Harden public history verification

[palermo-git]

Summary

• inspect raw, complete reachable history despite hostile merge settings, replacement refs, grafts, or shallow clones
• add independent path/content/graft/shallow canaries and fetch full history in every CI job that runs the gate
• prevent concurrent or stale mutation-gate scratch directories from being silently reused

Test plan

• mix test test/architecture/public_surface_privacy_test.exs — 4 passed
• mix quality — 336 passed, 47 archive mutations, 55 conformance mutations, 283/283 corpus agreement
• mix run scripts/check_conformance_mutations.exs — 55 mutations caught after exclusive-scratch hardening
• actionlint .github/workflows/ci.yml .github/workflows/supply-chain.yml

Summary by CodeRabbit

• Bug Fixes

  • Improved repository history handling for more reliable compatibility, quality, and supply-chain checks.
  • Enhanced validation for merge histories, shallow repositories, tags, grafts, and historical file changes.
  • Reduced the risk of conflicts when running parallel conformance checks.

• Tests

  • Expanded coverage for complex Git repository scenarios and full-history validation.
  • Improved test isolation to produce more consistent results across environments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 203a2cd4-bde6-49ef-996f-9a71cf66e2c2

📥 Commits

Reviewing files that changed from the base of the PR and between 06a84b0 and 91fc05e.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/supply-chain.yml
• scripts/check_conformance_mutations.exs
• test/architecture/public_surface_privacy_test.exs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

CI workflows now fetch full Git history. Repository privacy tests isolate Git behavior and cover merge, replacement-object, graft, shallow-history, tag, and historical-path cases. Mutation checks use process-qualified scratch directories.

Changes

Repository scan history handling

Layer / File(s)	Summary
Full-history checkout configuration .github/workflows/ci.yml, .github/workflows/supply-chain.yml	Checkout steps in the compatibility, quality, and supply-chain jobs now use fetch-depth: 0.
Controlled repository scanning test/architecture/public_surface_privacy_test.exs	The test fixture and Git helpers now control environment and replacement-object settings. Tests cover merge diffs, historical content, grafts, shallow repositories, annotated tags, full-history validation, and Git-path resolution.

Mutation scratch directories

Layer / File(s)	Summary
Process-qualified scratch paths scripts/check_conformance_mutations.exs	Mutation and baseline scratch directories now include System.pid() and use File.mkdir!/1.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 91fc0

The PR hardens history verification and CI scratch-directory handling without any supplied evidence of a current correctness, security, availability, or deployment risk; no actionable merge-blocking risk remains.

Suggested reviewers: corepay

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: strengthening public history verification against repository-history edge cases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rjp/public-history-verification

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[palermo-git]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.