Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Add CI and pre-commit validation for .fullsend/harness/*.yaml base URL SHA-256 integrity

Closed
  • Is something wrong?
#279 3 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@JohnStrunk is already working on this.

Since Oct 13, 2026.

  • #290 by @JohnStrunk — merged

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, go, python, yaml
Domain
ci-cd, devops, security, tooling

Research direction

Start by reading scripts/lint.py, .pre-commit-config.yaml, and .github/workflows/ci-workflow.yaml to trace the existing validation flow; inspect the .fullsend/harness/*.yaml files and the fullsend-ai/agents rule in .github/renovate.json5. Run the existing lint command, then define validation for URL shape and hashes, with offline and online behavior matching the proposal. Done means invalid hashes fail with a useful error, valid hashes pass, and CI runs the check.

Written by the indexing model from the issue text.

Description

enhancement feature infra ready-for-triage triaged

What happened

When Renovate opened PR #274, the post-upgrade task failed, resulting in an "Artifact update problem" comment and a renovate/artifacts: failure status.

However, all existing CI checks defined in .github/workflows/ci-workflow.yaml (Pre-commit checks, Go foundation checks, Specification store check, WMS validation and in-memory adapter checks, and Source Control Manager checks) passed cleanly. Neither .pre-commit-config.yaml nor scripts/lint.py inspects the base URLs or validates the #sha256= hashes in .fullsend/harness/*.yaml.

Because CI Workflow - Success was the only required status check in repository branch protection, and .github/renovate.json5 had platformAutomerge: true enabled for patch/minor updates, GitHub native auto-merge evaluated all required checks as passing. It enqueued and merged PR #274 into main despite:

  1. An explicit artifact failure comment posted by Renovate.
  2. A failing renovate/artifacts commit status.
  3. Completely broken agent harness configurations that break fullsend runtime execution.

What could go better

A core principle of agent-driven and automated repositories is that automated merges must be gated by deterministic CI checks. If a change introduces invalid or unverified configuration, CI must catch it before merge.

Currently, redhat-et/ProtoBot enforces pre-commit and CI gates for Go formatting, YAML syntax, Markdown linting, shell scripts, and specification change sets, but completely lacks any validation for .fullsend/harness/*.yaml remote base integrity. Because fullsend strictly enforces #sha256= integrity at runtime, any mismatch in a committed harness file is a severe defect that disables agent workflows.

Adding a pre-commit check (wired into scripts/lint.py) and CI verification step will ensure that any PR attempting to modify harness base URLs without valid hashes is immediately rejected by CI, thereby blocking platform auto-merge and preventing broken configuration from reaching main.

Proposed change

  1. Create a validation check script (e.g., scripts/check_harness_integrity.py or integrated into scripts/lint.py and .pre-commit-config.yaml) that:
    • Scans all YAML files under .fullsend/harness/*.yaml.
    • Extracts the base: URL and its #sha256=<hash> fragment.
    • Validates that the URL matches the expected https://raw.githubusercontent.com/... pattern.
    • Verifies that the #sha256= fragment matches the actual SHA-256 digest of the content at the specified version tag. In offline or local sandboxes where network access is restricted, verifies that the hash is well-formed (64 hex characters) and non-empty, and provides an --online mode or CI check for full hash verification.
  2. Add a CI step in .github/workflows/ci-workflow.yaml (or incorporate into the pre-commit checks job) that executes harness integrity validation before the CI workflow succeeds.
  3. In .github/renovate.json5, add automerge: false to the fullsend-ai/agents package rule (or configure Renovate to require human review for changes touching .fullsend/harness/), providing defense-in-depth against automated merging of agent infrastructure updates when artifact update scripts fail.

Validation criteria

  1. Modify one of the #sha256= hashes in .fullsend/harness/review.yaml to an invalid or stale hash.
  2. Run the harness validation check (via python scripts/lint.py or the dedicated check script) and verify that it fails with a non-zero exit code and an informative error message identifying the mismatched hash.
  3. Restore the correct hash and verify the check passes with exit code 0.
  4. Verify in .github/workflows/ci-workflow.yaml that PRs with mismatched harness hashes fail the check suite and cannot be merged via GitHub auto-merge.

Generated by retro agent from https://github.com/redhat-et/ProtoBot/pull/274

Dominant language
Go
Stars
6
Forks
8
Avg merge
1d 3h
Merged PRs (30d)
93

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from redhat-et/ProtoBot

All issues in redhat-et/ProtoBot

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.