Skip to content

chore(scorecard): drop anc.commit field + ANC_COMMIT computation - #47

Merged
brettdavies merged 1 commit into
devfrom
chore/drop-anc-commit
May 1, 2026
Merged

chore(scorecard): drop anc.commit field + ANC_COMMIT computation#47
brettdavies merged 1 commit into
devfrom
chore/drop-anc-commit

Conversation

@brettdavies

@brettdavies brettdavies commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

Removes per-build Git SHA capture from build.rs and the corresponding anc.commit field from the scorecard JSON. The version pin in anc.version is sufficient build identity for scorecard consumers, and the cargo:rerun-if-changed watches on .git/HEAD, .git/refs/heads/<branch>, .git/packed-refs made cached-build SHAs fragile across local commits without solving the underlying staleness problem cleanly.

Schema impact: anc.commit was added in scorecard 0.4 (v0.2.0). Schema 0.5 (the badge block, on dev now) has not yet tagged to main; the v0.3.0 tag will ship 0.5 without anc.commit baked in. No public consumer of the field exists pre-launch.

Net change: 6 files, +19/-101 lines. Code path simpler; one less moving part in the build.

Changelog

Changed

  • --output json scorecard anc block no longer includes a commit field. anc.version (the crate version pin) remains as the build identity. Removed because the per-build Git SHA capture made cached builds fragile (stale SHAs across local commits) without solving any consumer-facing problem; anc.version already identifies the released binary unambiguously, and pre-launch no public consumer of anc.commit exists.

Type of Change

  • chore: Maintenance tasks (dependencies, config, etc.)

Related Issues/Stories

  • Story: removed during v0.3.0 release prep. The SHA capture was added in 0.4 but the value was never consumed downstream (site doesn't archive per-run, leaderboard pins tool.version not anc.commit), and the .git/-watching cargo:rerun-if-changed directives made cached cargo build outputs embed stale SHAs unless the operator did a full rebuild after every commit. The version pin is enough.
  • Issue: n/a; pre-launch cleanup.
  • Architecture: build.rs::emit_build_info simplified (drops the git rev-parse branch, the three cargo:rerun-if-changed watches, and the std::process::Command import). src/scorecard/mod.rs::AncInfo now has just the version field. CLAUDE.md ## Scorecard v0.5 Fields updated to document the removal.
  • Related PRs: rides the v0.3.0 release alongside docs(releases): replace one-way leak check with triple-diff verification #45 (triple-diff RELEASES.md edit) and docs(releases): add squash-merge triage guidance to git cherry step #46 (cherry-triage guidance); all merged to dev, all cherry-picked into release/v0.3.0.

Testing

  • Unit tests added/updated
  • Integration tests added/updated
  • Manual testing completed
  • All tests passing

Test Summary:

  • Unit tests: 535+ passing; cargo test --quiet green across all 80 test binaries.
  • Integration tests: 51 passing in tests/integration.rs; 10/11 (1 ignored) in tests/skill_install.rs; 51 schema-drift tests in tests/scorecard_schema_v05.rs (one less than before, since anc.commit was removed from the key-existence assertion list); 6 in tests/scorecard_metadata_security.rs.
  • Coverage: cargo clippy --all-targets -- -Dwarnings green; cargo test green.
  • Removed tests: anc_commit_when_present_looks_like_short_sha (no longer applicable; ANC_COMMIT doesn't exist).

Files Modified

Modified:

  • build.rs: emit_build_info simplified to write only ANC_VERSION. Drops the git rev-parse --short HEAD branch, three cargo:rerun-if-changed directives on .git/, and the std::process::Command import (now unused).
  • src/build_info.rs: module doc updated; dropped the anc_commit_when_present_looks_like_short_sha test.
  • src/main.rs: drops ANC_COMMIT import and the commit: ANC_COMMIT initializer in the AncInfo literal.
  • src/scorecard/mod.rs: AncInfo shrinks to just version: &'static str. Test fixtures and the schema_v05_emits_every_documented_key assertion list drop anc.commit.
  • tests/scorecard_schema_v05.rs: same drop from this binary's key list.
  • CLAUDE.md: ## Scorecard v0.5 Fields anc bullet rewritten to describe the simpler shape and reference the removal rationale.

