The repository whose checkouts were born dirty

The probe

Our release decisions bind to a digest of the exact content that was reviewed. Until this change, the digest was computed where the review happened. The new probe recomputes it at merge time, in CI, from a fresh checkout, and refuses to certify if the two disagree.

A probe like this makes a quiet assumption: that cloning a repository and reading it back produces the committed content. That assumption has a known exception, and we were living in it.

The failure

The first CI run reported a digest mismatch on a checkout no one had modified. Git status on a fresh clone showed why:

$ git clone <repo> && cd <repo>
$ git status
  modified:   commercial/README.md   # nobody touched anything

# .gitattributes says:        *.md text eol=lf
# the committed bytes say:    CRLF

The repository declares in .gitattributes that markdown files use LF line endings. One file, commercial/README.md, had been committed with CRLF bytes before that declaration existed. Git resolves the disagreement at checkout time: it materializes the file per the declaration, notices the working copy no longer matches the index, and reports the file as modified even on a fresh clone.

The phantom modification appeared on every fresh clone, and it had been ignored for months. The probe could not ignore it, because a checkout that differs from the committed tree is the condition it exists to catch.

The fix

Renormalize the file so its committed bytes match the declaration: git add --renormalize, one file changed, line endings only. It was the only file in the repository in that state, which the probe verified in the same run.

What generalizes

• A line-ending declaration and the committed bytes can disagree, and Git will not warn you at commit time if the bytes predate the rule. Run git add --renormalize after introducing or changing .gitattributes, and check the result in CI.
• Any system that assumes clean-checkout invariance, including caches keyed on tree content, reproducible builds, and content digests, inherits this failure mode silently.
• A new probe that fails on its first run is doing its job. The months of green before it existed were not health; they were the absence of measurement.

Sources: the probe ships in the governor workflow; the decision records are public. How our release gates work · The production-ready guide