[clubanderson]

Run https://github.com/hivecommons/hive/actions/runs/40197595750 (first push-triggered sync after #14199) committed the publish tree and then failed with exit 141: git show --stat | head -40 under set -o pipefail dies with SIGPIPE when head closes the pipe on a 700-file stat. Print a --shortstat summary without a pipe instead.

Also: .hive-sync carries synced_at, so every run saw a staged change and would have committed; a .hive-sync-only diff is now restored and treated as "nothing to commit", so tag-only runs (crux/vX.Y.Z) and re-dispatches tag the existing synced commit instead of adding an empty one.

The first sync was done by hand with the same script (hivecommons/crux#3, hive@1e02ec49d331) while this lands.

Refs #14138

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this repository have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nicholasjackson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

d21f5e9

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head d21f5e9934e6) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/crux-sync.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#14221d21f5e9` sha256:1ada025bd2ef872fa085b58b886d2d6fb136d35336fa931854c8a2f607ebdb82 — download from the dashboard or `hivectl review evidence #14221`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at d21f5e9.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback

[hivecommons-hive]

Read crux-sync.yml on v5 around both hunks. Two things the body claims that I verified in the tree:

• The Push step already runs on steps.tag.outputs.tag != '' regardless of changed (crux-sync.yml:161), and with changed=false the crux-publish HEAD is still crux main, so git push origin HEAD:main is a no-op and the tag lands on the existing synced commit — exactly the "tag-only runs tag the existing synced commit" behaviour described.
• The .hive-sync-only restore runs before the git diff --cached --quiet test, so the early changed=false exit is reached. On a first sync .hive-sync is never the only staged path, so the git restore --staged --worktree from HEAD cannot hit an untracked file.

git show --shortstat --format=... HEAD with no pipe removes the SIGPIPE path. Looks correct to me.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read crux-sync.yml at the PR head end to end, including the Push step. Looks correct to me:

• git --no-pager show --shortstat --format="%H %s" HEAD (line 138) has no pipe, so there is nothing left for pipefail to turn into exit 141; set -euo pipefail is on in that step (line 118).
• The .hive-sync-only case (lines 122-125): git restore --staged --worktree .hive-sync runs before git diff --cached --quiet, so a timestamp-only diff now yields changed=false. The Push step is gated on changed == 'true' || tag != '' and tags $(git rev-parse HEAD) (lines 174, 212-216), so a tag-only run tags the existing synced commit exactly as the body says.

One note, not a defect: on a changed=false run the restore also reverts the worktree copy, so the crux-publish-tree artifact carries the previous .hive-sync timestamp/hive SHA rather than this run's. Fine for a 7-day debugging artifact; mentioning it only so it isn't a surprise.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88