Files
ironclaw/scripts
Henry Park fa1796e941 fix(ci): keep the duplicate-key gate stdlib-only and register the guard probe
Two failures this PR's own CI caught that no local run could.

1. The duplicate-key validator imported PyYAML. No checker under scripts/ci
   does — they are deliberately stdlib-only — and the fast-checks job
   installs no such dependency, so the import raised inside
   validate_workflow_texts and errored 70 self-tests in CI while passing
   locally. Exactly the green-locally/red-in-CI class the gate exists to
   catch, introduced by the gate itself.

   Replaced with a stdlib line scanner tracking one key set per mapping
   block. PyYAML was the wrong tool anyway: safe_load silently keeps the
   LAST duplicate, so a `yaml.safe_load` check passes while the author's
   value is discarded — which is how a duplicated `if-no-files-found`
   pinned a JUnit upload to `error` and would have hard-failed every
   coverage lane.

   The scanner's first draft mis-parsed `- &anchor` list items, whose
   marker carries no key, and reported two false duplicates in
   release-plz.yml. Element boundaries are now tracked whether or not the
   marker carries its key inline, and block scalars are skipped so a
   `run: |` body's prose is never read as YAML.

2. tests/hermetic_network_guard_probe.rs, added earlier in this branch, was
   not in the planner's root inventory: the glob matches `tests/reborn_*.rs`
   plus a short extras list, so the fail-closed arm rejected it with
   "unmapped test or CI path" and failed Detect Reborn test scope for the
   whole PR. It joins the extras beside dockerfile_runtime_home — the right
   lane, since the hermetic control that drives it runs in the
   root-partition job.

Regression tests: anchor-only list items and block-scalar bodies must not
false-positive, the checker must not import yaml, and the probe must appear
in the root inventory. All four fail against the respective bug.

Verified: ws12 self-tests 104 OK, ws12 live gate passed, planner suite 88
OK, check-guidance OK, and the planner now succeeds on this PR's own
changed-file list — the input that was failing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-23 22:59:10 +00:00
..