Summary
The sdd-spec workflow opened gominimal/minimal#658 as the spec PR for gominimal/minimal#583. A spec PR must be spec-only (touch docs/specs/** and nothing else), but its single generated commit (061fd00d) bundled a stale revert of CI/release files alongside the spec:
.github/workflows/release.yml — dropped the build-libkrun-macos-arm64 job, the informational otool steps, and the bundle dependency (−69 lines)scripts/stage-release.sh — dropped the libkrun artifact staging (−5 lines)
Both blocks had just landed in gominimal/minimal#655 (build + ship libkrun on MacOS). The spec PR effectively reverted #655.
This also violates the standing guardrail that SDD agents are barred from editing .github/workflows — yet an sdd-spec PR shipped a workflow diff.
Impact
Had gominimal/minimal#658 merged as-is, it would have silently reverted #655, removing the shipped macOS libkrun dylib from releases. CodeRabbit mis-read the leak as an intentional "simplified the macOS ARM64 release flow" change, so review signal did not flag it as a regression.
Likely root cause
061fd00d sits directly on top of 29e9f6a4 (#655's merge) yet its diff removes #655's lines. That is consistent with the workflow committing from a stale working tree (a checkout/reset predating #655) and running git add -A / git commit -a, capturing the old release.yml/stage-release.sh as deletions rather than staging only the new spec file.
Fix already applied downstream
In gominimal/minimal#658:
- Restored both files to
main (ci(release): restore libkrun macOS build dropped by spec-PR leak)
- Net PR diff is now spec-only (the single spec
.md)
- CodeRabbit review addressed in a separate commit
Requested hardening (in sdd-spec)
- Stage only the generated spec path (explicit
git add docs/specs/<id>/…), never git add -A / git commit -a.
- Add a diff guard that fails the run if a spec PR touches any path outside
docs/specs/**.
- Ensure the workflow checks out
main at HEAD (or rebases) before generating, so it never commits from a stale tree.
Summary
The
sdd-specworkflow opened gominimal/minimal#658 as the spec PR for gominimal/minimal#583. A spec PR must be spec-only (touchdocs/specs/**and nothing else), but its single generated commit (061fd00d) bundled a stale revert of CI/release files alongside the spec:.github/workflows/release.yml— dropped thebuild-libkrun-macos-arm64job, the informationalotoolsteps, and thebundledependency (−69 lines)scripts/stage-release.sh— dropped the libkrun artifact staging (−5 lines)Both blocks had just landed in gominimal/minimal#655 (
build + ship libkrun on MacOS). The spec PR effectively reverted #655.This also violates the standing guardrail that SDD agents are barred from editing
.github/workflows— yet ansdd-specPR shipped a workflow diff.Impact
Had gominimal/minimal#658 merged as-is, it would have silently reverted #655, removing the shipped macOS libkrun dylib from releases. CodeRabbit mis-read the leak as an intentional "simplified the macOS ARM64 release flow" change, so review signal did not flag it as a regression.
Likely root cause
061fd00dsits directly on top of29e9f6a4(#655's merge) yet its diff removes #655's lines. That is consistent with the workflow committing from a stale working tree (a checkout/reset predating #655) and runninggit add -A/git commit -a, capturing the oldrelease.yml/stage-release.shas deletions rather than staging only the new spec file.Fix already applied downstream
In gominimal/minimal#658:
main(ci(release): restore libkrun macOS build dropped by spec-PR leak).md)Requested hardening (in
sdd-spec)git add docs/specs/<id>/…), nevergit add -A/git commit -a.docs/specs/**.mainat HEAD (or rebases) before generating, so it never commits from a stale tree.