Repository navigation
fix(ci): stop changeset release PRs from failing structurally - #317
Merged
Merged
Conversation
PR #307 (chore: version packages) failed three checks that cannot pass on a release PR by construction: - Runtime image smoke boots identity-driven against the published config, so it compares the PR's framework train against bundles the last deploy published — a deploy-parity check the deploy train (with its bos mf check gate) owns post-merge. Skip it on changeset-release/main; the image's self-contained boot path stays covered by the regression browser start:* modes. - init.full resolved better-near-auth from npm, where the bumped rc version does not exist until publish. Pack it as a third framework tarball so child installs stay hermetic. - intent stale flags the version-marker drift every release PR creates by construction; skip the PR-time gate there — markers are reconciled by the post-publish review flow. Also: assert in container-build that every built remote stamps the same every-plugin train as the framework package (fails the build before staging/boot instead of 503-ing at smoke), and decouple two unit tests from the live framework version.
…assert paths - framework-packages.ts: the stage-pack-then-copy pattern for the two dependency framework packages is now one loop, so pack ordering (everything-dev consumes the transitive copies) is structural instead of incidental - container-build.ts: assertFederationTrain callers all pass root-relative dist paths the same way, and a train mismatch now lists the dists already checked
…ct typed helpers The review-driven assertion referenced authWorkspace outside the if-block where it was declared; the Docker dist-builder stage crashed with a ReferenceError after all builds succeeded, failing every image-building job (runtime image smoke, regression browser/http start modes). scripts/ is covered by no workspace typecheck, so only the Docker runtime caught it. - hoist the auth app-slot derivation to module level and share it between build() and stage() (stage() duplicated the same expression) - extract resolveAuthWorkspace + checkFederationTrain into typed package code (packages/everything-dev/src/federation-train.ts) with unit tests — the orchestrator keeps only a thin throwing wrapper that accumulates the checked-dists list - drop the script's local readBuildReport duplicate in favor of the package helper (schema-validated) Verified by running scripts/regression/container-build.ts locally: all 7 dists stamp every-plugin@2.10.1 and staging completes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the three structurally-failing checks on the changeset release PR #307 (chore: version packages). Investigated each failure to root cause:
1. Runtime image smoke (fail)
Root cause — not a build skew. The smoke boots identity-driven (
BOS_ACCOUNT/BOS_GATEWAYdefaults intests/smoke/runtime-image.mjs) →resolveStartConfigSourcetreats it as a registry start → fetches the published FastKV config → loads remotes from CDN URLs pinned to the last deploy (every-plugin2.10.1train), while the PR image's runtime is3.0.0-rc.0. The staged own-namespace bundles are never consulted because the fetch interceptor only matches/bundles/<account>/<gateway>/paths (bundle-fs-resolve.ts), and the published config points at CDN URLs. Strict singleton mismatch → all 7 remotes fail →/api/spec.json503.Fix: skip the job on
changeset-release/main. This is a deploy-parity check the deploy train owns post-merge (it re-aligns config + image and gates Railway onbos mf check). The image's self-contained boot path stays covered by the regression browserstart:*modes, which passed on #307.2. Framework tests — init.full (fail)
Root cause: the child install resolved
better-near-auth@^2.0.0-rc.0from npm, where only 1.10.2 existed — the rc publishes only when the PR merges.every-plugin/everything-devalready solved this with local tarballs;better-near-authjust wasn't in the set.Fix: pack it as a third framework tarball (
framework-packages.ts). Child direct refs and the everything-dev tarball's transitive refs now both rewrite to local tarballs, so the suite is hermetic at any train version. Also corrected the stale Bun-era comment and version-stamped copy filename.3. Validate intent skills (fail)
Root cause:
intent stalereportsneedsReviewbecause each SKILL.md'slibrary_versionmarker says 1.10.2 while the package was bumped to 2.0.0-rc.0. Locally on main: zero drift. The markers mean "reviewed against this published version" and are reconciled by the post-publish review job — the PR-time gate is a structural false positive on release PRs.Fix: skip the
validatejob onchangeset-release/mainwith a comment documenting the reconciliation flow.Hardening
container-build.ts: newassertFederationTrain— after building api/auth/plugins, each dist'smf-manifest.jsonmust stampevery-pluginat the framework package's version; a train skew now fails the build train before staging/boot instead of surfacing as a 503 at smoke time. Dry-run verified against live manifests.2.10.1) decoupled to a neutral literal so version bumps can't red them.Verification
pnpm run typecheck— 10/10 workspacespnpm run lint— cleaneverything-devsuite withCI=true: 1005 passed (incl. init.full)No changeset: CI + test-only changes, published packages unchanged.
Note
PR #307's own checks won't re-run until it picks this up — merge main into
changeset-release/mainonce (or admin-merge) when merging it.