Created:

  • None.

Renamed:

  • None.

Deleted:

  • None (no files removed; only fields/code/tests/doc lines).

Breaking Changes

  • No breaking changes

anc.commit shipped first in scorecard 0.4 (v0.2.0). Schema 0.5 (with badge) is on dev but has not been tagged to main; the v0.3.0 tag will ship 0.5 without anc.commit. There is no public consumer of the field today (the agentnative-site registry doesn't reference it; the site's leaderboard pins tool.version). Pre-launch field removal is within the documented 0.x flexibility.

Deployment Notes

  • No special deployment steps required

Checklist

  • Code follows project conventions and style guidelines
  • Commit messages follow Conventional Commits
  • Self-review of code completed
  • Tests added/updated and passing
  • No new warnings or errors introduced
  • Changes are backward compatible (or breaking changes documented)

@brettdavies
chore(scorecard): drop anc.commit field + ANC_COMMIT computation
b37f0d2 
Removes per-build Git SHA capture from build.rs and the corresponding
'anc.commit' field from the scorecard JSON. The version pin in
'anc.version' is sufficient build identity for scorecard consumers, and
the cargo:rerun-if-changed watches on .git/HEAD, .git/refs/heads/<branch>,
and .git/packed-refs made cached-build SHAs fragile across local commits
without solving the underlying staleness problem cleanly.

Schema impact: 'anc.commit' was added in scorecard 0.4. Schema 0.5
(badge block) is in dev but not yet tagged to main — the v0.3.0 tag will
ship 0.5 without 'anc.commit'. No public consumer of the field exists
pre-launch.

Files touched:

  - build.rs                      drop emit_build_info's commit branch +
                                  std::process::Command import
  - src/build_info.rs             drop ANC_COMMIT module-doc + test
  - src/main.rs                   drop ANC_COMMIT import + initializer
  - src/scorecard/mod.rs          drop AncInfo.commit field + test refs
  - tests/scorecard_schema_v05.rs drop 'anc.commit' from key list
  - CLAUDE.md                     update '0.4 additions' anc bullet

Suite green: 535+ unit, full integration, clippy -Dwarnings clean.
@brettdavies
brettdavies merged commit b74e1f4 into dev May 1, 2026
7 checks passed
@brettdavies
brettdavies deleted the chore/drop-anc-commit branch May 1, 2026 09:20
brettdavies added a commit that referenced this pull request May 1, 2026
@brettdavies
chore(scorecard): drop anc.commit field + ANC_COMMIT computation (#47)
3c23240 
## Summary

Removes per-build Git SHA capture from `build.rs` and the corresponding
`anc.commit` field from the scorecard JSON. The version pin in
`anc.version` is sufficient build identity for scorecard consumers, and
the `cargo:rerun-if-changed` watches on `.git/HEAD`,
`.git/refs/heads/<branch>`, `.git/packed-refs` made cached-build SHAs
fragile across local commits without solving the underlying staleness
problem cleanly.

**Schema impact**: `anc.commit` was added in scorecard 0.4 (v0.2.0).
Schema 0.5 (the `badge` block, on dev now) has not yet tagged to `main`
— the v0.3.0 tag will ship 0.5 without `anc.commit` baked in. No public
consumer of the field exists pre-launch.

Net change: 6 files, +19/-101 lines. Code path simpler; one less moving
part in the build.

## Changelog

### Changed

- `--output json` scorecard `anc` block no longer includes a `commit`
field. `anc.version` (the crate version pin) remains as the build
identity. Removed because the per-build Git SHA capture made cached
builds fragile (stale SHAs across local commits) without solving any
consumer-facing problem — `anc.version` already identifies the released
binary unambiguously, and pre-launch no public consumer of `anc.commit`
exists.

