From c5c37612e187c96d4cd08c20aab58b54aa0fa39f Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Wed, 29 Jul 2026 14:25:33 +0200 Subject: [PATCH 1/9] ci: build DevHub with pnpm + frozen lockfile in devhub-validation DevHub is a pnpm-only repo (commits only pnpm-lock.yaml, packageManager pnpm@10.11.0). The devhub-validation job installed it with `npm install`, which ignores the committed lock and does a floating, non-reproducible resolve on every run. A transitive dep publishing overnight was enough to shift the hoist and pull @databricks/appkit-ui/react into Next's react-server graph, crashing `next build` with `TypeError: b.createContext is not a function` on a job that passed the day before with no source change. Build DevHub the way DevHub's own CI does: pnpm install --frozen-lockfile and pnpm build. This makes the job reproducible and stops it silently mis-testing via a package manager DevHub never uses. Signed-off-by: Pawel Kosiec --- .github/workflows/ci.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 13fd1a779..562695e3e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -338,13 +338,21 @@ jobs: - name: Clone DevHub run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub + # DevHub is a pnpm-only repo (commits pnpm-lock.yaml, packageManager: pnpm@10.11.0). + # Build it the way DevHub builds itself so the install is reproducible; using npm here + # ignored the committed lock and did a floating resolve on every run. + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + with: + version: 10.11.0 + run_install: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 22 - name: Install DevHub dependencies working-directory: /tmp/devhub - run: npm install + run: pnpm install --frozen-lockfile - name: Sync AppKit docs from PR branch working-directory: /tmp/devhub @@ -355,5 +363,5 @@ jobs: - name: Build DevHub working-directory: /tmp/devhub - run: npm run build + run: pnpm build From c5c2169dba9e28821cadadff65f0dff33141a5ee Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Wed, 29 Jul 2026 14:25:40 +0200 Subject: [PATCH 2/9] docs: touch readme to trigger devhub-validation Temporary docs-path touch so the docs path filter runs devhub-validation for the CI change in the previous commit. Safe to drop before merge. Signed-off-by: Pawel Kosiec --- docs/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/README.md b/docs/README.md index e09a4e773..db748e84f 100644 --- a/docs/README.md +++ b/docs/README.md @@ -37,3 +37,6 @@ The `pnpm build` command: 2. Runs `apply-redirects` — replaces HTML pages with redirect pages pointing to developers.databricks.com Static files remain served from GitHub Pages: JSON schemas (`/schemas/`), `llms.txt`, and `.md` files (used by `npx @databricks/appkit docs` for npm-bundled documentation). + + + From c5f3bb21ed94c0844e313f7cf58083f134605c37 Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Wed, 29 Jul 2026 14:29:26 +0200 Subject: [PATCH 3/9] ci: let pnpm/action-setup read pnpm version from packageManager Passing an explicit version: input conflicts with this repo's packageManager field (pnpm@10.21.0), and action-setup errors out. Match the other jobs and omit version: so it reads packageManager. pnpm 10.x reads DevHub's lockfileVersion 9.0 fine. Signed-off-by: Pawel Kosiec --- .github/workflows/ci.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 562695e3e..b0c43b98d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -338,13 +338,12 @@ jobs: - name: Clone DevHub run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub - # DevHub is a pnpm-only repo (commits pnpm-lock.yaml, packageManager: pnpm@10.11.0). - # Build it the way DevHub builds itself so the install is reproducible; using npm here - # ignored the committed lock and did a floating resolve on every run. + # DevHub is a pnpm-only repo (commits pnpm-lock.yaml). Build it the way DevHub builds + # itself so the install is reproducible; using npm here ignored the committed lock and + # did a floating resolve on every run. No `version:` input — action-setup reads it from + # this repo's packageManager field, matching the other jobs (pnpm 10.x reads DevHub's + # lockfileVersion 9.0 fine). - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - with: - version: 10.11.0 - run_install: false - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: From f57924d16f824d1d68a0ee344059294003d531cd Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Wed, 29 Jul 2026 15:13:03 +0200 Subject: [PATCH 4/9] ci: drop redundant comment in devhub-validation Signed-off-by: Pawel Kosiec --- .github/workflows/ci.