fix(ci): give main pushes their own ImpactGate group and save PR baselines

Author: tobyhede

.github/workflows/impact.yml

@@ -8,8 +8,11 @@ on:
 permissions:
   contents: read
 
+# A newer push to the same pull request supersedes the older run. Main pushes
+# are grouped per SHA instead: one shared main group cancelled a merge's run
+# before it saved that SHA's baselines, leaving PRs on it to rebuild.
 concurrency:
-  group: impact-${{ github.ref }}
+  group: impact-${{ github.event_name == 'push' && github.sha || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -33,7 +36,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install analysis tools
-        run: python -m pip install -r .github/impact-gate/requirements.txt
+        run: python -m pip install --require-hashes --no-deps -r .github/impact-gate/requirements.txt
 
       - name: Check reporting behavior with the real CLI
         run: python -m unittest discover -s scripts/tests -p test_impact_gate.py -v
@@ -75,8 +78,11 @@ jobs:
           if [[ "$REFRESH" == 'true' ]]; then args+=(--refresh); fi
           python scripts/impact-gate.py prepare --base "$BASE_REF" --cache-dir "$BASELINE_DIR" "${args[@]}"
 
-      - name: Save main baselines
-        if: github.event_name == 'push' && steps.prepare.outputs.rebuilt == 'true'
+      # Any rebuilt pair is saved, including on pull requests: a PR's cache is
+      # scoped to its own ref, so it cannot replace main's, and later pushes to
+      # the PR reuse it instead of rebuilding both scopes again.
+      - name: Save baselines
+        if: steps.prepare.outputs.rebuilt == 'true'
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ${{ env.BASELINE_DIR }}

docs/plans/2026-10-08-impact-gate-rollout.md

@@ -8,6 +8,7 @@ Calibration date: 2026-10-08. This implements [Stack issue #1137](https://github
 - Hyper reproduction source: `cd294f1c02e9718c7627a8d7fe7dd35ecd3ee407`, `.scratch/impact-gate/issues/05-reduce-the-lizard-typescript-span-defect.md`.
 - Installed and exercised: `impact-gate==0.4.1`, `lizard==1.23.0`. Lizard 1.24.0 is excluded by upstream ImpactGate package metadata; it is not an upgrade candidate for this rollout.
 - Local measurement runtime: Python 3.13 on macOS arm64. Dependencies resolved during calibration: PyYAML 6.0.3, pygments 2.21.0, pathspec 1.1.1. Runtime timings are local evidence, not hosted-runner guarantees.
+- CI installs `.github/impact-gate/requirements.txt`, which pins those transitive dependencies at the same versions with hashes for every distribution, using `pip install --require-hashes --no-deps`. Its header records the regeneration command; Dependabot proposes pip updates for that directory.
 - Official release source: [CLI](https://github.com/officefloor/ImpactGate/blob/v0.4.1/impact_gate/cli.py), [baseline](https://github.com/officefloor/ImpactGate/blob/v0.4.1/impact_gate/baseline.py), [measurement scope](https://github.com/officefloor/ImpactGate/blob/v0.4.1/impact_gate/core/config.py). Flags and baseline serialization were also inspected in the installed wheel.
 
 ## Parser checks
@@ -35,7 +36,7 @@ The upstream baseline serializes `_meta` (`tool`, `n`, `head`, `base_ref`) plus
 
 ## Actions verification still required
 
-Local calibration and tests cannot verify GitHub cache scoping, main-run cache saves, later PR restores, or the rendered job summary. After the workflow is available in Actions, record links to a cold run, a main run saving the pair, and a PR run restoring it. Verify both report sections, policy/version cache invalidation, malformed-pair rebuilding, and explicit seed-only disclosure. Do not mark these checks complete based on local cache simulation.
+Local calibration and tests cannot verify GitHub cache scoping, cache saves, later PR restores, or the rendered job summary. Any run that rebuilds the pair saves it, pull requests included; a PR's cache is scoped to its own ref, so it cannot replace main's, and it spares later pushes to that PR a full rebuild. Main pushes run in per-SHA concurrency groups so a quick second merge cannot cancel the first before it saves. After the workflow is available in Actions, record links to a cold run, a main run saving the pair, a PR run restoring it, and a PR run reusing its own saved pair. Verify both report sections, policy/version cache invalidation, malformed-pair rebuilding, and explicit seed-only disclosure. Do not mark these checks complete based on local cache simulation.
 
 ## Imported history and rename checks
 

scripts/__tests__/impact-workflow.test.mjs

@@ -1,8 +1,45 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
+import { REPO_ROOT } from './lib/repo-root.mjs'
 import { readWorkflow } from './lib/workflows.mjs'
 
 const workflowPath = '.github/workflows/impact.yml'
 
