AntFleet

Disagreement · 7fd1739d-openai-0

Hardcoded upstream repo and branch names reduce robustness

mismatch
repo 6f7fc663·PR #17·reviewed 1 week ago

Primary finding

Hardcoded upstream repo and branch names reduce robustness

mediummaintainabilityhigh
  • .github/workflows/sync-upstream.yml:33-34
  • .github/workflows/sync-upstream.yml:39
  • .github/workflows/sync-upstream.yml:54
  • .github/workflows/sync-upstream.yml:89
The workflow assumes the upstream default branch is named "main" and that the upstream repo location remains constant. If the upstream project renames its default branch or moves repositories, fetch/merge steps will fail. Similarly, creating a PR against "main" will be incorrect if the fork's default branch changes. These hardcoded values make the workflow brittle and prone to silent breakage when defaults change.

Recommendation

Parameterize both the upstream repository and branch, and the fork base branch. - Define env vars or workflow inputs, e.g.: - env: BASE_BRANCH: ${{ github.event.repository.default_branch }} - env: UPSTREAM_REPO: aaronjmars/aeon (or from a repository variable) - env: UPSTREAM_BRANCH: main (or discover via GitHub API or `git remote show upstream`) - Replace occurrences: - `git fetch upstream main` -> `git fetch upstream "$UPSTREAM_BRANCH"` - `git rev-list --count HEAD..upstream/main` -> `...HEAD..upstream/$UPSTREAM_BRANCH` - `git merge --no-edit upstream/main` -> `... upstream/$UPSTREAM_BRANCH` - `gh pr create --base main` -> `--base "$BASE_BRANCH"`

Counterpart finding

`gh pr list --head $BRANCH` does not scope by base and may match the wrong PR if branch names collide across same-day runs

lowbugmedium
  • .github/workflows/sync-upstream.yml:88-94
The branch name uses only a UTC date stamp (`sync/upstream-YYYYMMDD`). If the workflow is run multiple times the same day via `workflow_dispatch` after the first PR is merged or closed, `gh pr list` defaults to open PRs; once a PR is merged the next run on the same day will `git checkout -b` against an existing local branch creation (fine in fresh runners) and `git push` may fast-forward or be rejected because the remote branch already exists with merged history. There is no handling for the `push` failing due to non-fast-forward, and no `--state all` on the lookup so a previously-closed PR for the same branch will be re-created in a confusing state.

Recommendation

Include the upstream short SHA or a timestamp with hours/minutes in the branch name, and use `git push --force-with-lease` plus `gh pr list --state all` when looking up existing PRs.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →
← back to all disagreementsview public receiptssee unanimous findings + anatomies →
Tweet ↗