Breadway/bread-ecosystem
1
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

ci: check out the event sha into a per-job directory for main-trigger workflows #85

Open
Breadway wants to merge 2 commits from fix/eco-82-main-trigger-checkout into main
pull from: fix/eco-82-main-trigger-checkout
merge into: Breadway:main
Conversation 2 Commits 2 Files changed 5 +174 -20
Breadway commented 2026-10-20 15:33:28 +08:00
Owner
Copy link

Found by: ECO-82 card (bread-ecosystem main-trigger workflows still clone into the shared src path). Same class as ECO-79, which fixed check.yml in PR #79.

What changed

  • .forgejo/workflows/dev-bakery.yml and .forgejo/workflows/dev-bread-theme.yml (push to main): the checkout step no longer runs rm -rf src && mkdir src and clones the branch name into the shared relative path. It uses the same inline bootstrap as check.yml, which mirrors scripts/ci-checkout.sh (see docs/ci-checkout.md):
    • verifies GITHUB_SHA is a full 40-hex commit id
    • mktemp -d a per-job directory under RUNNER_TEMP
    • exports BREAD_CI_JOB_DIR through GITHUB_ENV
    • git clone --no-checkout, detaches at GITHUB_SHA, and verifies HEAD
  • Every later src reference reads from "$BREAD_CI_JOB_DIR/src". That covers build, test, compute dev version, prepare artifacts, sign, and gen-index.sh. gen-index.sh finds its registry from its own path, so running it from the per-job tree is unchanged.
  • A final if: always() step clean owned checkout removes only that directory, and only under RUNNER_TEMP.
  • .forgejo/workflows/package.yml (tag pushes): this job runs in a per-job Arch container, so its /home/builder/src is already private and not on the shared runner workspace. It still cloned the mutable tag name, so it now checks out GITHUB_SHA with the same verification. The clone path and all later steps are unchanged.

Unchanged: the /srv/breadway-dl/dev/... artifact paths and latest symlinks, strip and sha256 steps, minisign signing, index regeneration, the dev version formula, the package.yml pacman/makepkg/publish steps, and all paths: filters and branch/tag triggers. What is published does not change.

Deviation from the card

The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as check.yml in this repo, so the copies cannot diverge silently. Moving to a pinned fetch plus hash check is a follow-up.

How verified

  • yaml.safe_load parses dev-bakery.yml, dev-bread-theme.yml, and package.yml.
  • bash -n passes for every run: block in those three files.
  • Grep shows no remaining cd src, src/, rm -rf src, mkdir src, or git clone --branch in the three files. The remaining src tokens are the $checkout/src clone lines, the /home/builder/src container path, and BREAD_CI_JOB_DIR references.
  • Local fixture (not committed), run from the edited YAML: two concurrent dev-style jobs on different SHAs got distinct directories, each at its own exact SHA, with neither affecting the other. The cleanup step removed only its own directory. A non-40-hex GITHUB_SHA is rejected.
  • The package.yml checkout block, with the container path pointed at a temp dir, checked out the exact SHA and rejected a non-SHA value. Its pacman, makepkg, and publish steps were not run.

Not run

  • The three workflows on the self-hosted runner. dev-* runs on pushes to main, and package.yml runs on tags. This PR does not push to main or create tags.
  • Any /srv/breadway-dl write, minisign signing, index regeneration, or pacman publish.
  • The concurrent control that reproduces the old shared-path race.

