cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(release): record verified runner dependency corruption
CI and Deploy / test (push) Failing after 7m25s
Details
CI and Deploy / deploy (push) Has been skipped
Details

Browse Source
This commit is contained in:
cesnimda
2026-09-10 00:24:05 +02:00
parent a861ca4275
commit 27657f3113
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/audits/2026-09-07/validation/b06-completion.md
+8
View File
@@ -358,3 +358,11 @@ Fresh local release verification after these changes:
| Root: `python scripts/supply-chain.py scan-secrets`; `git diff --check` | **Pass**; line-ending notices only |
Logs are under `.artifacts/redesign-audit/`. The latest full Linux backend run remains **916/916 at `2024c37`**; no backend source changed in this dependency correction. Deployment still requires the next full CI run and production preflight. This is authorized release repair, not Phase 2 redesign or B07; **F04 remains open**.
### Runner dependency corruption after the patch
[Run 742](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/742/jobs/1619), `a861ca4`, again passed **916/916 backend tests**, no skips (16s), repository/parser/build checks, locked frontend installation and the dependency audit. Lint stopped before analyzing application code with exit 2: installed `es-abstract/2025/RegExpCreate.js:19` contained `var"flags`, causing `SyntaxError: Invalid or unexpected token`. Subsequent gates and deployment were skipped.
Independent verification downloaded the exact `es-abstract` **1.24.2** tarball URL from the lockfile, verified its SHA-512 integrity against that lock and read the member without extracting it. The official member and locally installed file match byte-for-byte; line 19 is `var flags = typeof F === 'undefined' ? '' : ToString(F);`. This is evidence of different dependency bytes in the runner's failure, not a source lint violation or a need to edit the dependency. The corruption mechanism is unproven; the existing [runner investigation](../../../infrastructure/runner-investigation.md) documents analogous failures.
This evidence-only push makes **one further unchanged-code CI attempt** with the workflow's existing isolated install cache. No new retry loop, lint suppression or gate bypass is added. If corrupted dependency bytes or assertion-free process crashes recur, stop release retries and request runner-host diagnostics; do not generate repeated empty commits. Public `/health` still reports version **299**, `/ready` reports ready before this attempt; that is the existing deployment, not proof that `a861ca4` is live. The completed Phase 1 audit is pushed separately at `957fb57` on `codex/ui-redesign-audit`.