeability](/quest/m0/land-fixer/mergeability.md) - `quest land` merges with the quest driver instead of ejecting on GitHub's conflict flag diff --git a/quest/m0/land-fixer/lockfile.md b/quest/m0/land-fixer/lockfile.md new file mode 100644 index 00000000..fc9d69cd --- /dev/null +++ b/quest/m0/land-fixer/lockfile.md @@ -0,0 +1,56 @@ +# [S] The fixer rebuilds a conflicted lockfile from the base's copy + +## Goal + +When the fixer resolves a lockfile while merging the base (`bun.lock`, +`Cargo.lock`, `uv.lock`, `go.sum`, `flake.lock`, and the like), it starts +from the base's copy and runs the package manager, so the result adds only +the PR's own dependency changes. A fixer merge never reverts a dependency +change the base made, such as a security bump. + +Non-goals: running `bun audit` or another advisory scan in a repository's +land check; that is each repository's CI choice. + +## Plan + +Decided 2026-11-01 (maintainer, /quest-plan in moq-dev/moq). After `quest land` +removed [moq-dev/moq#7318](https://github.com/moq-dev/moq/pull/7318) with +`merge_conflict`, the fixer pushed its own merge of main, +[229973492b](https://github.com/moq-dev/moq/commit/229973492ba403cd414161c69c98e67680907e23), +which rebuilt `bun.lock` from the PR's side instead of main's. That undid +[moq-dev/moq#7443](https://github.com/moq-dev/moq/pull/7443)'s glob/minimatch +advisory fix: `glob@10.5.0` (with `jackspeak` and `path-scurry@1.11.1`) and +`minimatch@9.0.9` came back, and `bun audit` reported two moderate advisories, +GHSA-3g3m-2fjr-6pw4 and GHSA-g3hv-75wg-m249. The land check missed it because +moq runs `bun audit` only in Nightly. Redoing the merge from main's `bun.lock` +plus `bun install` added only the PR's packages and audited clean +([evidence](https://github.com/moq-dev/moq/pull/7318#issuecomment-6558969580)). + +- ✅ Plan it: start from the base's lockfile and regenerate, size S, in this + epic (m0) + +The fixer's merge resolution is Codex following `assets/land-fix.md`, whose +only lockfile rule is "regenerate lockfiles/generated files"; nothing says +which side to start from. Replace it with a procedure: for each lockfile the +merge touches, check out the `base` branch's copy (`git checkout base -- +`), apply the PR's manifest changes (merged `package.json`, +`Cargo.toml`, and so on), and run the package manager's minimal resolve +(`bun install`, a `cargo` build or `cargo update --workspace`, `uv lock`, +`go mod tidy`; never `cargo generate-lockfile` or an unpinned update). Then +compare the result with the base's copy: every change must trace to a +manifest change in the PR. The fix reason names the lockfiles it rebuilt. + +Regeneration fetches packages, which +[Registry network](/quest/m0/land-fixer/network.md) allows. A lockfile the +fixer cannot rebuild hands back with the command's output instead of taking +either side's copy. `flake.lock` follows the same rule once +[Protected edits](/quest/m0/land-fixer/protected.md) lets the fixer edit it. +Both PRs also edit `assets/land-fix.md`, so expect to merge their wording. + +Cover the rule in `test/land.test.ts`, which already asserts the prompt's +contents. + +## Related + +- [Registry network](/quest/m0/land-fixer/network.md) - lets the fixer fetch what a lockfile names, which regeneration needs +- [Protected edits](/quest/m0/land-fixer/protected.md) - opens `flake.lock` to the fixer