Refs ECO-82

Found by: ECO-82 card (bread-ecosystem main-trigger workflows still clone into the shared src path). Same class as ECO-79, which fixed check.yml in PR #79. ## What changed - `.forgejo/workflows/dev-bakery.yml` and `.forgejo/workflows/dev-bread-theme.yml` (push to `main`): the checkout step no longer runs `rm -rf src && mkdir src` and clones the branch name into the shared relative path. It uses the same inline bootstrap as `check.yml`, which mirrors `scripts/ci-checkout.sh` (see `docs/ci-checkout.md`): - verifies `GITHUB_SHA` is a full 40-hex commit id - `mktemp -d` a per-job directory under `RUNNER_TEMP` - exports `BREAD_CI_JOB_DIR` through `GITHUB_ENV` - `git clone --no-checkout`, detaches at `GITHUB_SHA`, and verifies HEAD - Every later `src` reference reads from `"$BREAD_CI_JOB_DIR/src"`. That covers build, test, compute dev version, prepare artifacts, sign, and `gen-index.sh`. `gen-index.sh` finds its registry from its own path, so running it from the per-job tree is unchanged. - A final `if: always()` step `clean owned checkout` removes only that directory, and only under `RUNNER_TEMP`. - `.forgejo/workflows/package.yml` (tag pushes): this job runs in a per-job Arch container, so its `/home/builder/src` is already private and not on the shared runner workspace. It still cloned the mutable tag name, so it now checks out `GITHUB_SHA` with the same verification. The clone path and all later steps are unchanged. Unchanged: the `/srv/breadway-dl/dev/...` artifact paths and `latest` symlinks, strip and sha256 steps, minisign signing, index regeneration, the dev version formula, the `package.yml` pacman/makepkg/publish steps, and all `paths:` filters and branch/tag triggers. What is published does not change. ## Deviation from the card The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as `check.yml` in this repo, so the copies cannot diverge silently. Moving to a pinned fetch plus hash check is a follow-up. ## How verified - `yaml.safe_load` parses `dev-bakery.yml`, `dev-bread-theme.yml`, and `package.yml`. - `bash -n` passes for every `run:` block in those three files. - Grep shows no remaining `cd src`, `src/`, `rm -rf src`, `mkdir src`, or `git clone --branch` in the three files. The remaining `src` tokens are the `$checkout/src` clone lines, the `/home/builder/src` container path, and `BREAD_CI_JOB_DIR` references. - Local fixture (not committed), run from the edited YAML: two concurrent dev-style jobs on different SHAs got distinct directories, each at its own exact SHA, with neither affecting the other. The cleanup step removed only its own directory. A non-40-hex `GITHUB_SHA` is rejected. - The `package.yml` checkout block, with the container path pointed at a temp dir, checked out the exact SHA and rejected a non-SHA value. Its pacman, makepkg, and publish steps were not run. ## Not run - The three workflows on the self-hosted runner. `dev-*` runs on pushes to `main`, and `package.yml` runs on tags. This PR does not push to `main` or create tags. - Any `/srv/breadway-dl` write, minisign signing, index regeneration, or pacman publish. - The concurrent control that reproduces the old shared-path race. Refs ECO-82
ci: check out the event sha into a per-job directory for main-trigger workflows
All checks were successful
check / check (push) Successful in 3m23s
Details
848cfb0481 
dev-bakery.yml and dev-bread-theme.yml ran `rm -rf src && mkdir src` and
cloned the branch name into the shared relative path on the shared
self-hosted runner. Concurrent jobs can replace the tree under a running
build (ECO-79).

Both now use the same inline bootstrap as check.yml, mirroring
scripts/ci-checkout.sh (see docs/ci-checkout.md):

- verify GITHUB_SHA is a full 40-hex commit id
- mktemp a per-job directory under RUNNER_TEMP
- export BREAD_CI_JOB_DIR through GITHUB_ENV
- clone --no-checkout, detach at GITHUB_SHA, verify HEAD

Every later step reads "$BREAD_CI_JOB_DIR/src". A final always step
removes only that directory, and only under RUNNER_TEMP.

package.yml runs in a per-job Arch container, so its clone path is
already private. It still cloned the mutable tag name, so it now checks
out GITHUB_SHA with the same verification. The clone path and everything
after it are unchanged.

Artifact paths under /srv/breadway-dl, signing, index regeneration and
the pacman publish step are unchanged. No publish target changes.

Refs ECO-82
Breadway commented 2026-10-20 18:35:54 +08:00
Author
Owner
Copy link

Independent review: CHANGES REQUESTED

Reviewed exact head 848cfb0481 against base 6747eb2e1d. Live recheck: head/base unchanged, open, mergeable=true, merged=false. No merge, tags, publishing or release jobs performed.

