|
| 1 | +name: Console Pin Freshness |
| 2 | + |
| 3 | +# Is `.objectui-sha` still CURRENT? (#3340 P0) |
| 4 | +# |
| 5 | +# ⚠️ NOT ci.yml's "Console Pin Gate" (#4290). The names are close and the |
| 6 | +# questions are opposite ends of the same fact: |
| 7 | +# |
| 8 | +# Console Pin Gate (#4290) "does the PINNED SHA still BUILD?" — clones |
| 9 | +# objectui at the pin and builds the SPA. |
| 10 | +# Console Pin Freshness "is the PIN still CURRENT?" — compares the pin |
| 11 | +# (this workflow) against objectui `main`. |
| 12 | +# |
| 13 | +# A two-month-old pin builds perfectly (Pin Gate green) while hiding two months |
| 14 | +# of frontend releases from the release record (this gate red). Keep both. |
| 15 | +# |
| 16 | +# WHERE IT BLOCKS |
| 17 | +# --------------- |
| 18 | +# On the changesets **Version Packages / release PR** only. Between pin bumps an |
| 19 | +# ordinary code PR sits behind objectui almost always — that is the normal state |
| 20 | +# of the repo, not a defect, and failing every PR over it would train everyone to |
| 21 | +# ignore this check. So the job runs everywhere and blocks only on the release |
| 22 | +# lane, where a lagging pin silently drops frontend changes from the release |
| 23 | +# record (#3340: four changes, two of them `minor` features, lost from v16). |
| 24 | +# |
| 25 | +# WHY THE JOB IS NEVER SKIPPED |
| 26 | +# ---------------------------- |
| 27 | +# It carries no job-level `if:` and no paths filter on purpose. A check that |
| 28 | +# does not run reports nothing, and a *required* context that reports nothing |
| 29 | +# leaves every PR stuck "Expected — waiting for status". Advisory mode is |
| 30 | +# expressed in the EXIT CODE, not by skipping: the report is printed in full |
| 31 | +# either way, so a green run on an ordinary PR still shows how far the pin has |
| 32 | +# drifted. |
| 33 | +# |
| 34 | +# REQUIRED-CHECK ENFORCEMENT IS NOT SELF-DECLARED |
| 35 | +# ----------------------------------------------- |
| 36 | +# A workflow cannot make itself required. A maintainer must add the |
| 37 | +# `Console Pin Freshness` context to the branch-protection rule for `main` |
| 38 | +# (Settings → Branches → main → Require status checks to pass). Until then this |
| 39 | +# workflow REPORTS on the release PR without blocking the merge button. |
| 40 | + |
| 41 | +on: |
| 42 | + pull_request: |
| 43 | + branches: [main] |
| 44 | + workflow_dispatch: |
| 45 | + |
| 46 | +concurrency: |
| 47 | + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} |
| 48 | + cancel-in-progress: true |
| 49 | + |
| 50 | +jobs: |
| 51 | + # Job name == the branch-protection context. Keep it stable: renaming it |
| 52 | + # silently detaches the required check (the #3622 lesson ci.yml records). |
| 53 | + pin-freshness: |
| 54 | + name: Console Pin Freshness |
| 55 | + runs-on: ubuntu-latest |
| 56 | + timeout-minutes: 10 |
| 57 | + permissions: |
| 58 | + contents: read |
| 59 | + |
| 60 | + steps: |
| 61 | + - name: Checkout repository |
| 62 | + uses: actions/checkout@v7 |
| 63 | + |
| 64 | + - name: Setup Node.js |
| 65 | + uses: actions/setup-node@v7 |
| 66 | + with: |
| 67 | + node-version: '22' |
| 68 | + |
| 69 | + # "A change to the guard runs the guard" — the rule this repo applies to |
| 70 | + # every other scripts/ gate. No install: the script is dependency-free. |
| 71 | + - name: Self-test the gate |
| 72 | + run: node scripts/check-objectui-pin-fresh.mjs --self-test |
| 73 | + |
| 74 | + - name: Check objectui pin freshness |
| 75 | + env: |
| 76 | + # Only ITEMIZES an already-established lag (`git ls-remote` decides the |
| 77 | + # verdict), but the token keeps the API off the 60/hr anonymous limit |
| 78 | + # so the report names the commits and changesets instead of degrading. |
| 79 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 80 | + # Read through env, never inlined into the shell: a PR title is |
| 81 | + # attacker-controlled text. |
| 82 | + HEAD_REF: ${{ github.event.pull_request.head.ref }} |
| 83 | + PR_TITLE: ${{ github.event.pull_request.title }} |
| 84 | + EVENT: ${{ github.event_name }} |
| 85 | + run: | |
| 86 | + # The changesets action opens the version PR from `changeset-release/<base>` |
| 87 | + # with the title configured in release.yml. Either identifies the lane; |
| 88 | + # both are checked so a future rename of one does not silently disarm |
| 89 | + # the gate. |
| 90 | + if [ "$EVENT" != "pull_request" ] \ |
| 91 | + || [ "$HEAD_REF" = "changeset-release/main" ] \ |
| 92 | + || [ "$PR_TITLE" = "chore: version packages" ]; then |
| 93 | + echo "::notice::Release lane — the objectui pin-freshness gate BLOCKS here (#3340)." |
| 94 | + node scripts/check-objectui-pin-fresh.mjs |
| 95 | + else |
| 96 | + echo "::notice::Not the Version Packages PR — pin freshness is reported but does not block (a pin lagging between bumps is normal). It blocks on the release PR." |
| 97 | + node scripts/check-objectui-pin-fresh.mjs --advisory |
| 98 | + fi |
0 commit comments