Repository navigation
ci(gates): the compose script's refusals reach the log, and its ref is an input — job_workflow_sha is empty inside a called reusable - #2713
Merged
Conversation
…s an input — job_workflow_sha is empty inside a called reusable Two defects from #2707, both found on the first satellite run (Manufacturing 33283588300): - compose-sealed-modules.sh returned each upstream's module list on stdout and the caller captured it, so every ::error the function printed (a 404 seal, a missing module set) vanished into the list file and the gate showed nothing but 'exit code 1'. The list now goes to a file; every message stays on stdout. - github.job_workflow_sha is EMPTY in a reusable called from another repository, so the script fetch silently read main while claiming a pin. The gate and compile-check take a platform-ref input (default main; pin it beside the uses: sha), assert it non-empty, and refuse a fetched file that is not a script. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves the reliability and diagnosability of the node-repo CI gate/compile-check workflows when composing sealed module bundles from upstream publications, especially when the workflow is invoked as a reusable from another repository.
Changes:
- Add a
platform-refworkflow input (defaultmain) to explicitly control whichSystemorph/MeshWeaverref is used when fetching.github/scripts/compose-sealed-modules.sh, avoiding reliance ongithub.job_workflow_sha(empty in cross-repo reusable runs). - Harden the script fetch in both gate and compile-check: assert
platform-refis non-empty, fail with a clear::error::on fetch failure, and sanity-check the fetched file looks like a script (#!). - Fix
compose-sealed-modules.shso upstream module lists are written to a provided list file (not stdout), preventing::error::output from being swallowed when callers capture stdout.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/node-repo-gate.yml | Introduces platform-ref input and uses it to fetch/validate compose-sealed-modules.sh, ensuring failures are explicit and ref selection is reproducible. |
| .github/workflows/node-repo-compile-check.yml | Mirrors the same platform-ref input and fetch/validation hardening for compile-check module composition. |
| .github/scripts/compose-sealed-modules.sh | Writes upstream module lists to a file argument so refusal/error output remains visible in CI logs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #2707, from its first satellite run (Manufacturing run 33283588300, attempt 2):
compose-sealed-modules.shreturned each upstream's module list on stdout and the caller captured it into a file — so the::errorlines it printed on a 404 seal / missing module set went into the list file, and the gate showed onlyProcess completed with exit code 1. The list is now written to a file argument; every message stays on stdout. Verified with a fakecurlanswering 404: the log now carries both::errorlines naming the identity and the republish.github.job_workflow_shais empty inside a reusable called from another repo (measured:JOB_WORKFLOW_SHA:blank in the step env), so the script fetch readmainwhile claiming a pin.node-repo-gate.ymlandnode-repo-compile-check.ymlgainplatform-ref(defaultmain; pin beside theuses:sha for reproducibility), assert it non-empty, and refuse a fetched file that is not a script.No caller input changes required (default
main).check-workflow-shell.py: 0 live;bash -nclean.🤖 Generated with Claude Code