From 23ed0bfb20a1cb2defb93d4b70a352560e4db9d3 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 10:40:54 +0000 Subject: [PATCH] ci: fail a pull request that starts before the latest release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A pull request made from an old main undoes what was fixed since and conflicts (strata#60 started 32 commits back, before 0.7.0). The new `base` job checks out the branch as pushed, not the merge GitHub prepares, and fails when it does not include the latest v… tag of the base branch, with the commands to update it. A branch a few commits behind only gets a notice. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Ke7yEW5dhDYFVpV2cdgs87 Signed-off-by: Claude --- .github/workflows/ci.yml | 24 ++++++++++++++++++++++++ README.md | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f5a2865..79912d6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,30 @@ permissions: contents: read jobs: + # A pull request must include the latest release of its base branch. One made from an old main undoes what + # was fixed since, and conflicts. Lagging a few commits behind is fine: it only gets a notice. + base: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + # the branch as pushed, not the merge GitHub prepares (that one always contains the base branch) + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + - name: The branch includes the latest release + env: + BASE: ${{ github.event.pull_request.base.ref }} + run: | + git fetch --quiet origin "+refs/heads/$BASE:refs/remotes/origin/$BASE" '+refs/tags/*:refs/tags/*' + behind=$(git rev-list --count HEAD..origin/$BASE) + tag=$(git tag --merged origin/$BASE --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1) + if [ -n "$tag" ] && ! git merge-base --is-ancestor "$tag" HEAD; then + echo "::error::This branch starts before $tag: it is $behind commits behind $BASE. Update it from $BASE (git fetch upstream && git rebase upstream/$BASE, or git merge upstream/$BASE), then push again." + exit 1 + fi + if [ "$behind" -gt 0 ]; then echo "::notice::This branch includes $tag but is $behind commits behind $BASE."; else echo "Up to date with $BASE."; fi + test: runs-on: ubuntu-latest steps: diff --git a/README.md b/README.md index e197c81..5955537 100644 --- a/README.md +++ b/README.md @@ -142,4 +142,4 @@ The hero film is made from code in `hero-film/`: `capture.mjs` takes real screen Muster is free software under the [GNU AGPL v3 or later](LICENSE): if you offer a modified version to users over a network, you must give them its source code. -Contributions follow the [Solid standard](https://github.com/SolidGeeks/.github/blob/main/CONTRIBUTING.md): sign off every commit with `git commit -s` (DCO), no CLA. To report a vulnerability, see [SECURITY.md](SECURITY.md). +Contributions follow the [Solid standard](https://github.com/SolidGeeks/.github/blob/main/CONTRIBUTING.md): sign off every commit with `git commit -s` (DCO), no CLA. Start your branch from the current `main`: the `base` job of the CI fails when a pull request does not include the latest release (`v…` tag), and says how to update it. To report a vulnerability, see [SECURITY.md](SECURITY.md).