## Type of Change

- [x] `chore`: Maintenance tasks (dependencies, config, etc.)

## Related Issues/Stories

- Story: removed during v0.3.0 release prep — the SHA capture was added
in 0.4 but the value was never consumed downstream (site doesn't archive
per-run, leaderboard pins `tool.version` not `anc.commit`), and the
`.git/`-watching `cargo:rerun-if-changed` directives made cached `cargo
build` outputs embed stale SHAs unless the operator did a full rebuild
after every commit. The version pin is enough.
- Issue: n/a — pre-launch cleanup.
- Architecture: `build.rs::emit_build_info` simplified (drops the git
rev-parse branch, the three `cargo:rerun-if-changed` watches, and the
`std::process::Command` import). `src/scorecard/mod.rs::AncInfo` now has
just the `version` field. CLAUDE.md `## Scorecard v0.5 Fields` updated
to document the removal.
- Related PRs: rides the v0.3.0 release alongside #45 (triple-diff
RELEASES.md edit) and #46 (cherry-triage guidance) — all merged to
`dev`, all cherry-picked into `release/v0.3.0`.

## Testing

- [ ] Unit tests added/updated
- [ ] Integration tests added/updated
- [x] Manual testing completed
- [x] All tests passing

**Test Summary:**

- Unit tests: 535+ passing — `cargo test --quiet` green across all 80
test binaries.
- Integration tests: 51 passing in `tests/integration.rs`; 10/11 (1
ignored) in `tests/skill_install.rs`; 51 schema-drift tests in
`tests/scorecard_schema_v05.rs` (one less than before — `anc.commit`
removed from the key-existence assertion list); 6 in
`tests/scorecard_metadata_security.rs`.
- Coverage: `cargo clippy --all-targets -- -Dwarnings` green; `cargo
test` green.
- Removed tests: `anc_commit_when_present_looks_like_short_sha` (no
longer applicable — `ANC_COMMIT` doesn't exist).

## Files Modified

**Modified:**

- `build.rs` — `emit_build_info` simplified to write only `ANC_VERSION`.
Drops the git `rev-parse --short HEAD` branch, three
`cargo:rerun-if-changed` directives on `.git/`, and the
`std::process::Command` import (now unused).
- `src/build_info.rs` — module doc updated; dropped the
`anc_commit_when_present_looks_like_short_sha` test.
- `src/main.rs` — drops `ANC_COMMIT` import and the `commit: ANC_COMMIT`
initializer in the `AncInfo` literal.
- `src/scorecard/mod.rs` — `AncInfo` shrinks to just `version: &'static
str`. Test fixtures and the `schema_v05_emits_every_documented_key`
assertion list drop `anc.commit`.
- `tests/scorecard_schema_v05.rs` — same drop from this binary's key
list.
- `CLAUDE.md` — `## Scorecard v0.5 Fields` `anc` bullet rewritten to
describe the simpler shape and reference the removal rationale.

**Created:**

- None.

**Renamed:**

- None.

**Deleted:**

- None (no files removed; only fields/code/tests/doc lines).

## Breaking Changes

- [x] No breaking changes

`anc.commit` shipped first in scorecard 0.4 (v0.2.0). Schema 0.5 (with
`badge`) is on `dev` but has not been tagged to `main` — the v0.3.0 tag
will ship 0.5 without `anc.commit`. There is no public consumer of the
field today (the `agentnative-site` registry doesn't reference it; the
site's leaderboard pins `tool.version`). Pre-launch field removal is
within the documented `0.x` flexibility.

