fix(#2247): compare decoded text in shim drift detection#9
Conversation
Base64 encoding can differ between implementations (line wrapping, padding). Compare decoded text instead to avoid false-positive stale shim updates. Mirrors upstream fullsend-ai#2254.
|
🤖 Finished Review · ✅ Success · Started 11:23 AM UTC · Completed 11:30 AM UTC |
ReviewReason: stale-head The review agent reviewed commit Previous runReviewReason: stale-head The review agent reviewed commit Previous run (2)ReviewReason: stale-head The review agent reviewed commit Previous run (3)ReviewFindingsCritical
Low
Info
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| if [ "$REMOTE_B64" = "$EXPECTED_B64" ]; then | ||
| # File exists — compare decoded text to avoid base64 encoding differences. | ||
| EXPECTED_TEXT=$(shim_content_b64 | base64 -d) | ||
| REMOTE_TEXT=$(printf '%s' "$REMOTE_CONTENT" | base64 -d) |
There was a problem hiding this comment.
[low] edge-case
The new approach pipes GitHub's base64 content through base64 -d and compares the decoded text using shell string comparison. If the YAML template ever contains NUL bytes or trailing newlines that differ between implementations, the shell comparison may silently truncate or mangle content. In practice this is very unlikely for YAML workflow files.
|
/fs quality |
|
🤖 Finished Review · ✅ Success · Started 11:41 AM UTC · Completed 11:52 AM UTC |
|
/fs-review |
|
🤖 Finished Review · ✅ Success · Started 11:53 AM UTC · Completed 12:04 PM UTC |
|
/fs-review |
|
🤖 Finished Review · ✅ Success · Started 12:06 PM UTC · Completed 12:18 PM UTC |
|
/fs-review |
Replaces intermediate pipeline artifacts with organized test files. Total: 8 test files → qf-tests/fullsend-aiGH-2247/ Jira: fullsend-aiGH-2247 [skip ci]
QualityFlow Pipeline Summary
Test Output
Issue: GH-2247 Generated by QualityFlow |
|
Closing — QF infrastructure updated on main, will re-create with improved pipeline. |
1 participant
The stale-shim comparison in reconcile-repos.sh used managed_content_b64() which decoded base64, extracted managed content, then re-encoded to base64. Bash command substitution strips trailing newlines, so the re-encoded base64 could differ from the original even when the decoded text was identical. This caused false-positive drift detection, leading to bogus update PRs (e.g. PR fullsend-ai#2101) that removed the sentinel lines.
Replace the base64-to-base64 comparison with decoded text comparison: decode both sides, strip carriage returns, and compare the resulting strings directly.
Mirrors upstream fullsend-ai#2254.
Closes fullsend-ai#2247