Required rework

  • Fulfil the explicit ECO-82 pinned-helper criterion in .forgejo/workflows/dev-bakery.yml:24-39, dev-bread-theme.yml:27-42 and package.yml:27-41. Fetch scripts/ci-checkout.sh from an immutable reviewed revision already integrated on main, verify its SHA-256 against a committed expected value before executing it, and use that helper for the exact-event checkout. ECO-79 is integrated (c6442cabb6). The PR body explicitly defers this required behavior; an inline copy is not acceptance of this card. It also omits the helper's bounded noninteractive clone behavior. Preserve the container-private package path and all publication steps.
  • Commit workflow-level regression fixtures and wire them into check.yml. scripts/test-ci-checkout.sh tests the helper, not these new inline blocks. The current three-file diff includes no workflow fixture, and the PR says its fixture was not committed. Cover advanced branch versus event SHA, concurrent jobs, GITHUB_ENV consumers, unset RUNNER_TEMP, failed checkout cleanup, invalid SHA, and hash mismatch rejection before helper execution.

Criteria and evidence

  • PASS: isolated dev directories and exact event checkout. Independently executed checkout/cleanup blocks extracted from the actual YAML against a local file repository whose branch had advanced: both concurrent jobs retained different exact commits and distinct trees. GITHUB_ENV was loaded into separate consumer/cleanup processes; cleanup removed only its own tree. Invalid SHA rejected before allocation; nonexistent SHA failed and always-cleanup removed its directory. Unset RUNNER_TEMP correctly used /tmp and cleaned that invocation. package.yml checkout-only fixture detached at the earlier exact SHA and rejected a branch name. No pacman, archive, makepkg, curl, signing or production write executed.
  • FAIL: pinned helper acquisition plus committed SHA-256 verification, as above.
  • FAIL: repeatable committed workflow regression, as above. Existing helper regression passes but does not exercise the changed workflow copies.
  • PASS (static publication parity): parsed base/head YAML and compared every trigger, path filter, job setting, container, release gate and every downstream step after normalizing only the isolated source prefix and added quoting. Dev bakery still builds/tests bakery and copies bakery.toml plus bakery-x86_64 into /srv/breadway-dl/dev/bakery/; dev bread-theme still builds bread-theme with extract and copies its manifest/LICENSE and bread-theme-x86_64 into /srv/breadway-dl/dev/bread-theme/. Version formula, latest symlinks, strip/checksum/minisign behavior, TRACK=dev and index generation are unchanged. scripts/gen-index.sh still locates registry/bread-ecosystem.toml from its own script path; uploaded manifests remain primary. package.yml's entire suffix from cd /home/builder/src through archive, PKGBUILD version/checksum edits, makepkg and the authenticated Arch upload is byte-identical. Its v* trigger and -rc. exclusion are unchanged. No application, registry, packaging or manifest source changed. This confirms recipe parity, not a claim of actual publishing.
  • PASS: YAML parsing and bash -n for every run block in all three files; scripts/lint-pins.sh; scripts/test-ci-checkout.sh; ci/test-build-lock.sh; scripts/test-publish-symbols.sh; cargo fmt --all -- --check. The shared-path control emits expected race diagnostics while its suite exits zero.
  • PASS: ~/.local/bin/cargo test --release --locked -p bakery: 108 unit tests and 2 integration tests passed, 3 ignored. Full workspace clippy/feature matrix was not independently repeated locally.

CI and review state

Exact-head check / check (push): success, 3m23s, https://git.breadway.dev/Breadway/bread-ecosystem/actions/runs/319/jobs/0 . check.yml defines pin lint, helper regression, build-lock regression, symbol publisher, fmt, clippy default/gtk/extract, workspace tests default/gtk/extract and extract build. Main/tag publish workflows correctly do not run on this fix branch and were not invoked. Public read-only review API returned [] before this comment. Required branch-protection configuration was not observable: API returned 401 and MCP has no branch-protection endpoint; no credentials extracted. Coordinator must verify required-check configuration before any eventual merge.

Next: rework this existing PR, keep its branch, rerun tests/CI, then request fresh exact-head review. A green check does not waive the two unmet acceptance criteria. No separate backlog issue is needed for these in-scope acceptance defects. Not approved for integration. Issue returns to todo per review-gate workflow; coordinator owns rework and integration. Owned detached review clone remains at ~/.worktrees/bread-ecosystem/review-eco82-848cfb0, with no source edits.

## Independent review: CHANGES REQUESTED Reviewed exact head 848cfb04810a417c4b9818b3c265f9c02e7632c7 against base 6747eb2e1d94f67936d7ad07198e879174f19273. Live recheck: head/base unchanged, open, mergeable=true, merged=false. No merge, tags, publishing or release jobs performed. ### Required rework - [ ] Fulfil the explicit ECO-82 pinned-helper criterion in .forgejo/workflows/dev-bakery.yml:24-39, dev-bread-theme.yml:27-42 and package.yml:27-41. Fetch scripts/ci-checkout.sh from an immutable reviewed revision already integrated on main, verify its SHA-256 against a committed expected value before executing it, and use that helper for the exact-event checkout. ECO-79 is integrated (c6442cabb6c02acd1380dcd0d17189c4e22def03). The PR body explicitly defers this required behavior; an inline copy is not acceptance of this card. It also omits the helper's bounded noninteractive clone behavior. Preserve the container-private package path and all publication steps. - [ ] Commit workflow-level regression fixtures and wire them into check.yml. scripts/test-ci-checkout.sh tests the helper, not these new inline blocks. The current three-file diff includes no workflow fixture, and the PR says its fixture was not committed. Cover advanced branch versus event SHA, concurrent jobs, GITHUB_ENV consumers, unset RUNNER_TEMP, failed checkout cleanup, invalid SHA, and hash mismatch rejection before helper execution. ### Criteria and evidence - PASS: isolated dev directories and exact event checkout. Independently executed checkout/cleanup blocks extracted from the actual YAML against a local file repository whose branch had advanced: both concurrent jobs retained different exact commits and distinct trees. GITHUB_ENV was loaded into separate consumer/cleanup processes; cleanup removed only its own tree. Invalid SHA rejected before allocation; nonexistent SHA failed and always-cleanup removed its directory. Unset RUNNER_TEMP correctly used /tmp and cleaned that invocation. package.yml checkout-only fixture detached at the earlier exact SHA and rejected a branch name. No pacman, archive, makepkg, curl, signing or production write executed. - FAIL: pinned helper acquisition plus committed SHA-256 verification, as above. - FAIL: repeatable committed workflow regression, as above. Existing helper regression passes but does not exercise the changed workflow copies. - PASS (static publication parity): parsed base/head YAML and compared every trigger, path filter, job setting, container, release gate and every downstream step after normalizing only the isolated source prefix and added quoting. Dev bakery still builds/tests bakery and copies bakery.toml plus bakery-x86_64 into /srv/breadway-dl/dev/bakery/; dev bread-theme still builds bread-theme with extract and copies its manifest/LICENSE and bread-theme-x86_64 into /srv/breadway-dl/dev/bread-theme/. Version formula, latest symlinks, strip/checksum/minisign behavior, TRACK=dev and index generation are unchanged. scripts/gen-index.sh still locates registry/bread-ecosystem.toml from its own script path; uploaded manifests remain primary. package.yml's entire suffix from cd /home/builder/src through archive, PKGBUILD version/checksum edits, makepkg and the authenticated Arch upload is byte-identical. Its v* trigger and -rc. exclusion are unchanged. No application, registry, packaging or manifest source changed. This confirms recipe parity, not a claim of actual publishing. - PASS: YAML parsing and bash -n for every run block in all three files; scripts/lint-pins.sh; scripts/test-ci-checkout.sh; ci/test-build-lock.sh; scripts/test-publish-symbols.sh; cargo fmt --all -- --check. The shared-path control emits expected race diagnostics while its suite exits zero. - PASS: ~/.local/bin/cargo test --release --locked -p bakery: 108 unit tests and 2 integration tests passed, 3 ignored. Full workspace clippy/feature matrix was not independently repeated locally. ### CI and review state Exact-head check / check (push): success, 3m23s, https://git.breadway.dev/Breadway/bread-ecosystem/actions/runs/319/jobs/0 . check.yml defines pin lint, helper regression, build-lock regression, symbol publisher, fmt, clippy default/gtk/extract, workspace tests default/gtk/extract and extract build. Main/tag publish workflows correctly do not run on this fix branch and were not invoked. Public read-only review API returned [] before this comment. Required branch-protection configuration was not observable: API returned 401 and MCP has no branch-protection endpoint; no credentials extracted. Coordinator must verify required-check configuration before any eventual merge. Next: rework this existing PR, keep its branch, rerun tests/CI, then request fresh exact-head review. A green check does not waive the two unmet acceptance criteria. No separate backlog issue is needed for these in-scope acceptance defects. Not approved for integration. Issue returns to todo per review-gate workflow; coordinator owns rework and integration. Owned detached review clone remains at ~/.worktrees/bread-ecosystem/review-eco82-848cfb0, with no source edits.
fix(ci): pin checkout helper and test main workflows
Some checks failed
check / check (push) Failing after 5s
Details
2a8a5fe287
Breadway commented 2026-10-20 18:42:45 +08:00
Author
Owner
Copy link

Reworked requested review items on the same PR/branch. The three workflow checkout blocks now fetch scripts/ci-checkout.sh at reviewed merged commit c6442cabb6, verify committed SHA-256 39d07ff4efe2336fe5eac1f1099590d5427e04111e0f51fc3f905df2cfbd205f before executing, then call the helper for the exact event SHA. Added scripts/test-main-checkout-workflows.sh and wired it into check.yml. It extracts and executes the actual checkout YAML run blocks using local/offline Git fixtures; coverage includes advanced branch event SHA, concurrent isolated directories, GITHUB_ENV to a separate process, /tmp fallback, invalid SHA, missing commit, scoped cleanup, hash corruption, and acquisition failure. No publication command or service operation was run. Verification: YAML and bash run-block parsing; bash -n test; scripts/test-ci-checkout.sh; scripts/test-main-checkout-workflows.sh; scripts/test-publish-symbols.sh; scripts/test-gen-index.sh; ci/test-build-lock.sh; cargo fmt --all -- --check; cargo test --release --locked -p bakery (108 passed, 3 ignored). All passed. Commit/head: 2a8a5fe. Please request fresh independent review on this head.

Reworked requested review items on the same PR/branch. The three workflow checkout blocks now fetch scripts/ci-checkout.sh at reviewed merged commit c6442cabb6c02acd1380dcd0d17189c4e22def03, verify committed SHA-256 39d07ff4efe2336fe5eac1f1099590d5427e04111e0f51fc3f905df2cfbd205f before executing, then call the helper for the exact event SHA. Added scripts/test-main-checkout-workflows.sh and wired it into check.yml. It extracts and executes the actual checkout YAML run blocks using local/offline Git fixtures; coverage includes advanced branch event SHA, concurrent isolated directories, GITHUB_ENV to a separate process, /tmp fallback, invalid SHA, missing commit, scoped cleanup, hash corruption, and acquisition failure. No publication command or service operation was run. Verification: YAML and bash run-block parsing; bash -n test; scripts/test-ci-checkout.sh; scripts/test-main-checkout-workflows.sh; scripts/test-publish-symbols.sh; scripts/test-gen-index.sh; ci/test-build-lock.sh; cargo fmt --all -- --check; cargo test --release --locked -p bakery (108 passed, 3 ignored). All passed. Commit/head: 2a8a5fe. Please request fresh independent review on this head.
Some checks failed
check / check (push) Failing after 5s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/eco-82-main-trigger-checkout:fix/eco-82-main-trigger-checkout
git switch fix/eco-82-main-trigger-checkout

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff fix/eco-82-main-trigger-checkout
git switch fix/eco-82-main-trigger-checkout
git rebase main
git switch main
git merge --ff-only fix/eco-82-main-trigger-checkout
git switch fix/eco-82-main-trigger-checkout
git rebase main
git switch main
git merge --no-ff fix/eco-82-main-trigger-checkout
git switch main
git merge --squash fix/eco-82-main-trigger-checkout
git switch main
git merge --ff-only fix/eco-82-main-trigger-checkout
git switch main
git merge fix/eco-82-main-trigger-checkout
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bread-theme

   
breadbug

   
bug

   
ci

   
enhancement

   
phase-2

   
release

   
rollout
No labels
bread-theme
breadbug
bug
ci
enhancement
phase-2
release
rollout
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bread-ecosystem!85
No description provided.