## Deployment Notes

- [x] No special deployment steps required

## Checklist

- [x] Code follows project conventions and style guidelines
- [x] Commit messages follow [Conventional
Commits](https://www.conventionalcommits.org/)
- [x] Self-review of code completed
- [x] Tests added/updated and passing
- [x] No new warnings or errors introduced
- [x] Changes are backward compatible (or breaking changes documented)
@brettdavies brettdavies mentioned this pull request May 1, 2026
Merged
16 tasks
brettdavies added a commit that referenced this pull request May 1, 2026
@brettdavies
release: v0.3.0 (#44)
8789d09 
## Summary

v0.3.0 promotes 15 PRs from `dev` to `main`. Headline: scorecard schema
bumps `0.3` → `0.5` (cumulative — `anc.commit` removed before tag), a
new `anc skill install <host>` subcommand with hardened `git clone` +
build-time host-map codegen, and a published agent-native badge surface
(text-mode hint + JSON `badge` block) gated on a 80% eligibility floor.
Plus PII fix on `target.path`, source-quality cleanup, README refresh,
cross-repo sync map, and tooling-side hardening (PR template
`**Renamed:**` subsection, `sync-spec` modernization,
`sync-skill-fixture` drift gate, triple-diff release-flow check with
squash-merge triage guidance).

The release-prep also surfaced four corrections that came in via the
canonical PR-to-dev flow during this ship: `#43` resynced the
`skill.json` build-time fixture against upstream `agentnative-site/dev`
(drift was blocking every open PR); `#42` corrected cross-repo URLs in
`.github/ISSUE_TEMPLATE/` (broken since the v0.1.1 squash on `main`);
`#45` replaced the release-flow's single-direction leak check with a
triple-diff plus `git cherry` patch-id check (the latter caught the URL
drift that motivated the change); `#46` added squash-merge-noise triage
guidance to the `git cherry` step (the check produced 55 noisy `+` lines
on first run, all expected, but the original comment didn't explain
that). `#47` dropped the `anc.commit` field from the scorecard JSON
before the v0.3.0 tag, since the `cargo:rerun-if-changed` `.git/`
watches made cached builds fragile and `anc.version` is sufficient build
identity.

## Changelog

<!-- Per the changelog generation rules, the canonical changelog is in
CHANGELOG.md.
This release section reflects the same content; generate-changelog.sh
extracts
from each contributing PR's ## Changelog block. The bullets below are a
     curated highlight set for the PR body itself. -->

### Added

- `anc skill install <host>` subcommand for six hosts (`claude_code`,
`codex`, `cursor`, `factory`, `kiro`, `opencode`) with `--dry-run` and
`--output {text,json}` flags and a uniform JSON envelope across success,
error, and dry-run paths (#35).
- Scorecard `--output json` self-describing metadata: four top-level
blocks (`tool`, `anc`, `run`, `target`) + a `badge` block with
`eligible`, `score_pct`, `embed_markdown`, `scorecard_url`, `badge_url`,
`convention_url` (#34, #36).
- `--output text` post-summary agent-native badge embed hint when the
tool clears the 80% eligibility floor; "do not nag" rule below (#36).

### Changed

- Scorecard `schema_version` bumped `0.3` → `0.4` → `0.5` (cumulative —
`anc.commit` field removed before the v0.3.0 tag, see #47) (#34, #36).
- `sync-spec.sh` modernized — remote-first tag resolution, `SPEC_REF`
env override removed (#33).
- `p7-naked-println` source check now exempts `build.rs` at any crate
root (#38).
- README refreshed for current state (schema 0.5, badge block,
`--audit-profile`, basename `target.path`); `rust-version` bumped `1.87`
→ `1.88` (#34, #40).
- `--output json` scorecard `anc` block no longer includes a `commit`
field — `anc.version` is the build identity (#47).

### Fixed

- `target.path` in `--output json` now emits the basename of the
resolved target instead of the canonicalized absolute path — eliminates
a home-dir / username PII leak that flowed into committed scorecards,
badge URLs, and agent-posted artifacts (#39).
- Eliminated four `.unwrap()` calls on infallible paths across
`src/skill_install.rs` and `build.rs`, replaced with `.expect("…")`
naming the contract (#38).
- Cross-repo URLs in `.github/ISSUE_TEMPLATE/` corrected: spec →
`agentnative`, site → `agentnative-site`, double-`cli` typo →
`agentnative-cli` (#42).

