Skip to main content
← Back to list
01Issue
BugShippedSwamp CLIPublic
Assigneesstack72

Relationships

#2212 A config-integrity checksum mismatch fails validate-attestation with no log output

Opened by skunk-ape · 9/16/2026· Shipped 9/16/2026

When validate-attestation fails on a configIntegrity checksum mismatch, the job exits 1 having written nothing to the log. Every other failure path in the job emits a ::error:: annotation; this one does not.

Observed

PR #2475 failed Validate Attestation. The full job log between the step's ##[endgroup] and the runner's ##[error]Process completed with exit code 1. is empty — no annotation, no message, no indication of which check failed or why.

Diagnosing it required reading .github/workflows/ci.yml, enumerating every path that increments errors, eliminating the ones that emit ::error::, and inferring by subtraction that check_hash must have been the culprit. Then confirming which of the eleven hashed files differed, by hand.

Cause

.github/workflows/ci.yml — check_hash():

if [ "$att_hash" = "$actual_hash" ]; then
  echo "✅ \`$label\`" >> "$GITHUB_STEP_SUMMARY"
else
  echo "❌ \`$label\`: checksum mismatch" >> "$GITHUB_STEP_SUMMARY"
  errors=$((errors + 1))
fi

The mismatch is reported only to $GITHUB_STEP_SUMMARY, never to stdout. The same applies to the not in attestation and file not found at commit branches, which increment warnings silently.

By contrast, the version, commit-match, and gate checks all do:

echo "::error::Commit mismatch: attestation=${att_commit:0:8} PR=${head_sha:0:8}"

so those failures surface as annotations on the PR and in the log.

The step summary does contain the detail, but it is a separate artifact from the log — anyone reading the job output, or a tool tailing it, sees an unexplained exit 1.

Suggested fix

Emit an annotation alongside the summary line, and name both hashes so the mismatch is actionable without re-deriving it:

echo "::error::Config integrity mismatch for ${label}: attestation=${att_hash:0:12} actual=${actual_hash:0:12}"

Worth doing the same for the two warning branches with :⚠️:.

Notes

Found while shipping swamp-club#2199. The underlying mismatch in that instance was not a real integrity problem at all — see the companion issue about the job hashing the merge commit rather than the attested commit — which made the silence more costly, since there was no genuine defect to find in the diff.

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPEDTRIAGE+ 2 MOREREVIEW+ 7 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

9/16/2026, 11:45:39 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack729/16/2026, 10:47:35 PM
Editable. Press Enter to edit.

stack72 commented 9/16/2026, 11:45:48 PM

Thanks @skunk-ape for reporting this! We shipped: Add ::error:: and :⚠️: annotations to the check_hash() function in .github/workflows/ci.yml so that config-integrity failures surface in the job log and as PR annotations, matching the behavior of every other failure path in validate-attestation.. The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

Sign in to post a ripple.