Skip to content

Commit 7e2262b

Browse files
committed
fix(ci): guard against unpublished opencode submodule pins
1 parent 86400e1 commit 7e2262b

7 files changed

Lines changed: 132 additions & 11 deletions

File tree

.githooks/pre-commit

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ set -euo pipefail
77

88
ROOT_README="README.md"
99

10+
# Guard against unpublished opencode submodule pins.
11+
if git diff --cached --name-only --diff-filter=ACMR | rg -q '^packages/opencode$'; then
12+
./scripts/check-opencode-submodule-published.sh --from-index
13+
fi
14+
1015
if [[ -f "$ROOT_README" ]]; then
1116
cp "$ROOT_README" packages/core/README.md
1217
git add packages/core/README.md

.githooks/pre-push

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
./scripts/check-opencode-submodule-published.sh

.github/workflows/cargo-updates.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ jobs:
1515
runs-on: ubuntu-latest
1616
steps:
1717
- uses: actions/checkout@v6
18-
with:
19-
# Required for shared just check targets that validate packages/opencode.
20-
submodules: recursive
18+
19+
- name: Verify opencode submodule pin is published
20+
run: ./scripts/check-opencode-submodule-published.sh
2121

2222
- name: Install Linux system dependencies
2323
run: |

.github/workflows/cargo-upgrades.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- uses: actions/checkout@v6
19-
with:
20-
# Required for shared just check targets that validate packages/opencode.
21-
submodules: recursive
19+
20+
- name: Verify opencode submodule pin is published
21+
run: ./scripts/check-opencode-submodule-published.sh
2222

2323
- name: Install Linux system dependencies
2424
run: |

.github/workflows/ci.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,9 @@ jobs:
6969
os: [ubuntu-latest, macos-latest]
7070
steps:
7171
- uses: actions/checkout@v6
72-
with:
73-
# Required for just targets that validate/build/test packages/opencode.
74-
submodules: recursive
72+
73+
- name: Verify opencode submodule pin is published
74+
run: ./scripts/check-opencode-submodule-published.sh
7575

7676
- name: Install Linux system dependencies
7777
if: matrix.os == 'ubuntu-latest'

justfile

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,10 @@ check-opencode-submodule-drift:
149149
git submodule status --recursive
150150
git submodule foreach --recursive 'git status --short --branch'
151151

152+
# Ensure pinned opencode submodule commit is remotely fetchable
153+
check-opencode-submodule-published:
154+
./scripts/check-opencode-submodule-published.sh
155+
152156
# Update opencode submodule + Dockerfile OPENCODE_COMMIT pin
153157
update-opencode-commit:
154158
./scripts/update-opencode-commit.sh
@@ -288,10 +292,10 @@ do-marketplace-build:
288292
infra/digitalocean/packer/opencode-marketplace.pkr.hcl
289293

290294
# Pre-commit checks (without Docker build - faster, works without Docker)
291-
pre-commit: fmt lint build test-all-fast
295+
pre-commit: check-opencode-submodule-published fmt lint build test-all-fast
292296

293297
# Pre-commit checks including Docker build (requires Docker)
294-
pre-commit-full: fmt lint build test-all-fast build-docker
298+
pre-commit-full: check-opencode-submodule-published fmt lint build test-all-fast build-docker
295299
@echo "✓ Full pre-commit checks passed (including Docker build)"
296300

297301
# Format everything
Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
usage() {
5+
cat <<'EOF'
6+
Usage: check-opencode-submodule-published.sh [--from-index] [--commit <sha>]
7+
8+
Checks that the opencode submodule commit pinned by the superproject is fetchable
9+
from the configured submodule remote.
10+
11+
Options:
12+
--from-index Read the submodule gitlink commit from the index (:packages/opencode).
13+
--commit <sha> Validate an explicit commit SHA.
14+
-h, --help Show this help text.
15+
EOF
16+
}
17+
18+
from_index="false"
19+
target_commit=""
20+
21+
while [[ $# -gt 0 ]]; do
22+
case "$1" in
23+
--from-index)
24+
from_index="true"
25+
shift
26+
;;
27+
--commit)
28+
if [[ $# -lt 2 ]]; then
29+
echo "Error: --commit requires a SHA argument." >&2
30+
usage >&2
31+
exit 1
32+
fi
33+
target_commit="$2"
34+
shift 2
35+
;;
36+
-h|--help)
37+
usage
38+
exit 0
39+
;;
40+
*)
41+
echo "Error: Unknown argument: $1" >&2
42+
usage >&2
43+
exit 1
44+
;;
45+
esac
46+
done
47+
48+
if [[ -z "${target_commit}" ]]; then
49+
if [[ "${from_index}" == "true" ]]; then
50+
target_commit="$(git rev-parse --verify --quiet :packages/opencode || true)"
51+
if [[ -z "${target_commit}" ]]; then
52+
echo "Error: Could not resolve staged gitlink for packages/opencode from index." >&2
53+
exit 1
54+
fi
55+
else
56+
target_commit="$(git rev-parse --verify --quiet HEAD:packages/opencode || true)"
57+
if [[ -z "${target_commit}" ]]; then
58+
echo "Error: Could not resolve gitlink for packages/opencode from HEAD." >&2
59+
exit 1
60+
fi
61+
fi
62+
fi
63+
64+
if [[ ! "${target_commit}" =~ ^[0-9a-f]{40}$ ]]; then
65+
echo "Error: Invalid commit SHA: ${target_commit}" >&2
66+
exit 1
67+
fi
68+
69+
submodule_url="$(git config -f .gitmodules --get submodule.packages/opencode.url || true)"
70+
if [[ -z "${submodule_url}" ]]; then
71+
echo "Error: Missing submodule.packages/opencode.url in .gitmodules." >&2
72+
exit 1
73+
fi
74+
75+
probe_dir="$(mktemp -d)"
76+
cleanup() {
77+
rm -rf "${probe_dir}"
78+
}
79+
trap cleanup EXIT
80+
81+
stderr_file="${probe_dir}/fetch.stderr"
82+
git -C "${probe_dir}" init -q
83+
84+
# The submodule URL in .gitmodules is SSH-style (git@github.com:...).
85+
# CI runners and local hooks may not have an SSH key configured, so rewrite
86+
# GitHub SSH URLs to HTTPS for this reachability probe.
87+
if ! git \
88+
-C "${probe_dir}" \
89+
-c protocol.version=2 \
90+
-c url."https://github.com/".insteadOf=git@github.com: \
91+
-c url."https://github.com/".insteadOf=ssh://git@github.com/ \
92+
fetch --depth=1 "${submodule_url}" "${target_commit}" >/dev/null 2>"${stderr_file}"; then
93+
echo "Error: packages/opencode commit is not fetchable from remote." >&2
94+
echo " Commit: ${target_commit}" >&2
95+
echo " Remote: ${submodule_url}" >&2
96+
if [[ -s "${stderr_file}" ]]; then
97+
echo " Git fetch error:" >&2
98+
sed 's/^/ /' "${stderr_file}" >&2
99+
fi
100+
echo "Remediation:" >&2
101+
echo " 1) Push the submodule commit to ${submodule_url}, or" >&2
102+
echo " 2) Re-pin packages/opencode to a published commit." >&2
103+
exit 1
104+
fi
105+
106+
echo "OK: packages/opencode commit is published and fetchable."
107+
echo " Commit: ${target_commit}"
108+
echo " Remote: ${submodule_url}"

0 commit comments

Comments
 (0)