### Documentation

- `scripts/SYNCS.md` cross-repo sync map (#41).
- `RELEASES.md` § "After publish — sync `dev` with the release" + new
`sync-dev-after-release.sh` script formalizing the post-publish backport
convention (#37).
- `RELEASES.md` § "Releasing dev to main" step 4 replaced with a
triple-diff verification block (A: main→release, B: release→dev, C:
dev→main) plus a `git cherry` patch-id check (#45), with
squash-merge-noise triage guidance added in #46.
- README `## Install the skill` section + `[![agent-native]]` badge row
(#35, #40).

## Type of Change

- [x] `feat`: New feature (non-breaking change which adds functionality)
- [x] `fix`: Bug fix (non-breaking change which fixes an issue)
- [x] `chore`: Maintenance tasks (dependencies, config, etc.)
- [x] `docs`: Documentation update

## Related Issues/Stories

- Story: v0.3.0 release — twelve PRs across two days of work post-v0.2.0
plus four release-prep PRs (#42, #43, #45, #46) opened during the
release ceremony to fix issues caught by the new triple-diff
verification, plus #47 dropping `anc.commit` before the tag.
- Issue: n/a
- Architecture: scorecard schema evolution (`0.3 → 0.4 → 0.5`) covered
in CLAUDE.md `## Scorecard v0.5 Fields`; skill-install architecture
covered in CLAUDE.md `## Skill Install Verb`; release ceremony in
`RELEASES.md`.
- Related PRs: #30, #33, #34, #35, #36, #37, #38, #39, #40, #41, #42,
#43, #45, #46, #47 — all merged to `dev` and cherry-picked here in
chronological order.

## Testing

- [x] Unit tests added/updated
- [x] Integration tests added/updated
- [x] Manual testing completed
- [x] All tests passing

**Test Summary:**

- Unit tests: 535+ passing across all #34, #35, #36, #38, #39 PRs
(counts varied as PRs landed). #47 simplified to ~520+ after dropping
the `anc_commit_when_present_looks_like_short_sha` test.
- Integration tests: full suite green at every cherry-pick step. New
tests added: `tests/scorecard_metadata_security.rs` (red-team
regressions for hostile binaries), `tests/scorecard_schema_v05.rs`
(schema drift guard with `target.path` regression test),
`tests/skill_install.rs` (10 active + 1 ignored e2e), `tests/dogfood.rs`
(p2/p5 dogfood guards).
- Coverage: pre-push hook (CI mirror) green at every step — fmt, clippy
`-Dwarnings`, full test suite, cargo-deny, Windows compat (libc grep +
cross-target clippy).
- Triple-diff verification (the new step from #45) confirmed only
`docs/plans/`, `docs/brainstorms/`, `docs/ideation/` (guarded paths) and
the `docs/solutions` symlink remain on dev. Release-prep files
(`CHANGELOG.md`, `Cargo.{toml,lock}`, `completions/*`) will backport to
dev via `scripts/sync-dev-after-release.sh` post-publish per the
convention from #37. The `git cherry` patch-id check produced 55 `+`
lines on first run; all audited as expected (squash-merge patch-id
mismatch + conflict-resolution drift + intentional skips), zero real
misses — motivated #46's triage guidance.

