|
25 | 25 | outputs: |
26 | 26 | docs: ${{ steps.changes.outputs.docs }} |
27 | 27 | core: ${{ steps.changes.outputs.core }} |
| 28 | + console: ${{ steps.changes.outputs.console }} |
28 | 29 | steps: |
29 | 30 | - name: Checkout repository |
30 | 31 | uses: actions/checkout@v7 |
|
46 | 47 | - 'pnpm-lock.yaml' |
47 | 48 | - 'tsconfig.json' |
48 | 49 | - '.github/workflows/ci.yml' |
| 50 | + # Build inputs of the vendored Console SPA — see the Console Pin Gate |
| 51 | + # job at the bottom of this file. `.objectui-sha` is a ROOT DOTFILE, so |
| 52 | + # it matches neither filter above: a pin-only diff skipped `core` and |
| 53 | + # `docs` alike, which is how #4288 moved the pin 76 commits with six of |
| 54 | + # fourteen checks skipped and nothing anywhere building the new SHA. |
| 55 | + # The last two entries are the "a change to the guard runs the guard" |
| 56 | + # rule the repo applies to every other filtered gate; they are close to |
| 57 | + # free here because an unmoved pin hits the dist cache. |
| 58 | + console: |
| 59 | + - '.objectui-sha' |
| 60 | + - 'scripts/build-console.sh' |
| 61 | + - 'scripts/check-console-sha.mjs' |
| 62 | + - '.github/workflows/ci.yml' |
49 | 63 |
|
50 | 64 | test: |
51 | 65 | name: Test Core |
@@ -696,3 +710,170 @@ jobs: |
696 | 710 |
|
697 | 711 | - name: Build Docs |
698 | 712 | run: pnpm --filter @objectstack/docs build |
| 713 | + |
| 714 | + # ── The pinned objectui SHA actually builds (#4290) ─────────────────────── |
| 715 | + # |
| 716 | + # `.objectui-sha` is the single source of truth for the vendored Console SPA: |
| 717 | + # release.yml reads it, clones objectstack-ai/objectui at that commit, builds |
| 718 | + # @object-ui/console, and copies the dist into packages/console/. Editing that |
| 719 | + # one line replaces the entire frontend the platform ships. |
| 720 | + # |
| 721 | + # Nothing on the PR side ever built it. The pin appeared in exactly two |
| 722 | + # workflows, neither of them a gate: release.yml (post-merge, on the main push) |
| 723 | + # and showcase-smoke.yml (manual + nightly, whose own header says "it never |
| 724 | + # gates PRs"). Combined with the filter hole noted above, #4288 merged a |
| 725 | + # 76-commit pin bump green with six of fourteen checks skipped. A SHA that |
| 726 | + # cannot build — a typo, a commit that was force-pushed away, a genuinely |
| 727 | + # broken objectui, a dead bundle canary — reached main unchallenged and would |
| 728 | + # have surfaced at PUBLISH time. The only thing standing between the two was |
| 729 | + # the author remembering to run scripts/build-console.sh locally: discipline, |
| 730 | + # not a gate. |
| 731 | + # |
| 732 | + # `pnpm objectui:refresh` does include the build, so the normal path was |
| 733 | + # already covered in practice; the hole is a hand-edited pin, or that single |
| 734 | + # line cherry-picked out of another branch. |
| 735 | + # |
| 736 | + # Cost is real but narrowly aimed. A moved pin is the only trigger that pays |
| 737 | + # the full clone + vite build, and #4288's 76 commits of staleness are the |
| 738 | + # measure of how rare that is. The other triggers (this file, the drift guard) |
| 739 | + # leave the pin untouched, so they hit the dist cache and cost about a minute. |
| 740 | + # |
| 741 | + # Scope, stated plainly: this proves the PINNED SHA builds. It does NOT cover a |
| 742 | + # packages/client change breaking the injected-client bundle — that input lives |
| 743 | + # under `packages/**`, and watching it here would rebuild the console on a large |
| 744 | + # fraction of every PR. release.yml stays the only check for that direction. |
| 745 | + # |
