ci: Configure SDK compliance capture suite#203
Conversation
|
Reviews (1): Last reviewed commit: "ci: Configure SDK compliance capture sui..." | Re-trigger Greptile |
| compliance: | ||
| name: PostHog SDK compliance tests | ||
| uses: PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml@be8b8d5a3f94a249659844e94832e874f049c1e4 | ||
| uses: PostHog/posthog-sdk-test-harness/.github/workflows/test-sdk-action.yml@fix/sdk-harness-options-20260630 |
There was a problem hiding this comment.
Mutable branch reference in reusable workflow call
The uses line was changed from a pinned commit SHA to a branch name (fix/sdk-harness-options-20260630). Branch references are mutable: any push to that branch in the external posthog-sdk-test-harness repo will immediately affect what code runs inside this workflow, including in a security context with access to secrets. If the branch is ever force-pushed or receives an unreviewed commit, CI will silently pick it up. This also makes the build non-reproducible — the same workflow run could behave differently on different days.
Once the harness branch is merged, this should be updated to either the merge commit SHA or the next tagged release SHA.
posthog-ruby Compliance ReportDate: 2026-06-30 10:01:25 UTC ✅ All Tests Passed!29/29 tests passed Capture Tests✅ 29/29 tests passed View Details
|
Problem
SDK compliance workflows need explicit harness suite/sdk-type selection and configurable blocking behavior so CI only runs the intended contract checks.
Changes
Testing
docker compose configfor the adapter compose file.git diff --check.Release / changeset
No SDK package changeset: CI/local compliance configuration only.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Implemented with Pi using dedicated git worktrees. The change was requested to align SDK compliance harness setup across SDK repositories while keeping non-ready SDKs non-blocking.