Breadway/bos-settings

Fork 0

ci(check): check out the event sha into a per-job directory #90

Open

Breadway wants to merge 2 commits from fix/eco-83-check-checkout-isolation into main

Breadway commented

2026-10-20 15:37:48 +08:00

Owner

Found by: ECO-83 card (remaining consumers still clone into the shared src path). Same class as ECO-79.

What changed

.forgejo/workflows/check.yml: the checkout step no longer runs rm -rf src && mkdir src and clones the branch name into the shared relative path. It uses the inline bootstrap of bread-ecosystem scripts/ci-checkout.sh (see its docs/ci-checkout.md), the same as bread's check.yml:

verifies GITHUB_SHA is a full 40-hex commit id
mktemp -d a per-job directory under RUNNER_TEMP
exports BREAD_CI_JOB_DIR through GITHUB_ENV
git clone --no-checkout, detaches at GITHUB_SHA, and verifies HEAD

Every later src reference in a run block now reads from the per-job directory. A final if: always() step clean owned checkout removes only that directory, and only under RUNNER_TEMP.

Tauri layout: the Cargo root is src/src and frontendDist is ../frontend/build relative to it. The stub is now mkdir -p "$BREAD_CI_JOB_DIR/src/frontend/build", and fmt, clippy, test, lint-pins and dev-deps all run in "$BREAD_CI_JOB_DIR/src/src". Plain cargo, no ci/build.sh wrapper, so no docker mount is involved.

Unchanged: the ci/bread-ecosystem.rev pin (it predates the helper, and the card does not ask for a bump), the dev-mode resolution, lint-pins, the build and test commands, and all triggers.

Deviation from the card

The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as bread's check.yml, because the pinned rev does not contain ci-checkout.sh. Moving to a pinned fetch is a follow-up.

How verified

yaml.safe_load parses the file.
bash -n passes for every run: block.
Grep shows no remaining bare cd src, src/, rm -rf src, mkdir src, --root src, or git clone --branch in run blocks. Matches are comments only.
Local fixture (not committed), run from this file's own checkout and cleanup blocks: exact SHA at HEAD, two concurrent jobs on different SHAs got distinct directories with no interference, cleanup removed only its own directory, and a non-40-hex GITHUB_SHA is rejected.

Not run

The ci/test-build-lock.sh regression the card mentions. It is not in this repo's pinned bread-ecosystem rev, so it cannot run from this tree without bumping the pin, which the card does not ask for.
check.yml on the self-hosted runner. Its result on the pushed head is recorded on the PR.

Refs ECO-83

Found by: ECO-83 card (remaining consumers still clone into the shared src path). Same class as ECO-79. ## What changed `.forgejo/workflows/check.yml`: the checkout step no longer runs `rm -rf src && mkdir src` and clones the branch name into the shared relative path. It uses the inline bootstrap of bread-ecosystem `scripts/ci-checkout.sh` (see its `docs/ci-checkout.md`), the same as bread's `check.yml`: - verifies `GITHUB_SHA` is a full 40-hex commit id - `mktemp -d` a per-job directory under `RUNNER_TEMP` - exports `BREAD_CI_JOB_DIR` through `GITHUB_ENV` - `git clone --no-checkout`, detaches at `GITHUB_SHA`, and verifies HEAD Every later `src` reference in a run block now reads from the per-job directory. A final `if: always()` step `clean owned checkout` removes only that directory, and only under `RUNNER_TEMP`. Tauri layout: the Cargo root is src/src and frontendDist is ../frontend/build relative to it. The stub is now mkdir -p "$BREAD_CI_JOB_DIR/src/frontend/build", and fmt, clippy, test, lint-pins and dev-deps all run in "$BREAD_CI_JOB_DIR/src/src". Plain cargo, no ci/build.sh wrapper, so no docker mount is involved. Unchanged: the `ci/bread-ecosystem.rev` pin (it predates the helper, and the card does not ask for a bump), the dev-mode resolution, lint-pins, the build and test commands, and all triggers. ## Deviation from the card The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as bread's `check.yml`, because the pinned rev does not contain `ci-checkout.sh`. Moving to a pinned fetch is a follow-up. ## How verified - `yaml.safe_load` parses the file. - `bash -n` passes for every `run:` block. - Grep shows no remaining bare `cd src`, `src/`, `rm -rf src`, `mkdir src`, `--root src`, or `git clone --branch` in run blocks. Matches are comments only. - Local fixture (not committed), run from this file's own checkout and cleanup blocks: exact SHA at HEAD, two concurrent jobs on different SHAs got distinct directories with no interference, cleanup removed only its own directory, and a non-40-hex `GITHUB_SHA` is rejected. ## Not run - The ci/test-build-lock.sh regression the card mentions. It is not in this repo's pinned bread-ecosystem rev, so it cannot run from this tree without bumping the pin, which the card does not ask for. - `check.yml` on the self-hosted runner. Its result on the pushed head is recorded on the PR. Refs ECO-83

Breadway added 1 commit

2026-10-20 15:37:49 +08:00

ci(check): check out the event sha into a per-job directory

check / check (push) Failing after 24s

Details

a8ee98db47

check.yml ran `rm -rf src && mkdir src` and cloned the branch name into
the shared relative path on the shared self-hosted runner. Concurrent
jobs can replace the tree under a running build (ECO-79).

The checkout step now uses the same inline bootstrap as bread's
check.yml, mirroring bread-ecosystem scripts/ci-checkout.sh (see its
docs/ci-checkout.md):

- verify GITHUB_SHA is a full 40-hex commit id
- mktemp a per-job directory under RUNNER_TEMP
- export BREAD_CI_JOB_DIR through GITHUB_ENV
- clone --no-checkout, detach at GITHUB_SHA, verify HEAD

Later steps read from the per-job directory. A final always step removes
only that directory, and only under RUNNER_TEMP. Dev-mode resolution,
lint-pins, the build and test commands, and the pinned ci/bread-ecosystem.rev
are unchanged.

Refs ECO-83

Breadway added 1 commit

2026-10-20 17:29:39 +08:00

Merge remote-tracking branch 'origin/main' into fix/eco-83-check-checkout-isolation

check / check (push) Successful in 4m51s

Details

39ab67f55e

check / check (push) Successful in 4m51s

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/eco-83-check-checkout-isolation:fix/eco-83-check-checkout-isolation

git switch fix/eco-83-check-checkout-isolation

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff fix/eco-83-check-checkout-isolation

git switch fix/eco-83-check-checkout-isolation

git rebase main

git switch main

git merge --ff-only fix/eco-83-check-checkout-isolation

git switch fix/eco-83-check-checkout-isolation

git rebase main

git switch main

git merge --no-ff fix/eco-83-check-checkout-isolation

git switch main

git merge --squash fix/eco-83-check-checkout-isolation