ci: inline the fleet-canonical CI workflow + exact-floor override gate#293
Open
John-David Dalton (jdalton) wants to merge 10 commits into
Open
ci: inline the fleet-canonical CI workflow + exact-floor override gate#293John-David Dalton (jdalton) wants to merge 10 commits into
John-David Dalton (jdalton) wants to merge 10 commits into
Conversation
Replace the Layer-3 reusable ci.yml + _local-not-for-reuse-ci.yml wrapper pair with the fleet-canonical inlined workflow (verbatim wheelhouse template block, including the 'pnpm run test --all' fix — bare 'pnpm test' resolves to the modified scope and skips everything on a clean CI checkout). Repo-owned jobs live below the end marker, matching every other fleet member. Old @sha pins to the removed reusable keep resolving (SHA-pinned refs are immutable). Required-checks note: job names change from 'Run CI Pipeline / ...' to '🔎 Check', '🧪 Test', '🧪 Test NPM Packages'.
All 131 overrides declare engines.node >=24, but CI only ever ran a
newer current-line Node — nothing proved the floor. The new
floor-node-smoke gate side-installs Node 24.0.0 (pinned version +
sha256 verified against nodejs.org's SHASUMS256 before extraction;
the binary never touches PATH) and dynamic-imports every override's
node entry under it, including the JSON-module entries (date,
es-iterator-helpers) via 'with { type: json }'. Verified locally:
131 imported, 0 failed.
…tion) Two pre-existing high findings — inputs.operation / inputs.run_url expanded directly inside run: — fail the setup-and-install zizmor audit in every CI job, on main too (main CI is currently red on them). Route both through step env vars.
ci.yml is now the fleet-canonical inlined workflow, so: - README badges point at ci.yml (the _local wrapper is gone) - shared-workflow-cascade hook watches the real Layer-3 reusables (weekly-update / publish-npm / get-green) instead of ci.yml and the never-existent provenance.yml — an inlined-ci edit no longer demands a cross-repo cascade - updating-workflows reference, repo architecture doc, pin-guard header, and the fleet cleaning-ci/agent-ci skills describe the current split: inlined fleet block for CI, @sha pins only for the surviving reusables (also fixes the stale provenance.yml name — the file is publish-npm.yml) Audit verdict on the rest: weekly-update.yml + publish-npm.yml + get-green.yml stay workflow_call BY DESIGN (the wheelhouse template itself delegates to them); .lock.yml files are gh-aw-owned; agentics-maintenance.yml's workflow_call trigger has no callers but is dormant and harmless — left as-is.
…repin weekly-update wrapper action-pins-are-current tests reachability with merge-base --is-ancestor, but CI's fetch-depth-25 checkout truncates history — any pin older than ~25 commits reported UNREACHABLE as phantom rot (the June propagation-SHA pins aged out as main advanced). The check now deepens once (--unshallow) on a shallow repo and retests before failing. Also lands the one genuinely stale pin's --fix repin.
Pre-existing on main since the sync-overrides commit landed (Check never ran far enough to report them until the agentics and shallow-pin layers were fixed): getPackageVersionSpec called with 1 arg while its options param was required; fetchPackageManifest returns unknown, so manifest?.version failed; unused __dirname/_ecosystem bindings; and the null-proto spread idiom trips excess-property freshness checks when destructured directly — split through an intermediate so the idiom keeps its Object-pollution guard and satisfies tsc.
Merged origin/main (its a90a436 edited get-green.md and weekly-update.md without running gh aw compile, so the committed .lock.yml body_hash no longer matched — main's Check is red on it, and PR merge refs inherit it). Recompiled both locks with gh-aw v0.79.6 and committed the refreshed actions-lock entries. Type, lint, pin, and gh-aw drift gates all pass on the merged tree.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two changes that bring socket-registry's CI to fleet convention and close a coverage hole:
1. Inline the fleet-canonical CI workflow
Replaces the Layer-3 reusable
ci.yml+_local-not-for-reuse-ci.ymlwrapper pair with the fleet-canonical inlined workflow — verbatim wheelhouse template block, repo-owned jobs below the end marker, matching every other fleet member (socket-lib'sci.ymlis byte-identical to the template).@shapins to the removed reusable keep resolving (SHA-pinned refs are immutable).Run CI Pipeline / …to🔎 Check,🧪 Test,🧪 Test NPM Packages— branch protection needs the new names.2. Floor-node gate for the npm overrides (
floor-node-smoke)All 131 overrides declare
engines.node: >=24, but CI only ever ran a newer current-line Node — nothing proved the floor. The new gate side-installs the exact floor release (Node 24.0.0, pinned version + sha256 via lib-stablehttpDownload's verified/atomic download — the binary never touches PATH) and dynamic-imports every override's node entry under it, including the JSON-module entries (date,es-iterator-helpers) viawith { type: 'json' }.Verified locally: 131 imported, 0 skipped, 0 failed on darwin-arm64;
pnpm run lint --allclean; fleet pre-push validation passed.Fleet-wide finding (fixed upstream)
While inlining: the canonical template's test job ran bare
pnpm test, which resolves to the modified scope — on a clean CI checkout that's zero files, so every member's Test matrix job passes while running nothing (socket-lib main run 29165499582 logsNo modified source files … skipping tests). The wheelhouse template now passes--allexplicitly (wheelhouse commit9d2ff9a8d); this PR's block already carries that fix. Other members pick it up on the next cascade.Follow-ups (not in this PR)
weekly-update.yml,agentics-maintenance.yml,_local-not-for-reuse-{weekly-update,provenance}.ymlstill useworkflow_call— same inlining treatment pending (gh-aw.lock.ymlartifacts stay as generated).shared-workflow-cascade,no-hand-edit-registry-pin-guard), and the wheelhousepropagationShapin manifest describe the retired reusable-workflow architecture and need a cleanup pass.