+// Evaluates the small subset of the Actions expression language these guards
+// need (context paths, string literals, ==, !=, &&, ||, !), so a test asserts
+// what an expression DOES for an event rather than how it is spelled.
+function evaluate(expression, context) {
+  const body = String(expression)
+    .replace(/^\s*\$\{\{\s*/, '')
+    .replace(/\s*\}\}\s*$/, '')
+  const js = body
+    .replace(/\b(github|steps)((?:\.[\w-]+)+)/g, (_, root, path) =>
+      JSON.stringify(
+        path
+          .slice(1)
+          .split('.')
+          .reduce((value, key) => value?.[key], context[root]) ?? '',
+      ),
+    )
+    .replace(/==/g, '===')
+    .replace(/!===/g, '!==')
+  return new Function(`return (${js})`)()
+}
+
+function interpolate(template, context) {
+  return String(template).replace(/\$\{\{(.*?)\}\}/g, (_, expression) =>
+    String(evaluate(expression, context)),
+  )
+}
+
+const pushEvent = (sha) => ({
+  github: { event_name: 'push', ref: 'refs/heads/main', sha },
+})
+const pullRequestEvent = (sha) => ({
+  github: { event_name: 'pull_request', ref: 'refs/pull/7/merge', sha },
+})
+
 describe('advisory change impact', () => {
   it('applies every generated-output exclusion to both report scopes', () => {
     const all = readWorkflow('.github/impact-gate/all.yml')
@@ -29,7 +66,7 @@ describe('advisory change impact', () => {
     })
   })
 
-  it('keeps baseline caches compatible and saves only main-push results', () => {
+  it('keeps baseline caches compatible and saves every rebuilt pair', () => {
     const job = readWorkflow(workflowPath).jobs.impact
     const restore = job.steps.find((step) =>
       step.uses?.startsWith('actions/cache/restore@'),
@@ -53,12 +90,94 @@ describe('advisory change impact', () => {
     const save = job.steps.find((step) =>
       step.uses?.startsWith('actions/cache/save@'),
     )
-    expect(save.if).toBe(
-      "github.event_name == 'push' && steps.prepare.outputs.rebuilt == 'true'",
-    )
+    // F4: this used to pin `github.event_name == 'push' && …`, which is the
+    // defect — a PR with no valid base cache rebuilt both scopes (~280 s) on
+    // every synchronize. A PR cache is scoped to the PR ref and cannot clobber
+    // main's, so a rebuilt pair is saved on both events, and never otherwise.
+    for (const event of [pushEvent('a'), pullRequestEvent('b')]) {
+      for (const rebuilt of ['true', 'false']) {
+        const context = {
+          ...event,
+          steps: { prepare: { outputs: { rebuilt } } },
+        }
+        expect(
+          Boolean(evaluate(save.if, context)),
+          `${event.github.event_name}, rebuilt=${rebuilt}`,
+        ).toBe(rebuilt === 'true')
+      }
+    }
     expect(save.with.path).toBe(restore.with.path)
   })
 
+  it('never lets one main push cancel another before its baselines are saved', () => {
+    // F3: a shared `impact-refs/heads/main` group with cancel-in-progress
+    // cancelled a merge's run before "Save main baselines", so that SHA never
+    // got a cache and PRs on it fell back to an ancestor or a full rebuild.
+    const { concurrency } = readWorkflow(workflowPath)
+    const first = interpolate(concurrency.group, pushEvent('1111'))
+    const second = interpolate(concurrency.group, pushEvent('2222'))
+    expect(first).not.toBe(second)
+    // A superseded pull request run is still cancelled.
+    const prA = pullRequestEvent('3333')
+    const prB = pullRequestEvent('4444')
+    expect(interpolate(concurrency.group, prA)).toBe(
+      interpolate(concurrency.group, prB),
+    )
+    expect(String(interpolate(concurrency['cancel-in-progress'], prA))).toBe(
+      'true',
+    )
+  })
+
+  it('installs a fully pinned, hash-checked analysis toolchain', () => {
+    // F5: two top-level pins left PyYAML, Pygments and pathspec floating, with
+    // no hashes and no Dependabot coverage.
+    const requirements = readFileSync(
+      join(REPO_ROOT, '.github/impact-gate/requirements.txt'),
+      'utf8',
+    )
+    const entries = requirements
+      .replace(/\\\n/g, ' ')
+      .split('\n')
+      .map((line) => line.replace(/#.*/, '').trim())
+      .filter(Boolean)
+    const names = entries.map((entry) =>
+      entry
+        .split(/[=<>!~ ;[]/)[0]
+        .toLowerCase()
+        .replace(/_/g, '-'),
+    )
+    expect(names).toEqual(
+      expect.arrayContaining([
+        'impact-gate',
+        'lizard',
+        'pathspec',
+        'pygments',
+        'pyyaml',
+      ]),
+    )
+    for (const entry of entries) {
+      expect(entry, entry).toMatch(/^[\w.-]+==[\w.]+(\s|;)/)
+      expect(entry, entry).toMatch(/--hash=sha256:[0-9a-f]{64}/)
+    }
+    const install = readWorkflow(workflowPath).jobs.impact.steps.find((step) =>
+      step.run?.includes('.github/impact-gate/requirements.txt'),
+    )
+    expect(install.run).toContain('--require-hashes')
+    expect(install.run).toContain('--no-deps')
+
+    const pip = readWorkflow('.github/dependabot.yml').updates.find(
+      (update) =>
+        update['package-ecosystem'] === 'pip' &&
+        update.directory === '/.github/impact-gate',
+    )
+    expect(pip).toBeDefined()
+    expect(pip.cooldown).toEqual({ 'default-days': 7 })
+    expect(pip.ignore).toContainEqual({
+      'dependency-name': '*',
+      'update-types': ['version-update:semver-major'],
+    })
+  })
+
   it('runs the real-CLI checks and reports PRs without masking tool errors', () => {
     const job = readWorkflow(workflowPath).jobs.impact
     const checks = job.steps.find((step) =>