| 746 | + # The NAME is the required-check contract — the same trap the dogfood shards |
| 747 | + # note above: renaming it silently drops the gate wherever branch protection |
| 748 | + # lists it, with every PR still green. |
| 749 | + console-pin: |
| 750 | + name: Console Pin Gate |
| 751 | + needs: filter |
| 752 | + if: needs.filter.outputs.console == 'true' |
| 753 | + runs-on: ubuntu-latest |
| 754 | + timeout-minutes: 45 |
| 755 | + permissions: |
| 756 | + contents: read |
| 757 | + |
| 758 | + steps: |
| 759 | + - name: Checkout repository |
| 760 | + uses: actions/checkout@v7 |
| 761 | + |
| 762 | + - name: Setup Node.js |
| 763 | + uses: actions/setup-node@v7 |
| 764 | + with: |
| 765 | + node-version: '22' |
| 766 | + |
| 767 | + - name: Enable Corepack |
| 768 | + run: corepack enable |
| 769 | + |
| 770 | + - name: Verify pnpm version |
| 771 | + run: pnpm --version |
| 772 | + |
| 773 | + - name: Get pnpm store directory |
| 774 | + shell: bash |
| 775 | + run: | |
| 776 | + echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV |
| 777 | +
|
| 778 | + - name: Setup pnpm cache |
| 779 | + uses: actions/cache@v6 |
| 780 | + with: |
| 781 | + path: ${{ env.STORE_PATH }} |
| 782 | + key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }} |
| 783 | + restore-keys: | |
| 784 | + ${{ runner.os }}-pnpm-store-v3- |
| 785 | +
|
| 786 | + # Restore-only, and with no save step at all: this job runs a handful of |
| 787 | + # times a month, so its own namespace would almost always be cold. The |
| 788 | + # build-core fallbacks below are the ones that actually hit — that job |
| 789 | + # builds a superset of the client closure needed here and is seeded from |
| 790 | + # main (same reasoning as the Temporal Conformance job's fallback). |
| 791 | + - name: Restore Turbo cache |
| 792 | + uses: actions/cache/restore@v6 |
| 793 | + with: |
| 794 | + path: .turbo/cache |
| 795 | + key: ${{ runner.os }}-turbo-${{ github.job }}-${{ github.ref_name }}-${{ github.sha }} |
| 796 | + restore-keys: | |
| 797 | + ${{ runner.os }}-turbo-${{ github.job }}-${{ github.ref_name }}- |
| 798 | + ${{ runner.os }}-turbo-${{ github.job }}- |
| 799 | + ${{ runner.os }}-turbo-build-core-${{ github.ref_name }}- |
| 800 | + ${{ runner.os }}-turbo-build-core- |
| 801 | +
|
| 802 | + - name: Install dependencies |
| 803 | + run: pnpm install --frozen-lockfile |
| 804 | + |
| 805 | + # build-console.sh bundles THIS tree's @objectstack/client into the console |
| 806 | + # (via OBJECTSTACK_CLIENT_DIST) and falls back to building it in place when |
| 807 | + # the dist is missing — but that fallback is a bare `pnpm build` inside |
| 808 | + # packages/client, which tsup cannot finish unless @objectstack/core and |
| 809 | + # @objectstack/spec are built already. Build the closure through turbo |
| 810 | + # instead: cacheable, and near-free off the restore above. Both of the |
| 811 | + # script's existing callers (release.yml, showcase-smoke.yml) pre-build for |
| 812 | + # the same reason. |
| 813 | + - name: Build @objectstack/client and its dependencies |
| 814 | + run: pnpm exec turbo run build --filter=@objectstack/client... --concurrency=4 |
| 815 | + |
| 816 | + # Same key as release.yml's "Cache vendored Console dist" step. Actions |
| 817 | + # caches are repo-scoped, so a PR reads whatever main already built for this |
| 818 | + # pin — that is what makes the non-pin triggers cheap. Only a pin the repo |
| 819 | + # has never built misses, and a miss is exactly when this gate has work to do. |
| 820 | + # |
| 821 | + # Split restore/save where release.yml uses the combined action, because the |
| 822 | + # combined form's post-step saves even when the job FAILED. build-console.sh |
