release.yml's wheel check exports TAG, COMMIT and REPOSITORY in a bash line that no test runs, so a TAG taken from the ref name passes the suite

Found by lane openRepoTools-2's independent re-check of #284 (PR 3b of #228), its comment 6284132726, NIT 2 (the mutant WX1). Lane 2's own weighting: WX1 fails closed, and can only break a branch rehearsal (FR-033).

Line numbers are .github/workflows/release.yml at 7376b34, as lane 2 gives them. That file is blob 9a27e2e at 7376b34, at #284's head 2ff7094 and in tree 7ad2bbe (the tree main holds once #284 lands), so the lines are #284's and, once it lands, main's. test :N is tests/test_release_workflow.py at 2ff7094 (blob 8273f40, also in 7ad2bbe).

What happens

The build job's wheel check (:805) begins with export TAG="v$VERSION" COMMIT="$GITHUB_SHA" REPOSITORY="$GITHUB_REPOSITORY" (:809).
The tests run only the step's Python heredoc, with its values handed in through the environment (run_wheel_check, test :2083-2097). No test runs the step whole or reads that line.
So WX1, TAG="$GITHUB_REF_NAME", survives. The heredoc refuses a TAG other than v$VERSION (:817-820), so the mutant can only fail a rehearsal on a branch.

Where

release.yml:809 and the refusal at :817-820. The stamp step has the same export (:703) and is run whole, on a branch ref and on the tag (test :2370-2442).

How it was found

Lane 2's mutant WX1 survives both selections at 7376b34: -k test_release_workflow (499 passed) and the broader -k selection (733 passed). These are lane 2's measurements.

The fix

Lane 2's: run the step whole, on a branch ref and on the tag, as for the stamp step.
What a fix has to settle (nothing here is decided):
- what the whole step needs: run_wheel_check hands the heredoc a synthetic wheel, and the step's next line (:810) names $RUNNER_TEMP/dist-a/openrepotools-$VERSION-py3-none-any.whl, which no test runs either;
- which refs the cases use, and that TAG is v$VERSION in each.

Why it is not in v1.1.0

It is a test gap: release.yml is right today, and WX1 fails closed. Lane 2 found no MUST and no SHOULD in PR 3's re-check survivors are killed: tests/test_release_workflow.py runs the fetch, pipx, approval, tag, ref, clean, stamp, dist and digest steps instead of reading them, and release.yml changes only in comments (#228, PR 3b) #284, whose description leaves this NIT for v1.2.0.

Filed in milestone v1.2.0 on Brett Heap's word (2026-10-20T09:40Z, "yes, file the four NITs in v1.2.0"). It is unclaimed.

Lane: openRepoTools-3

🤖 Generated with Claude Code

PR 3's re-check survivors are killed: tests/test_release_workflow.py …

CLAIMED — lane openRepoTools-2, session 202778d2-0e63-4478-9c95-fdde314b0524@Eagle, 2026-10-20T22:59:50Z, for #285

Logged in lanes/log/openRepoTools-2.md at 3eb383bdc52d891eaaac1119ca59d91cbde039de.

The three reads (lane-collision-protocol Rule 1):

1. existing `CLAIMED —` comments on opensoft/openRepoTools#285:
   none
2. `gh pr list --repo opensoft/openRepoTools --state all --search "#285"`, kept where the row or its body names `#285`:
284	PR 3's re-check survivors are killed: tests/test_release_workflow.py runs the fetch, pipx, approval, tag, ref, clean, stamp, dist and digest steps instead of reading them, and release.yml changes only in comments (#228, PR 3b)	006-release-pypi-pr3b	MERGED
3. `git ls-remote --heads git@github.com:opensoft/openRepoTools` branches naming `285` as a whole token:
   none

Lane openRepoTools-2, 2026-10-21T02:2xZ: #285 is done, on a branch only. It is branch test/285-wheel-check-whole-step-lane2 at 9f161a9, one commit on main a42946e, to be cherry-picked into openRepoTools-code after v1.1.0 is tagged.

The new test is test_release_build_the_wheel_check_step_as_github_runs_it_holds_the_wheel_to_v_version. It runs the wheel check step whole, on a rehearsal branch with 1.1.0rc1 and on the tag v1.1.0.
The proof: under WX1 (TAG taken from GITHUB_REF_NAME), the branch case fails with ::error::the release's values … are not this run's. Without WX1 both cases pass.
-k test_release_workflow passes 501.

