bread-ecosystem main-trigger workflows still clone into shared src #81

New issue

Open

opened 2026-10-16 18:55:26 +08:00 by Breadway · 1 comment

Breadway commented

2026-10-16 18:55:26 +08:00

Owner

Found during ECO-79 follow-up review of bread-ecosystem workflows. .forgejo/workflows/dev-bakery.yml, dev-bread-theme.yml, and package.yml still use the shared relative src checkout path. This is separate from the isolated check workflow changed by ECO-79 PR #79.

Confidence: high that these files retain the fixed-path checkout pattern by source inspection. No failure in these workflows is attributed to a runner interleaving; the exact shared workspace behavior is not confirmed from the runner.

After the shared checkout helper is reviewed and merged, update only these main-trigger workflows in a separate fix branch/PR: acquire a pinned helper revision, verify its committed SHA-256 before use, check out the event SHA into a per-job directory, export the directory through GITHUB_ENV, and clean only that invocation's directory in a final always step. Preserve package/artifact paths and verify their consumers.

Regression: local workflow fixture for exact-SHA and directory isolation, plus relevant CI checks. Do not batch other repositories or the rc/stable workflows here.

Found during ECO-79 follow-up review of bread-ecosystem workflows. `.forgejo/workflows/dev-bakery.yml`, `dev-bread-theme.yml`, and `package.yml` still use the shared relative `src` checkout path. This is separate from the isolated check workflow changed by ECO-79 PR #79. Confidence: high that these files retain the fixed-path checkout pattern by source inspection. No failure in these workflows is attributed to a runner interleaving; the exact shared workspace behavior is not confirmed from the runner. After the shared checkout helper is reviewed and merged, update only these main-trigger workflows in a separate fix branch/PR: acquire a pinned helper revision, verify its committed SHA-256 before use, check out the event SHA into a per-job directory, export the directory through GITHUB_ENV, and clean only that invocation's directory in a final always step. Preserve package/artifact paths and verify their consumers. Regression: local workflow fixture for exact-SHA and directory isolation, plus relevant CI checks. Do not batch other repositories or the rc/stable workflows here.

Breadway commented

2026-10-20 15:33:54 +08:00

Author

Owner

PR open: #85 (fix/eco-82-main-trigger-checkout). Head SHA: 848cfb0481. dev-bakery.yml and dev-bread-theme.yml moved to the per-job checkout; package.yml now checks out GITHUB_SHA with the same verification (its path is already per-job in the Arch container). Verified: YAML parses, bash -n on all run blocks, grep for leftover src refs, local fixture of the checkout/cleanup blocks (exact SHA, concurrent jobs isolated, cleanup scoped, non-SHA rejected). Not run: the main-trigger and tag workflows on the runner, and any publish. Pinned-helper follow-up not done; inline bootstrap used as in check.yml.

PR open: https://git.breadway.dev/Breadway/bread-ecosystem/pulls/85 (fix/eco-82-main-trigger-checkout). Head SHA: 848cfb04810a417c4b9818b3c265f9c02e7632c7. dev-bakery.yml and dev-bread-theme.yml moved to the per-job checkout; package.yml now checks out GITHUB_SHA with the same verification (its path is already per-job in the Arch container). Verified: YAML parses, bash -n on all run blocks, grep for leftover src refs, local fixture of the checkout/cleanup blocks (exact SHA, concurrent jobs isolated, cleanup scoped, non-SHA rejected). Not run: the main-trigger and tag workflows on the runner, and any publish. Pinned-helper follow-up not done; inline bootstrap used as in check.yml.