Remaining bread consumers still clone into the shared src path (adopt pinned checkout helper) #82

New issue

Open

opened 2026-10-17 14:03:53 +08:00 by Breadway · 2 comments

Breadway commented

2026-10-17 14:03:53 +08:00

Owner

Found during ECO-79 coordinator verification, by reading the merged helper (bread-ecosystem c6442cab) and the ECO-79 mechanism list. Confidence high by source inspection; no new failure is attributed to it.

ECO-79 fixed the shared helper and Bread's check.yml/dev-release.yml. ECO-81 covers Bread's stable release.yml and ECO-82 covers bread-ecosystem dev-bakery/dev-bread-theme/package.yml. Still unfixed: the check.yml clone step in breadbar, breadbox, breadcrumbs, breadpad (and any other consumer listed in ECO-79) that still does rm -rf src && mkdir src && git clone --branch src into the shared workspace path.

Fix: adopt the pinned, SHA-verified helper from a reviewed bread-ecosystem commit, check out the event SHA into a per-job mktemp directory, export it via GITHUB_ENV, and clean only that directory in a final always step. Regression: local workflow fixture for exact SHA and directory isolation plus the existing ci/test-build-lock.sh. Do not batch repositories that already have their own cards.

Found during ECO-79 coordinator verification, by reading the merged helper (bread-ecosystem c6442cab) and the ECO-79 mechanism list. Confidence high by source inspection; no new failure is attributed to it. ECO-79 fixed the shared helper and Bread's check.yml/dev-release.yml. ECO-81 covers Bread's stable release.yml and ECO-82 covers bread-ecosystem dev-bakery/dev-bread-theme/package.yml. Still unfixed: the check.yml clone step in breadbar, breadbox, breadcrumbs, breadpad (and any other consumer listed in ECO-79) that still does rm -rf src && mkdir src && git clone --branch <ref> src into the shared workspace path. Fix: adopt the pinned, SHA-verified helper from a reviewed bread-ecosystem commit, check out the event SHA into a per-job mktemp directory, export it via GITHUB_ENV, and clean only that directory in a final always step. Regression: local workflow fixture for exact SHA and directory isolation plus the existing ci/test-build-lock.sh. Do not batch repositories that already have their own cards.

Breadway commented

2026-10-20 15:49:06 +08:00

Author

Owner

Work saved on Forgejo, all PRs unreviewed and unmerged. Open PRs: bos-settings #90 (a8ee98db), breadhelp #15 (5ab0baac), breadcrumbs #47 (3e04033e), breadbar #64 (6b595f37), breadbox #22 (67a40cbd), breadclip #23 (ca435293), breadpad #18 (45453eb7), breadpaper #17 (673e9b92), breadshot #12 (67a40cbd is breadbox; breadshot is ce534095). breadlock has no open PR; bread-ecosystem's own workflows are ECO-82 (bread-ecosystem #85). The check workflows only run on fix/** pushes, so each PR's own check run is the only real exercise of its change.

Breadway commented

2026-10-20 15:49:14 +08:00

Author

Owner

Correction to my previous comment, which garbled the breadbox and breadshot entries. The per-repo PRs for this card are: bos-settings #90 (a8ee98db), breadhelp #15 (5ab0baac), breadcrumbs #47 (3e04033e), breadbar #64 (6b595f37), breadbox #22 (67a40cbd), breadclip #23 (ca435293), breadpad #18 (45453eb7), breadpaper #17 (673e9b92), breadshot #12 (ce534095). All are unreviewed and unmerged. breadlock has no open PR. bread-ecosystem's own workflows are ECO-82 (bread-ecosystem #85). The check workflows run only on fix/** pushes, so each PR's own check run is the only real exercise of its change.