Lane: openRepoTools-2

tests/test_release_workflow.py runs the wheel check's rehearsal-branc…

Lane openRepoTools-2, 2026-10-21T14:5xZ: #285's review fix is on the branch. Branch test/285-wheel-check-whole-step-lane2 is at 33abe8a, one new commit on 9f161a9 (a fast-forward push, no force). It is still a branch only, to be cherry-picked into openRepoTools-code after v1.1.0 is tagged.

RV-A's SHOULD: both cases took REPOSITORY and GITHUB_REPOSITORY from wheel_release(), which gives the code leg's name, so REPOSITORY="opensoft/openRepoTools-code" written into the step's bash line passed both. In production that line would refuse every run outside the code leg, and the only release runs so far (39416933776 on main, a branch rehearsal, and 39417405752 on v1.1.0rc1) ran in opensoft/openRepoTools.
The fix: the rehearsal-branch case now runs in THIS_REPOSITORY, opensoft/openRepoTools, as rehearsals run today, with its wheel stamped to match. The tag case is as it was, in the code leg, so a REPOSITORY hard-coded to either name fails one of the two cases. The cases keep their ids.
Proof, in private clones, on -k wheel_check_step_as_github_runs_it:
- RV-A's mutant V2 (REPOSITORY hard-coded to the code leg): at 9f161a9 2 passed, so the mutant survives, as RV-A found; at 33abe8a 1 failed, 1 passed: the rehearsal-branch case fails with ::error::the release's values {...'REPOSITORY': 'opensoft/openRepoTools-code'} are not this run's {...'REPOSITORY': 'opensoft/openRepoTools'}, and the tag case passes.
- The mirror mutant V3 (hard-coded to this repository): at 33abe8a 1 failed, 1 passed: the tag case fails with ::error::the release's values {...'REPOSITORY': 'opensoft/openRepoTools'} are not this run's {...'REPOSITORY': 'opensoft/openRepoTools-code'}, and the rehearsal-branch case passes.
- Unmutated at 33abe8a: 2 passed, the same two cases.
-k test_release_workflow on the tree at 33abe8a: 501 passed, 2434 deselected.
Still open: nothing from RV-A's findings.

Lane: openRepoTools-2

Merge main (33ce26d, with #296's ubuntu-24.04 pin) into test/285-whee…

Lane openRepoTools-2, 2026-10-21T16:2xZ: the final review of #285 is READY, with no MUST and no SHOULD. It was an opus pass, on Brett Heap's word.

Head: 1b6d8dc. It holds the branch's own commits 9f161a9 and 33abe8a, plus a merge of main 33ce26d whose tree equals git merge-tree of the two. Patch-ids show it carries only main's delta.
RV-A's SHOULD is FIXED by 33abe8a. The rehearsal-branch case runs in this repository, with its wheel stamped to match.
- A hard-coded REPOSITORY naming the code leg (V2) is now killed by [a-rehearsal-branch], across the whole file: 1 failed, 511 passed.
- The mirror mutant (V3) is killed by the tag case.
- TAG taken from GITHUB_REF_NAME (WX1) is killed too.
The four branches together: release.yml's wheel check exports TAG, COMMIT and REPOSITORY in a bash line that no test runs, so a TAG taken from the ref name passes the suite #285 to A step inserted after the stamp writer is caught by the step-order pin's count alone, because no test runs the stamp step followed by another step #288 add 13 tests to main's 499, for 512 passed. Under a network probe, every connection the new tests make is to 127.0.0.1.
CI: run 39622061918 on 1b6d8dc has all four jobs green.

Lane: openRepoTools-2

Navigation Menu

Repository navigation

release.yml's wheel check exports TAG, COMMIT and REPOSITORY in a bash line that no test runs, so a TAG taken from the ref name passes the suite #285

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

release.yml's wheel check exports TAG, COMMIT and REPOSITORY in a bash line that no test runs, so a TAG taken from the ref name passes the suite #285

Description

Activity

brettheap commented on Oct 20, 2026

brettheap commented on Oct 21, 2026

brettheap commented on Oct 21, 2026

brettheap commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions