Breadway/bread-ecosystem
1
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

ci: check out the event sha into a per-job directory for main-trigger workflows #85

Open
Breadway wants to merge 1 commit from fix/eco-82-main-trigger-checkout into main
pull from: fix/eco-82-main-trigger-checkout
merge into: Breadway:main
Conversation 0 Commits 1 Files changed 3 +83 -20
Breadway commented 2026-10-20 15:33:28 +08:00
Owner
Copy link

Found by: ECO-82 card (bread-ecosystem main-trigger workflows still clone into the shared src path). Same class as ECO-79, which fixed check.yml in PR #79.

What changed

  • .forgejo/workflows/dev-bakery.yml and .forgejo/workflows/dev-bread-theme.yml (push to main): the checkout step no longer runs rm -rf src && mkdir src and clones the branch name into the shared relative path. It uses the same inline bootstrap as check.yml, which mirrors scripts/ci-checkout.sh (see docs/ci-checkout.md):
    • verifies GITHUB_SHA is a full 40-hex commit id
    • mktemp -d a per-job directory under RUNNER_TEMP
    • exports BREAD_CI_JOB_DIR through GITHUB_ENV
    • git clone --no-checkout, detaches at GITHUB_SHA, and verifies HEAD
  • Every later src reference reads from "$BREAD_CI_JOB_DIR/src". That covers build, test, compute dev version, prepare artifacts, sign, and gen-index.sh. gen-index.sh finds its registry from its own path, so running it from the per-job tree is unchanged.
  • A final if: always() step clean owned checkout removes only that directory, and only under RUNNER_TEMP.
  • .forgejo/workflows/package.yml (tag pushes): this job runs in a per-job Arch container, so its /home/builder/src is already private and not on the shared runner workspace. It still cloned the mutable tag name, so it now checks out GITHUB_SHA with the same verification. The clone path and all later steps are unchanged.

Unchanged: the /srv/breadway-dl/dev/... artifact paths and latest symlinks, strip and sha256 steps, minisign signing, index regeneration, the dev version formula, the package.yml pacman/makepkg/publish steps, and all paths: filters and branch/tag triggers. What is published does not change.

Deviation from the card

The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as check.yml in this repo, so the copies cannot diverge silently. Moving to a pinned fetch plus hash check is a follow-up.

How verified

  • yaml.safe_load parses dev-bakery.yml, dev-bread-theme.yml, and package.yml.
  • bash -n passes for every run: block in those three files.
  • Grep shows no remaining cd src, src/, rm -rf src, mkdir src, or git clone --branch in the three files. The remaining src tokens are the $checkout/src clone lines, the /home/builder/src container path, and BREAD_CI_JOB_DIR references.
  • Local fixture (not committed), run from the edited YAML: two concurrent dev-style jobs on different SHAs got distinct directories, each at its own exact SHA, with neither affecting the other. The cleanup step removed only its own directory. A non-40-hex GITHUB_SHA is rejected.
  • The package.yml checkout block, with the container path pointed at a temp dir, checked out the exact SHA and rejected a non-SHA value. Its pacman, makepkg, and publish steps were not run.

Not run

  • The three workflows on the self-hosted runner. dev-* runs on pushes to main, and package.yml runs on tags. This PR does not push to main or create tags.
  • Any /srv/breadway-dl write, minisign signing, index regeneration, or pacman publish.
  • The concurrent control that reproduces the old shared-path race.

Refs ECO-82

Found by: ECO-82 card (bread-ecosystem main-trigger workflows still clone into the shared src path). Same class as ECO-79, which fixed check.yml in PR #79. ## What changed - `.forgejo/workflows/dev-bakery.yml` and `.forgejo/workflows/dev-bread-theme.yml` (push to `main`): the checkout step no longer runs `rm -rf src && mkdir src` and clones the branch name into the shared relative path. It uses the same inline bootstrap as `check.yml`, which mirrors `scripts/ci-checkout.sh` (see `docs/ci-checkout.md`): - verifies `GITHUB_SHA` is a full 40-hex commit id - `mktemp -d` a per-job directory under `RUNNER_TEMP` - exports `BREAD_CI_JOB_DIR` through `GITHUB_ENV` - `git clone --no-checkout`, detaches at `GITHUB_SHA`, and verifies HEAD - Every later `src` reference reads from `"$BREAD_CI_JOB_DIR/src"`. That covers build, test, compute dev version, prepare artifacts, sign, and `gen-index.sh`. `gen-index.sh` finds its registry from its own path, so running it from the per-job tree is unchanged. - A final `if: always()` step `clean owned checkout` removes only that directory, and only under `RUNNER_TEMP`. - `.forgejo/workflows/package.yml` (tag pushes): this job runs in a per-job Arch container, so its `/home/builder/src` is already private and not on the shared runner workspace. It still cloned the mutable tag name, so it now checks out `GITHUB_SHA` with the same verification. The clone path and all later steps are unchanged. Unchanged: the `/srv/breadway-dl/dev/...` artifact paths and `latest` symlinks, strip and sha256 steps, minisign signing, index regeneration, the dev version formula, the `package.yml` pacman/makepkg/publish steps, and all `paths:` filters and branch/tag triggers. What is published does not change. ## Deviation from the card The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as `check.yml` in this repo, so the copies cannot diverge silently. Moving to a pinned fetch plus hash check is a follow-up. ## How verified - `yaml.safe_load` parses `dev-bakery.yml`, `dev-bread-theme.yml`, and `package.yml`. - `bash -n` passes for every `run:` block in those three files. - Grep shows no remaining `cd src`, `src/`, `rm -rf src`, `mkdir src`, or `git clone --branch` in the three files. The remaining `src` tokens are the `$checkout/src` clone lines, the `/home/builder/src` container path, and `BREAD_CI_JOB_DIR` references. - Local fixture (not committed), run from the edited YAML: two concurrent dev-style jobs on different SHAs got distinct directories, each at its own exact SHA, with neither affecting the other. The cleanup step removed only its own directory. A non-40-hex `GITHUB_SHA` is rejected. - The `package.yml` checkout block, with the container path pointed at a temp dir, checked out the exact SHA and rejected a non-SHA value. Its pacman, makepkg, and publish steps were not run. ## Not run - The three workflows on the self-hosted runner. `dev-*` runs on pushes to `main`, and `package.yml` runs on tags. This PR does not push to `main` or create tags. - Any `/srv/breadway-dl` write, minisign signing, index regeneration, or pacman publish. - The concurrent control that reproduces the old shared-path race. Refs ECO-82
ci: check out the event sha into a per-job directory for main-trigger workflows
All checks were successful
check / check (push) Successful in 3m23s
Details
848cfb0481 
dev-bakery.yml and dev-bread-theme.yml ran `rm -rf src && mkdir src` and
cloned the branch name into the shared relative path on the shared
self-hosted runner. Concurrent jobs can replace the tree under a running
build (ECO-79).

Both now use the same inline bootstrap as check.yml, mirroring
scripts/ci-checkout.sh (see docs/ci-checkout.md):

- verify GITHUB_SHA is a full 40-hex commit id
- mktemp a per-job directory under RUNNER_TEMP
- export BREAD_CI_JOB_DIR through GITHUB_ENV
- clone --no-checkout, detach at GITHUB_SHA, verify HEAD

Every later step reads "$BREAD_CI_JOB_DIR/src". A final always step
removes only that directory, and only under RUNNER_TEMP.

package.yml runs in a per-job Arch container, so its clone path is
already private. It still cloned the mutable tag name, so it now checks
out GITHUB_SHA with the same verification. The clone path and everything
after it are unchanged.

Artifact paths under /srv/breadway-dl, signing, index regeneration and
the pacman publish step are unchanged. No publish target changes.

Refs ECO-82
All checks were successful
check / check (push) Successful in 3m23s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/eco-82-main-trigger-checkout:fix/eco-82-main-trigger-checkout
git switch fix/eco-82-main-trigger-checkout

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff fix/eco-82-main-trigger-checkout
git switch fix/eco-82-main-trigger-checkout
git rebase main
git switch main
git merge --ff-only fix/eco-82-main-trigger-checkout
git switch fix/eco-82-main-trigger-checkout
git rebase main
git switch main
git merge --no-ff fix/eco-82-main-trigger-checkout
git switch main
git merge --squash fix/eco-82-main-trigger-checkout
git switch main
git merge --ff-only fix/eco-82-main-trigger-checkout
git switch main
git merge fix/eco-82-main-trigger-checkout
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bread-theme

   
breadbug

   
bug

   
ci

   
enhancement

   
phase-2

   
release

   
rollout
No labels
bread-theme
breadbug
bug
ci
enhancement
phase-2
release
rollout
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bread-ecosystem!85
No description provided.