From 1f96eba5777d60c247433c8572c6d8947057d739 Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Mon, 1 Jun 2026 21:46:29 +0000
Subject: [PATCH] fix(ci-test-review): resolve PR ref to commit sha in
 verify-pr.sh

Resolve the recipe branch/ref to its head commit sha via the Gitea API
before invoking the cold full-suite run, so the upgrade tier deploys the
exact PR head. From the phase-5 upgrade-flow verification.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .claude/skills/ci-test-review/verify-pr.sh | 27 ++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/.claude/skills/ci-test-review/verify-pr.sh b/.claude/skills/ci-test-review/verify-pr.sh
index 0b92609..de205e7 100755
--- a/.claude/skills/ci-test-review/verify-pr.sh
+++ b/.claude/skills/ci-test-review/verify-pr.sh
@@ -25,6 +25,29 @@ REPEAT="${REPEAT:-1}"
 # clones SRC at REF (then pulls upstream tags so the upgrade tier can deploy a prior
 # published version). Defaults to the recipe's recipe-maintainers mirror.
 SRC="${SRC:-recipe-maintainers/${RECIPE}}"
+TESTENV="${TESTENV:-/srv/cc-ci/.testenv}"
+
+set -a; . "$TESTENV"; set +a
+: "${GITEA_USERNAME:?}"
+: "${GITEA_PASSWORD:?}"
+: "${GITEA_URL:?}"
+
+resolve_ref_sha() {
+  if printf '%s' "$REF" | grep -Eq '^[0-9a-f]{40}$'; then
+    printf '%s\n' "$REF"
+    return 0
+  fi
+  branch_enc="$(jq -nr --arg x "$REF" '$x|@uri')"
+  curl -fsS -u "${GITEA_USERNAME}:${GITEA_PASSWORD}" \
+    "https://${GITEA_URL}/api/v1/repos/${SRC}/branches/${branch_enc}" \
+    | jq -r '.commit.id // .commit.sha // empty'
+}
+
+REF_SHA="$(resolve_ref_sha)"
+[ -n "$REF_SHA" ] || {
+  echo "ERROR: could not resolve ${SRC} ref ${REF} to a commit sha" >&2
+  exit 1
+}
 
 resolve_remote_root() {
   ssh "$SSH" "for d in '${REMOTE_ROOT:-/root/builder-clone}' /root/cc-ci; do [ -f \"\$d/runner/run_recipe_ci.py\" ] && { printf '%s' \"\$d\"; exit 0; }; done; exit 1"
@@ -38,14 +61,14 @@ REMOTE_WORKTREE="$(resolve_remote_root)" || {
   exit 1
 }
 
-echo "verify-pr: RECIPE=$RECIPE SRC=$SRC REF=$REF cold full-suite x${REPEAT} on ${SSH} (root=${REMOTE_WORKTREE})" >&2
+echo "verify-pr: RECIPE=$RECIPE SRC=$SRC REF=$REF REF_SHA=$REF_SHA cold full-suite x${REPEAT} on ${SSH} (root=${REMOTE_WORKTREE})" >&2
 
 green=1
 for i in $(seq 1 "$REPEAT"); do
   log="${REMOTE_LOG}.${i}.log"
   rc=0
   # Real harness, cold (no --quick), against the mirror PR head — same path as !testme.
-  ssh "$SSH" "cd '${REMOTE_WORKTREE}' && RECIPE='${RECIPE}' SRC='${SRC}' REF='${REF}' cc-ci-run runner/run_recipe_ci.py >'${log}' 2>&1" || rc=$?
+  ssh "$SSH" "cd '${REMOTE_WORKTREE}' && RECIPE='${RECIPE}' SRC='${SRC}' REF='${REF_SHA}' cc-ci-run runner/run_recipe_ci.py >'${log}' 2>&1" || rc=$?
   echo "--- pass ${i}/${REPEAT}: exit ${rc} (log ${SSH}:${log}) ---" >&2
   ssh "$SSH" "awk '/===== RUN SUMMARY =====/{f=1} f{print}' '${log}'" >&2 || true
   [ "$rc" = "0" ] || green=0