Merge pull request #13 from kernel/hypeship/keep-human-commits-on-coverage-branches

Keep human commits on the MCP coverage branch when publishing

Author: rgarcia

.github/tests/update-coverage-security.test.mjs

@@ -61,10 +61,12 @@ test('changes are restricted to the allowlist before validation', () => {
   assert.ok(jobs.generate.indexOf(snapshot) < jobs.generate.indexOf(verify));
   assert.match(snapshot, /mcp-update-disallowed-paths\.sh/);
   assert.match(snapshot, /git reset -q --hard\n\s+git clean -fdq/);
-  assert.match(snapshot, /MAIN_SHA: \$\{\{ steps\.prepare\.outputs\.main_sha \}\}/);
-  assert.match(snapshot, /git reset -q --soft "\$MAIN_SHA"\n\s+git add -A/);
+  assert.match(snapshot, /AGENT_BASE: \$\{\{ steps\.prepare\.outputs\.agent_base \}\}/);
+  assert.match(snapshot, /git reset -q --soft "\$AGENT_BASE"\n\s+git add -A/);
   const prepare = step('generate', 'Prepare update branch and SDK diff');
   assert.match(prepare, /main_sha=\$\(git rev-parse origin\/main\)/);
+  assert.match(prepare, /git rebase origin\/main; then[\s\S]*else\n\s+echo "rebased=true"/);
+  assert.match(prepare, /agent_base=\$\(git rev-parse HEAD\)[\s\S]*agent_base_tree=/);
   // Only a branch without human commits may be regenerated from main.
   assert.match(
     prepare,
@@ -107,6 +109,14 @@ test('publishing runs in a separate job that never executes repository code', ()
   assert.match(apply, /git apply --index "\$RUNNER_TEMP\/mcp-coverage-update\/changes\.patch"/);
   assert.match(apply, /mcp-update-disallowed-paths\.sh/);
   assert.match(apply, /100644\|100755\|000000/);
+  // Publishing rebuilds the exact head the changes were validated on, so human
+  // commits on the update branch are never squashed or dropped.
+  assert.match(
+    apply,
+    /if \[\[ "\$REBASED" == true \]\]; then\n\s+git switch -c \S+ "\$UPDATE_SHA"\n\s+git rebase -q "\$MAIN_SHA"/,
+  );
+  assert.match(apply, /"\$\(git rev-parse 'HEAD\^\{tree\}'\)" != "\$AGENT_BASE_TREE"[\s\S]*exit 1/);
+  assert.ok(apply.indexOf('AGENT_BASE_TREE') < apply.indexOf('git apply --index'));
   const mint = jobs.publish.indexOf(step('publish', 'Generate MCP repository token'));
   assert.ok(jobs.publish.indexOf(apply) < mint);
   assert.doesNotMatch(jobs.publish.slice(0, mint).join(''), /GH_TOKEN:/);

.github/workflows/update-mcp-coverage.yml

@@ -61,6 +61,8 @@ jobs:
       changed: ${{ steps.snapshot.outputs.changed }}
       main_sha: ${{ steps.prepare.outputs.main_sha }}
       update_sha: ${{ steps.prepare.outputs.update_sha }}
+      rebased: ${{ steps.prepare.outputs.rebased }}
+      agent_base_tree: ${{ steps.prepare.outputs.agent_base_tree }}
     env:
       SDK_VERSION: ${{ needs.sdk-version.outputs.version }}
       SDK_SHA: ${{ needs.sdk-version.outputs.sha }}
@@ -126,10 +128,16 @@ jobs:
               fi
               echo "::warning::$UPDATE_BRANCH conflicts with main; regenerating it from main."
               git switch -C "$UPDATE_BRANCH" origin/main
+            else
+              echo "rebased=true" >> "$GITHUB_OUTPUT"
             fi
           else
             git switch -c "$UPDATE_BRANCH" origin/main
           fi
+          # The agent's changes are published on top of this head, so human
+          # commits on the update branch keep their content and authorship.
+          echo "agent_base=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "agent_base_tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
 
           old_version=$(jq -er '.dependencies["@onkernel/sdk"]' package.json)
           if [[ "$old_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
@@ -221,9 +229,9 @@ jobs:
         id: snapshot
         working-directory: mcp
         env:
-          MAIN_SHA: ${{ steps.prepare.outputs.main_sha }}
+          AGENT_BASE: ${{ steps.prepare.outputs.agent_base }}
         run: |
-          git reset -q --soft "$MAIN_SHA"
+          git reset -q --soft "$AGENT_BASE"
           git add -A
           git diff --cached --name-only --no-renames -z \
             | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/excluded-paths"
@@ -276,6 +284,8 @@ jobs:
       SDK_VERSION: ${{ needs.sdk-version.outputs.version }}
       MAIN_SHA: ${{ needs.generate.outputs.main_sha }}
       UPDATE_SHA: ${{ needs.generate.outputs.update_sha }}
+      REBASED: ${{ needs.generate.outputs.rebased }}
+      AGENT_BASE_TREE: ${{ needs.generate.outputs.agent_base_tree }}
       UPDATE_BRANCH: mcp-coverage-update
     steps:
       - name: Checkout updater scripts
@@ -302,7 +312,16 @@ jobs:
         run: |
           git config user.name 'kernel-internal[bot]'
           git config user.email '260533166+kernel-internal[bot]@users.noreply.github.com'
-          git switch -c "$UPDATE_BRANCH" "$MAIN_SHA"
+          if [[ "$REBASED" == true ]]; then
+            git switch -c "$UPDATE_BRANCH" "$UPDATE_SHA"
+            git rebase -q "$MAIN_SHA"
+          else
+            git switch -c "$UPDATE_BRANCH" "$MAIN_SHA"
+          fi
+          if [[ "$(git rev-parse 'HEAD^{tree}')" != "$AGENT_BASE_TREE" ]]; then
+            echo "::error::The rebuilt update branch differs from the one the changes were validated on."
+            exit 1
+          fi
           git apply --index "$RUNNER_TEMP/mcp-coverage-update/changes.patch"
           git diff --cached --name-only --no-renames -z \
             | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/disallowed-paths"