From 1db26daef133807e1eb0d1b4a24bc850ee88413e Mon Sep 17 00:00:00 2001 From: pbertsch Date: Sun, 8 Nov 2026 07:36:13 -0600 Subject: [PATCH] ci: read the platform contract from the dispatch payload (raw download of the private repo 404s) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018tpBsXGDfaicezLgmDaWkv --- .github/workflows/contract-drift.yml | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/.github/workflows/contract-drift.yml b/.github/workflows/contract-drift.yml index fa34491..602cfac 100644 --- a/.github/workflows/contract-drift.yml +++ b/.github/workflows/contract-drift.yml @@ -25,9 +25,26 @@ jobs: run: pip install -e .[dev] - name: Fetch latest platform contract + # The platform repo is private, so the contract cannot be downloaded + # from raw.githubusercontent.com (that always returned 404 and the job + # failed before it could report drift). The platform's dispatch now + # carries it: gzip + base64 in client_payload.contractGzB64, with its + # SHA-256. It is read only through env: and parsed as JSON, never + # interpolated into the script. A scheduled run has no payload and + # checks the vendored copy only. + env: + CONTRACT_GZ_B64: ${{ github.event.client_payload.contractGzB64 }} + CONTRACT_SHA256: ${{ github.event.client_payload.contractSha256 }} run: | - curl -sSL -o /tmp/latest-contract.json \ - https://raw.githubusercontent.com/AlphaWaveSystems/awsys-shortener/master/contracts/sdk-contract.json + set -euo pipefail + if [ -z "${CONTRACT_GZ_B64:-}" ]; then + echo "::notice::No contract in the dispatch payload (scheduled run or an older sender); checking the vendored contract only." + cp tests/contracts/sdk-contract.json /tmp/latest-contract.json + else + printf '%s' "$CONTRACT_GZ_B64" | base64 -d | gunzip > /tmp/latest-contract.json + echo "${CONTRACT_SHA256} /tmp/latest-contract.json" | sha256sum -c - + fi + jq -e '.version | type == "string"' /tmp/latest-contract.json > /dev/null - name: Compare version and diff id: diff