## Files Modified

**Modified:**

- `Cargo.toml`, `Cargo.lock` — version `0.2.0 → 0.3.0`; `time =
"=0.3.47"` added; `rust-version` bumped.
- `CHANGELOG.md` — v0.3.0 release notes prepended.
- `README.md`, `AGENTS.md`, `CLAUDE.md` — updated for schema 0.4/0.5,
skill-install architecture, audit-profile, basename `target.path`, badge
surface, `anc.commit` removal.
- `RELEASES.md` — post-publish backport step (#37); skill-fixture sync
step; step 4 replaced with triple-diff + `git cherry` check (#45);
squash-merge triage guidance added (#46).
- `build.rs` — `emit_skill_hosts` codegen, `ANC_VERSION` emission (no
longer Git-SHA-aware after #47).
- `src/build_info.rs` — `ANC_VERSION` re-export; `ANC_COMMIT` and its
test removed in #47.
- `src/main.rs`, `src/cli.rs`, `src/error.rs`, `src/scorecard/mod.rs`,
`src/argv.rs` — schema 0.4/0.5 metadata, skill-install dispatch, badge
computation, basename helper. `AncInfo` shrinks to one field after #47.
- `src/checks/source/rust/naked_println.rs` — build.rs exemption.
- `src/skill_install/skill.json` — fixture refresh (`source.commit` pin
and `verify` block removed by upstream).
- `scripts/sync-spec.sh` — remote-first, `SPEC_REF` removed.
- `scripts/hooks/pre-push` — Windows cross-clippy step.
- `.github/pull_request_template.md` — `**Renamed:**` sub-header.
-
`.github/ISSUE_TEMPLATE/{config,false-positive,feature-request,scoring-bug}.yml`
— corrected cross-repo URLs.
- `completions/anc.{bash,zsh,fish,elvish,powershell}` — regenerated.

**Created:**

- `src/output.rs`, `src/skill_install.rs`,
`src/skill_install/skill.json`.
- `tests/dogfood.rs`, `tests/scorecard_metadata_security.rs`,
`tests/scorecard_schema_v05.rs`, `tests/skill_install.rs`,
`tests/fixtures/hostile-{hang,nonzero-exit,stdout-flood}/probe.sh`.
- `scripts/sync-skill-fixture.sh`, `scripts/sync-dev-after-release.sh`,
`scripts/SYNCS.md`.
- `.github/workflows/skill-fixture-drift.yml`.
- `.github/ISSUE_TEMPLATE/00-blank.yml`.

**Renamed:**

- `tests/scorecard_schema_v04.rs` → `tests/scorecard_schema_v05.rs`
(drift guard now covers `badge.*` keys).
- `tests/fixtures/skill.json` → `src/skill_install/skill.json` (codegen
needs to read from a path inside cargo's package).

**Deleted:**

- `.github/ISSUE_TEMPLATE/grade-a-cli.yml`, `pressure-test.yml`,
`spec-question.yml` — duplicates of the spec repo's set; routed via
`config.yml`.
- `src/build_info.rs::ANC_COMMIT` const (and its test) — dropped before
tag, see #47.

## Breaking Changes

- [x] No breaking changes

The scorecard `schema_version` bumps (`0.3` → `0.4` → `0.5`) are
additive within the documented `0.x` pre-launch policy. Pre-`0.4`
consumers feature-detect the four metadata blocks; pre-`0.5` consumers
feature-detect the `badge` key. `target.path` value semantics changed
(basename instead of absolute path) — schema shape is unchanged, so
consumers reading the field at all will continue to parse it; consumers
using it for cross-host correlation should already have migrated to
`tool.name`. `anc.commit` was added in 0.4 but removed before the v0.3.0
tag (#47); no public consumer of the field exists pre-launch.

## Deployment Notes

- [x] No special deployment steps required

Standard pipeline: tag push triggers crates.io publish (Trusted
Publishing, OIDC), GitHub Release with all 5 platform archives +
sha256sums, then dispatch to `brettdavies/homebrew-tap` for formula
update. After `finalize-release.yml` flips `make_latest: true`, run
`./scripts/sync-dev-after-release.sh v0.3.0` to backport `Cargo.toml`,
`Cargo.lock`, `CHANGELOG.md` to dev (new convention from #37).

## Checklist

- [x] Code follows project conventions and style guidelines
- [x] Commit messages follow [Conventional
Commits](https://www.conventionalcommits.org/)
- [x] Self-review of code completed
- [x] Tests added/updated and passing
- [x] No new warnings or errors introduced
- [x] Changes are backward compatible (or breaking changes documented)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brettdavies