ci: run lock downgrade gate on pull requests

[proggeramlug]

Summary

Run the existing resolved-dependency downgrade detector on every pull request against the pull request base. GitHub checks out the synthetic merge commit, so the comparison evaluates the lockfile that would actually land while allowing an old branch to inherit newer base pins normally.

Changes

• Move the detector self-test into an independent lint step so unrelated lint failures cannot hide its result.
• Fetch the pull request base SHA when needed and run lock_no_downgrade.py --vs against the checked-out merge result.
• Keep the comparison in the required lint job and report its result even when an earlier independent lint step fails.

Related issue

Fixes #11025

Test plan

• python3 scripts/lock_no_downgrade.py --self-test
• python3 scripts/lock_no_downgrade.py --vs HEAD (3,327 dependency edges compared)
• Exact tempfile 3.27.0 fixture: changed only its resolved edge from getrandom 0.4.2 to 0.3.4; gate exited 1 and named the consumer and downgrade
• Same detector checks repeated in the isolated Linux worktree on perrymaster
• git diff --check
• scripts/check_file_size.sh
• Workflow parses with PyYAML
• cargo build --release clean — workflow-only change; no Rust build needed
• cargo test --workspace --exclude perry-ui-ios --exclude perry-ui-tvos --exclude perry-ui-watchos --exclude perry-ui-gtk4 --exclude perry-ui-android --exclude perry-ui-windows passes — workflow-only change
• (if user-facing) Added or updated a test under test-files/ or a #[test] in the affected crate — not user-facing
• (if CLI / stdlib / runtime API changed) Updated docs/src/ — no API change
• (if touching a platform UI backend) Built -p perry-ui-<backend> locally on that platform — no UI change

Screenshots / output

LOCKFILE DOWNGRADE — refusing:
  getrandom: 0.4.2 -> 0.3.4   (via shared consumer tempfile 3.27.0)

Checklist

• I have NOT bumped the workspace version or edited CLAUDE.md / CHANGELOG.md (maintainer handles these at merge)
• My commits follow the loose feat: / fix: / docs: / chore: prefix convention used in the log
• I've read CONTRIBUTING.md and agree to the Code of Conduct

Summary by CodeRabbit

• Bug Fixes

  • Pull request validation now detects dependency downgrades in Cargo.lock, helping prevent newer dependency resolutions from being unintentionally replaced.
  • Test isolation checks now run fully during lint validation, improving detection of cross-test global state leakage.

• Documentation

  • Added a changelog entry describing the new dependency downgrade protection for pull requests.

CI note

The live pull request run executed both new steps successfully: Lockfile downgrade detector self-test and Cargo.lock may not downgrade vs. pull request base. The aggregate lint job is red only at Public benchmark evidence freshness; python3 benchmarks/ci_public_baseline_check.py also fails on the unchanged base because the committed benchmark artifact is already stale, tracked by #10799.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ae74862c-2a16-48b1-9512-5eed6313e40b

📥 Commits

Reviewing files that changed from the base of the PR and between f5cfbff and 1d835d3.

📒 Files selected for processing (2)

• .github/workflows/test.yml
• changelog.d/11032-lock-downgrade-pr-gate.md

Included review availability: Your plan provides up to 8 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The lint workflow now runs global sink isolation directly, keeps the lockfile detector self-test separate, and compares pull-request lockfiles with the base commit. A changelog entry documents the new pull-request downgrade gate.

Changes

Lockfile CI validation

Layer / File(s)	Summary
Per-test isolation validation .github/workflows/test.yml	The Per-test global sinks step now runs global_sink_isolation.py directly.
Pull-request lockfile comparison .github/workflows/test.yml, changelog.d/11032-lock-downgrade-pr-gate.md	The workflow runs lock_no_downgrade.py --self-test separately. On pull requests, it fetches the base SHA when needed and compares the lockfile against that base. The changelog records the downgrade example involving tempfile and getrandom.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActionsLintJob
  participant GitRepository
  participant lock_no_downgrade.py
  GitHubActionsLintJob->>GitRepository: Fetch BASE_SHA when absent
  GitHubActionsLintJob->>lock_no_downgrade.py: Run --vs BASE_SHA
  lock_no_downgrade.py-->>GitHubActionsLintJob: Report lockfile downgrade result

Loading

Merge Risk: ⚪ Minimal · up to 1d835

No actionable merge-blocking risk remains in the reviewed changes.

🚥 Pre-merge checks | ✅ 6 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The workflow also changes the Per-test global sinks step to run python3 scripts/global_sink_isolation.py instead of only its self-test. Issue [#11025] concerns Cargo.lock dependency downgrade de…	Remove the unrelated global_sink_isolation.py behavior change, or link it to a requirement that defines this scope.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The description references issue #11025, and the issue objective matches the implemented pull request changes.
Out of Scope Changes check	✅ Passed	The changes are limited to the CI workflow and related changelog entry. They support the stated pull request objective.
Linked Issues check	✅ Passed	Issue [#11025] requires a real base-versus-merge comparison for pull requests. The workflow now obtains the pull request base SHA and runs lock_no_downgrade.py --vs "$BASE_SHA" in the lint job aga…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Title check	✅ Passed	The title clearly and concisely describes the main change: running the lock downgrade gate on pull requests.
Description check	✅ Passed	The description includes all required sections, explains the workflow changes, references the related issue, documents testing, and completes the applicable checklist items.

Full details: Out of Scope Changes check

Explanation

The workflow also changes the Per-test global sinks step to run python3 scripts/global_sink_isolation.py instead of only its self-test. Issue [#11025] concerns Cargo.lock dependency downgrade detection and does not establish a requirement for this global-sink behavior change. The changelog entry is related to the issue, but this workflow change has no shown connection to it.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Landed on main in merge train 257 (#11039, v0.5.1640), main 990b3eeada.

Carried at head 1d835d3d9e. CI on the train head passed every job except the known public-baseline lint step: all 6 gap shards, cargo-test, e2e-scoped, gc-stress, check, warnings and security-audit green.

This train was split by blast radius after an earlier 35-PR assembly hit five gap regressions: it carries only PRs touching no lowering path. Trains rebase-merge, so commits get new SHAs and GitHub cannot mark this merged. Closed as landed.