From 45acbba88da9094e283435fe38222b06ab613dff Mon Sep 17 00:00:00 2001
From: AxelNoun <150222552+AxelNoun@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:00:21 +0200
Subject: [PATCH] CI: fail when the ephy_testing_data HEAD hash cannot be
 resolved

The hash step wrote `dataset_hash=$(git ls-remote ... | cut -f1)` with
echo, so its exit status was the one of echo. When git ls-remote failed
against gin (HTTP 403, connection failure), the step stayed green, wrote
an empty dataset_hash and the cache key degraded to `Linux-datasets-`.

Enable pipefail, test both the assignment and the emptiness of the result,
emit an ::error:: annotation and exit 1. The step id and names are
unchanged, so steps.ephy_testing_data.outputs.dataset_hash still resolves.

See #1896.
---
 .github/workflows/caches_cron_job.yml | 7 ++++++-
 .github/workflows/io-test.yml         | 7 ++++++-
 .github/workflows/plexon2-testing.yml | 7 ++++++-
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/caches_cron_job.yml b/.github/workflows/caches_cron_job.yml
index 4bbfef049..4b1046aee 100644
--- a/.github/workflows/caches_cron_job.yml
+++ b/.github/workflows/caches_cron_job.yml
@@ -70,7 +70,12 @@ jobs:
       - name: Get current hash (SHA) of the ephy_testing_data repo
         id: ephy_testing_data
         run: |
-          echo "dataset_hash=$(git ls-remote https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git HEAD | cut -f1)" >> $GITHUB_OUTPUT
+          set -o pipefail
+          if ! hash="$(git ls-remote https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git HEAD | cut -f1)" || [ -z "$hash" ]; then
+            echo "::error::could not resolve ephy_testing_data HEAD on gin; refusing to build a degenerate cache key"
+            exit 1
+          fi
+          echo "dataset_hash=$hash" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache@v3
         # Loading cache of ephys_testing_dataset
diff --git a/.github/workflows/io-test.yml b/.github/workflows/io-test.yml
index 341f9e5a3..5815d3cd6 100644
--- a/.github/workflows/io-test.yml
+++ b/.github/workflows/io-test.yml
@@ -42,7 +42,12 @@ jobs:
         # the key depend on the last commit repo https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git
         id: ephy_testing_data
         run: |
-          echo "dataset_hash=$(git ls-remote https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git HEAD | cut -f1)" >> $GITHUB_OUTPUT
+          set -o pipefail
+          if ! hash="$(git ls-remote https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git HEAD | cut -f1)" || [ -z "$hash" ]; then
+            echo "::error::could not resolve ephy_testing_data HEAD on gin; refusing to build a degenerate cache key"
+            exit 1
+          fi
+          echo "dataset_hash=$hash" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache/restore@v4
         # Loading cache of ephys_testing_dataset
diff --git a/.github/workflows/plexon2-testing.yml b/.github/workflows/plexon2-testing.yml
index 6cdb3e366..28005f404 100644
--- a/.github/workflows/plexon2-testing.yml
+++ b/.github/workflows/plexon2-testing.yml
@@ -33,7 +33,12 @@ jobs:
         # the key depend on the last commit repo https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git
         id: ephy_testing_data
         run: |
-          echo "dataset_hash=$(git ls-remote https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git HEAD | cut -f1)" >> $GITHUB_OUTPUT
+          set -o pipefail
+          if ! hash="$(git ls-remote https://gin.g-node.org/NeuralEnsemble/ephy_testing_data.git HEAD | cut -f1)" || [ -z "$hash" ]; then
+            echo "::error::could not resolve ephy_testing_data HEAD on gin; refusing to build a degenerate cache key"
+            exit 1
+          fi
+          echo "dataset_hash=$hash" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache/restore@v4
         # Loading cache of ephys_testing_dataset