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b0c43b98d..df46a9b01 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -338,11 +338,6 @@ jobs: - name: Clone DevHub run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub - # DevHub is a pnpm-only repo (commits pnpm-lock.yaml). Build it the way DevHub builds - # itself so the install is reproducible; using npm here ignored the committed lock and - # did a floating resolve on every run. No `version:` input — action-setup reads it from - # this repo's packageManager field, matching the other jobs (pnpm 10.x reads DevHub's - # lockfileVersion 9.0 fine). - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 From ed72476d9ccd441b6d0dfeac81e8843792ec571f Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Wed, 29 Jul 2026 15:42:33 +0200 Subject: [PATCH 5/9] Revert testing change --- docs/README.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/docs/README.md b/docs/README.md index db748e84f..e09a4e773 100644 --- a/docs/README.md +++ b/docs/README.md @@ -37,6 +37,3 @@ The `pnpm build` command: 2. Runs `apply-redirects` — replaces HTML pages with redirect pages pointing to developers.databricks.com Static files remain served from GitHub Pages: JSON schemas (`/schemas/`), `llms.txt`, and `.md` files (used by `npx @databricks/appkit docs` for npm-bundled documentation). - - - From 96ee7933ca4142eafeabc4f759b65fbf2ee3de56 Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Thu, 30 Jul 2026 11:20:35 +0200 Subject: [PATCH 6/9] ci: extract reusable DevHub build workflow + add nightly run Move the devhub-validation build steps into a reusable workflow (devhub-build.yml, workflow_call) so the per-PR job and a new nightly share one definition instead of duplicating steps. - ci.yml devhub-validation now calls the reusable workflow, passing the PR's remote/ref; gating (needs detect-changes, docs filter) unchanged. - devhub-nightly.yml runs the same build daily against appkit main, to catch DevHub-side breaks that land between docs PRs. Failures surface via GitHub's built-in scheduled-workflow-failure email. Both callers grant id-token: write so the JFrog OIDC step keeps working. Signed-off-by: Pawel Kosiec --- .github/workflows/ci.yml | 40 ++++--------------- .github/workflows/devhub-build.yml | 58 ++++++++++++++++++++++++++++ .github/workflows/devhub-nightly.yml | 20 ++++++++++ 3 files changed, 85 insertions(+), 33 deletions(-) create mode 100644 .github/workflows/devhub-build.yml create mode 100644 .github/workflows/devhub-nightly.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index df46a9b01..212e06a89 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -325,37 +325,11 @@ jobs: name: DevHub Build Validation needs: detect-changes if: needs.detect-changes.outputs.docs == 'true' - runs-on: - group: databricks-protected-runner-group - labels: linux-ubuntu-latest - - steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - - name: Setup JFrog npm - uses: ./.github/actions/setup-jfrog-npm - - - name: Clone DevHub - run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub - - - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: 22 - - - name: Install DevHub dependencies - working-directory: /tmp/devhub - run: pnpm install --frozen-lockfile - - - name: Sync AppKit docs from PR branch - working-directory: /tmp/devhub - env: - APPKIT_REMOTE: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }} - APPKIT_BRANCH: ${{ github.head_ref || github.ref_name }} - run: node scripts/sync-appkit-docs.mjs --force - - - name: Build DevHub - working-directory: /tmp/devhub - run: pnpm build + permissions: + contents: read + id-token: write + uses: ./.github/workflows/devhub-build.yml + with: + appkit-remote: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }} + appkit-ref: ${{ github.head_ref || github.ref_name }} diff --git a/.github/workflows/devhub-build.yml b/.github/workflows/devhub-build.yml new file mode 100644 index 000000000..6f6635c02 --- /dev/null +++ b/.github/workflows/devhub-build.yml @@ -0,0 +1,58 @@ +name: DevHub Build + +# Reusable workflow: clones DevHub, syncs AppKit docs from the given ref, and runs +# DevHub's build to validate that our docs build inside the actual consumer site. +# Called by ci.yml (per-PR) and devhub-nightly.yml (scheduled against main). + +on: + workflow_call: + inputs: + appkit-remote: + description: "Git URL to sync AppKit docs from" + type: string + default: "https://github.com/databricks/appkit.git" + appkit-ref: + description: "AppKit branch/ref to sync docs from" + type: string + default: "main" + +permissions: + contents: read + id-token: write # required for the JFrog OIDC token exchange in setup-jfrog-npm + +jobs: + build: + name: Build DevHub + runs-on: + group: databricks-protected-runner-group + labels: linux-ubuntu-latest + + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Setup JFrog npm + uses: ./.github/actions/setup-jfrog-npm + + - name: Clone DevHub + run: git clone --depth 1 https://github.com/databricks/devhub.git /tmp/devhub + + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 22 + + - name: Install DevHub dependencies + working-directory: /tmp/devhub + run: pnpm install --frozen-lockfile + + - name: Sync AppKit docs + working-directory: /tmp/devhub + env: + APPKIT_REMOTE: ${{ inputs.appkit-remote }} + APPKIT_BRANCH: ${{ inputs.appkit-ref }} + run: node scripts/sync-appkit-docs.mjs --force + + - name: Build DevHub + working-directory: /tmp/devhub + run: pnpm build diff --git a/.github/workflows/devhub-nightly.yml b/.github/workflows/devhub-nightly.yml new file mode 100644 index 000000000..481825f2c --- /dev/null +++ b/.github/workflows/devhub-nightly.yml @@ -0,0 +1,20 @@ +name: DevHub Nightly Build + +# Daily validation that AppKit main docs still build inside DevHub. Catches breaks +# introduced by DevHub-side changes (their deps/framework) between AppKit docs PRs, +# which the per-PR devhub-validation job cannot see. Failures surface via GitHub's +# built-in scheduled-workflow-failure email to whoever last edited this file. + +on: + schedule: + - cron: "0 6 * * *" # 06:00 UTC daily + workflow_dispatch: # allow manual re-run + +permissions: + contents: read + id-token: write + +jobs: + devhub-build: + # No inputs → defaults sync databricks/appkit main and build it against DevHub. + uses: ./.github/workflows/devhub-build.yml From 11b83ca0f284df263d1795cb49ee7711afe31656 Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Thu, 30 Jul 2026 11:25:22 +0200 Subject: [PATCH 7/9] docs: temporary touch to verify devhub-validation (revert before merge) Signed-off-by: Pawel Kosiec --- docs/README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/README.md b/docs/README.md index e09a4e773..cd9e97208 100644 --- a/docs/README.md +++ b/docs/README.md @@ -37,3 +37,6 @@ The `pnpm build` command: 2. Runs `apply-redirects` — replaces HTML pages with redirect pages pointing to developers.databricks.com Static files remain served from GitHub Pages: JSON schemas (`/schemas/`), `llms.txt`, and `.md` files (used by `npx @databricks/appkit docs` for npm-bundled documentation). + + + From eb20a4a168a44e370dc5bc2a3969f77bc1f6ddab Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Thu, 30 Jul 2026 11:25:46 +0200 Subject: [PATCH 8/9] ci: tighten devhub-nightly comment Signed-off-by: Pawel Kosiec --- .github/workflows/devhub-nightly.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/devhub-nightly.yml b/.github/workflows/devhub-nightly.yml index 481825f2c..911e8ea0f 100644 --- a/.github/workflows/devhub-nightly.yml +++ b/.github/workflows/devhub-nightly.yml @@ -1,9 +1,7 @@ name: DevHub Nightly Build -# Daily validation that AppKit main docs still build inside DevHub. Catches breaks -# introduced by DevHub-side changes (their deps/framework) between AppKit docs PRs, -# which the per-PR devhub-validation job cannot see. Failures surface via GitHub's -# built-in scheduled-workflow-failure email to whoever last edited this file. +# Daily check that AppKit main docs still build inside DevHub, catching DevHub-side +# breaks that land between docs PRs. Failures surface via GitHub's scheduled-failure email. on: schedule: From 263d23a0af07a1006e3bdbca89e579d73e96b44c Mon Sep 17 00:00:00 2001 From: Pawel Kosiec Date: Thu, 30 Jul 2026 11:35:20 +0200 Subject: [PATCH 9/9] ci: revert docs test touch and trim workflow comments Signed-off-by: Pawel Kosiec --- .github/workflows/devhub-build.yml | 5 ++--- .github/workflows/devhub-nightly.yml | 4 ++-- docs/README.md | 3 --- 3 files changed, 4 insertions(+), 8 deletions(-) diff --git a/.github/workflows/devhub-build.yml b/.github/workflows/devhub-build.yml index 6f6635c02..256317ddb 100644 --- a/.github/workflows/devhub-build.yml +++ b/.github/workflows/devhub-build.yml @@ -1,8 +1,7 @@ name: DevHub Build -# Reusable workflow: clones DevHub, syncs AppKit docs from the given ref, and runs -# DevHub's build to validate that our docs build inside the actual consumer site. -# Called by ci.yml (per-PR) and devhub-nightly.yml (scheduled against main). +# Builds DevHub with AppKit docs synced from the given ref. +# Called by ci.yml (per-PR) and devhub-nightly.yml. on: workflow_call: diff --git a/.github/workflows/devhub-nightly.yml b/.github/workflows/devhub-nightly.yml index 911e8ea0f..227f748f7 100644 --- a/.github/workflows/devhub-nightly.yml +++ b/.github/workflows/devhub-nightly.yml @@ -6,7 +6,7 @@ name: DevHub Nightly Build on: schedule: - cron: "0 6 * * *" # 06:00 UTC daily - workflow_dispatch: # allow manual re-run + workflow_dispatch: permissions: contents: read @@ -14,5 +14,5 @@ permissions: jobs: devhub-build: - # No inputs → defaults sync databricks/appkit main and build it against DevHub. + # Defaults build databricks/appkit main against DevHub. uses: ./.github/workflows/devhub-build.yml diff --git a/docs/README.md b/docs/README.md index cd9e97208..e09a4e773 100644 --- a/docs/README.md +++ b/docs/README.md @@ -37,6 +37,3 @@ The `pnpm build` command: 2. Runs `apply-redirects` — replaces HTML pages with redirect pages pointing to developers.databricks.com Static files remain served from GitHub Pages: JSON schemas (`/schemas/`), `llms.txt`, and `.md` files (used by `npx @databricks/appkit docs` for npm-bundled documentation). - - -