| 823 | + # writes the SHA stamp before it asserts the bundle canary, so a canary |
| 824 | + # failure leaves a stamped-but-broken dist on disk — cache that and the next |
| 825 | + # run restores it, skips the build, and sails through the stamp check. Saving |
| 826 | + # only once every assertion below is green is what lets a restored dist carry |
| 827 | + # the same guarantees as a freshly built one. |
| 828 | + - name: Restore vendored Console dist (keyed on the objectui pin) |
| 829 | + id: console-dist |
| 830 | + uses: actions/cache/restore@v6 |
| 831 | + with: |
| 832 | + path: packages/console/dist |
| 833 | + key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }} |
| 834 | + |
| 835 | + # The gate. Shallow-clones objectui at the pinned SHA, builds |
| 836 | + # @object-ui/console against this tree's client, copies the dist into |
| 837 | + # packages/console/, and asserts the bundle canary — every failure mode a |
| 838 | + # bad pin can carry, surfaced on the PR instead of at publish time. |
| 839 | + - name: Build the Console SPA at the pinned objectui SHA |
| 840 | + if: steps.console-dist.outputs.cache-hit != 'true' |
| 841 | + run: bash scripts/build-console.sh |
| 842 | + |
| 843 | + # check:console-sha exits 0 — deliberately — when there is no dist at all |
| 844 | + # (published installs and package-only CI legitimately have none), and warns |
| 845 | + # without failing when a dist carries no stamp. Both are right for that |
| 846 | + # script and both are VACUOUS here, where producing a dist is the entire |
| 847 | + # point: an empty or partial cache restore would otherwise reach the drift |
| 848 | + # check with nothing to check and report success. Prove one is really in |
| 849 | + # place before letting that check speak for the job. |
| 850 | + - name: Assert a real Console dist is in place |
| 851 | + env: |
| 852 | + CACHE_HIT: ${{ steps.console-dist.outputs.cache-hit }} |
| 853 | + run: | |
| 854 | + dist=packages/console/dist |
| 855 | + if [ "$CACHE_HIT" = "true" ]; then origin="the dist cache restore"; else origin="scripts/build-console.sh"; fi |
| 856 | + fail=0 |
| 857 | + [ -s "$dist/index.html" ] || { echo "::error::$dist/index.html is missing or empty"; fail=1; } |
| 858 | + [ -n "$(ls -A "$dist/assets" 2>/dev/null || true)" ] || { echo "::error::$dist/assets is missing or empty"; fail=1; } |
| 859 | + [ -s "$dist/.objectui-sha" ] || { echo "::error::$dist/.objectui-sha stamp is missing — check:console-sha would pass vacuously"; fail=1; } |
| 860 | + if [ "$fail" -ne 0 ]; then |
| 861 | + echo "::error::No usable Console dist after $origin." |
| 862 | + exit 1 |
| 863 | + fi |
| 864 | + echo "✓ Console dist present ($(du -sk "$dist" | awk '{print $1}') KB, via $origin) from objectui@$(cut -c1-12 "$dist/.objectui-sha")" |
| 865 | +
|
| 866 | + - name: Verify the Console dist stamp matches the pin |
| 867 | + run: pnpm check:console-sha |
| 868 | + |
| 869 | + # Reached only with every assertion above green (see the split-restore note). |
| 870 | + # This deviates from the workflow's restore-only-on-PRs policy on purpose: |
| 871 | + # that policy targets the ~5 turbo entries every push writes, whereas this |
| 872 | + # key moves only when the pin does. A pin-bump PR writes one entry, and the |
| 873 | + # rest of that PR's pushes reuse it instead of rebuilding the console again. |
| 874 | + - name: Save vendored Console dist |
| 875 | + if: steps.console-dist.outputs.cache-hit != 'true' |
| 876 | + uses: actions/cache/save@v6 |
| 877 | + with: |
| 878 | + path: packages/console/dist |
| 879 | + key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh') }} |
0 commit comments