fix: use the SHA from git rev-parse HEAD when publishing (#470)

Author: elliott-with-the-longest-name-on-github

packages/app/e2e.test.ts

@@ -151,7 +151,10 @@ describe.sequential.each([
 
   it(`serves and installs playground-a for ${mode}`, async () => {
     const [owner, repo] = payload.repository.full_name.split("/");
-    const sha = payload.workflow_run.head_sha.substring(0, 7);
+    const { stdout: gitHeadSha } = await ezSpawn.async("git rev-parse HEAD", {
+      stdio: "overlapped",
+    });
+    const sha = gitHeadSha.trim().substring(0, 7);
     const ref = pr?.payload.number ?? payload.workflow_run.head_branch;
 
     // Test download with SHA
@@ -191,7 +194,10 @@ describe.sequential.each([
 
   it(`serves and installs playground-b for ${mode}`, async () => {
     const [owner, repo] = payload.repository.full_name.split("/");
-    const sha = payload.workflow_run.head_sha.substring(0, 7);
+    const { stdout: gitHeadSha } = await ezSpawn.async("git rev-parse HEAD", {
+      stdio: "overlapped",
+    });
+    const sha = gitHeadSha.trim().substring(0, 7);
 
     // Test download
     const response = await worker.fetch(

packages/app/server/routes/[owner]/[repo]/[packageAndRefOrSha].get.ts

@@ -1,5 +1,5 @@
 import type { WorkflowData } from "../../../types";
-import { abbreviateCommitHash } from "@pkg-pr-new/utils";
+import { abbreviateCommitHash, isValidGitHash } from "@pkg-pr-new/utils";
 import { normalizeKey } from "unstorage";
 
 type Params = Omit<WorkflowData, "sha" | "ref"> & {
@@ -86,10 +86,3 @@ export default eventHandler(async (event) => {
     status: 404,
   });
 });
-
-const sha1Regex = /^[\da-f]{40}$/i;
-const sha256Regex = /^[\da-f]{64}$/i;
-
-function isValidGitHash(hash: string): boolean {
-  return sha1Regex.test(hash) || sha256Regex.test(hash);
-}

packages/app/server/routes/publish.post.ts

@@ -2,7 +2,11 @@ import type { H3Event } from "h3";
 import type { components as OctokitComponents } from "@octokit/openapi-types";
 import type { Comment, PackageManager } from "@pkg-pr-new/utils";
 import type { WorkflowData } from "../types";
-import { isPullRequest, isWhitelisted } from "@pkg-pr-new/utils";
+import {
+  isPullRequest,
+  isValidGitHash,
+  isWhitelisted,
+} from "@pkg-pr-new/utils";
 import { randomUUID } from "uncrypto";
 import { setItemStream, useTemplatesBucket } from "../utils/bucket";
 import { useOctokitInstallation } from "../utils/octokit";
@@ -23,6 +27,7 @@ export default eventHandler(async (event) => {
       "sb-only-templates": onlyTemplatesHeader,
       "sb-comment-with-sha": commentWithShaHeader,
       "sb-comment-with-dev": commentWithDevHeader,
+      "sb-sha": shaOverride,
     } = getHeaders(event);
     const compact = compactHeader === "true";
     const onlyTemplates = onlyTemplatesHeader === "true";
@@ -54,6 +59,16 @@ export default eventHandler(async (event) => {
       });
     }
 
+    if (shaOverride) {
+      if (!isValidGitHash(shaOverride)) {
+        throw createError({
+          statusCode: 400,
+          message: "Invalid sb-sha: must be a 40-character hex SHA",
+        });
+      }
+      workflowData.sha = shaOverride;
+    }
+
     const whitelisted = await isWhitelisted(
       workflowData.owner,
       workflowData.repo,

packages/cli/index.ts

@@ -233,7 +233,13 @@ const main = defineCommand({
             process.exit(1);
           }
 
-          const { sha } = await checkResponse.json();
+          const { stdout: gitShaOutput } = await ezSpawn.async(
+            "git rev-parse HEAD",
+            {
+              stdio: "overlapped",
+            },
+          );
+          const sha = gitShaOutput.trim();
 
           const deps: Map<string, string> = new Map(); // pkg.pr.new versions of the package
           const realDeps: Map<string, string> | null = isPeerDepsEnabled
@@ -575,6 +581,7 @@ const main = defineCommand({
           const res = await fetch(publishUrl, {
             method: "POST",
             headers: {
+              "sb-sha": sha,
               "sb-comment": comment,
               "sb-compact": `${isCompact}`,
               "sb-key": key,

packages/utils/index.ts

@@ -30,6 +30,13 @@ export function abbreviateCommitHash(fullHash: string) {
   return fullHash.substring(0, commitLength);
 }
 
+const sha1Regex = /^[\da-f]{40}$/i;
+const sha256Regex = /^[\da-f]{64}$/i;
+
+export function isValidGitHash(hash: string): boolean {
+  return sha1Regex.test(hash) || sha256Regex.test(hash);
+}
+
 export function isPullRequest(ref: string) {
   return !Number.isNaN(Number(ref));
 }