ci(check): check out the event sha into a per-job directory #47

Open

Breadway wants to merge 1 commit from fix/eco-83-check-checkout-isolation into main

pull from: fix/eco-83-check-checkout-isolation

merge into: Breadway:main

Breadway:main

Breadway:fix/crumb-audit-batch

Breadway:fix/crumb-27-bootstrap-ssid

Breadway:fix/crumb-33-fail-closed-dns

Breadway:fix/crumb-26-latest-set-profile

Breadway:fix/crumb-31-trim-set-profile

Breadway:fix/crumb-34-list-effective-exit-nodes

Breadway:fix/crumb-30-match-fqdn

Breadway:fix/crumb-29-normalize-exit-nodes

Conversation 0 Commits 1 Files changed 1 +33 -8

Breadway commented 2026-10-20 15:37:40 +08:00

Owner

Copy link

Found by: ECO-83 card (remaining consumers still clone into the shared src path). Same class as ECO-79.

What changed

.forgejo/workflows/check.yml: the checkout step no longer runs rm -rf src && mkdir src and clones the branch name into the shared relative path. It uses the inline bootstrap of bread-ecosystem scripts/ci-checkout.sh (see its docs/ci-checkout.md), the same as bread's check.yml:

• verifies GITHUB_SHA is a full 40-hex commit id
• mktemp -d a per-job directory under RUNNER_TEMP
• exports BREAD_CI_JOB_DIR through GITHUB_ENV
• git clone --no-checkout, detaches at GITHUB_SHA, and verifies HEAD

Every later src reference in a run block now reads from the per-job directory. A final if: always() step clean owned checkout removes only that directory, and only under RUNNER_TEMP.

Also runs fmt via ci/build.sh and test --release.

Unchanged: the ci/bread-ecosystem.rev pin (it predates the helper, and the card does not ask for a bump), the dev-mode resolution, lint-pins, the build and test commands, and all triggers.

Deviation from the card

The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as bread's check.yml, because the pinned rev does not contain ci-checkout.sh. Moving to a pinned fetch is a follow-up.

How verified

• yaml.safe_load parses the file.
• bash -n passes for every run: block.
• Grep shows no remaining bare cd src, src/, rm -rf src, mkdir src, --root src, or git clone --branch in run blocks. Matches are comments only.
• Local fixture (not committed), run from this file's own checkout and cleanup blocks: exact SHA at HEAD, two concurrent jobs on different SHAs got distinct directories with no interference, cleanup removed only its own directory, and a non-40-hex GITHUB_SHA is rejected.

Not run

• The ci/test-build-lock.sh regression the card mentions. It is not in this repo's pinned bread-ecosystem rev, so it cannot run from this tree without bumping the pin, which the card does not ask for.
• check.yml on the self-hosted runner. Its result on the pushed head is recorded on the PR.

Refs ECO-83

Found by: ECO-83 card (remaining consumers still clone into the shared src path). Same class as ECO-79. ## What changed `.forgejo/workflows/check.yml`: the checkout step no longer runs `rm -rf src && mkdir src` and clones the branch name into the shared relative path. It uses the inline bootstrap of bread-ecosystem `scripts/ci-checkout.sh` (see its `docs/ci-checkout.md`), the same as bread's `check.yml`: - verifies `GITHUB_SHA` is a full 40-hex commit id - `mktemp -d` a per-job directory under `RUNNER_TEMP` - exports `BREAD_CI_JOB_DIR` through `GITHUB_ENV` - `git clone --no-checkout`, detaches at `GITHUB_SHA`, and verifies HEAD Every later `src` reference in a run block now reads from the per-job directory. A final `if: always()` step `clean owned checkout` removes only that directory, and only under `RUNNER_TEMP`. Also runs fmt via ci/build.sh and test --release. Unchanged: the `ci/bread-ecosystem.rev` pin (it predates the helper, and the card does not ask for a bump), the dev-mode resolution, lint-pins, the build and test commands, and all triggers. ## Deviation from the card The card asks for a pinned helper fetch with a committed SHA-256. This PR uses the inline bootstrap, the same as bread's `check.yml`, because the pinned rev does not contain `ci-checkout.sh`. Moving to a pinned fetch is a follow-up. ## How verified - `yaml.safe_load` parses the file. - `bash -n` passes for every `run:` block. - Grep shows no remaining bare `cd src`, `src/`, `rm -rf src`, `mkdir src`, `--root src`, or `git clone --branch` in run blocks. Matches are comments only. - Local fixture (not committed), run from this file's own checkout and cleanup blocks: exact SHA at HEAD, two concurrent jobs on different SHAs got distinct directories with no interference, cleanup removed only its own directory, and a non-40-hex `GITHUB_SHA` is rejected. ## Not run - The ci/test-build-lock.sh regression the card mentions. It is not in this repo's pinned bread-ecosystem rev, so it cannot run from this tree without bumping the pin, which the card does not ask for. - `check.yml` on the self-hosted runner. Its result on the pushed head is recorded on the PR. Refs ECO-83

Breadway added 1 commit 2026-10-20 15:37:41 +08:00

ci(check): check out the event sha into a per-job directory ... 3e04033e53

check.yml ran `rm -rf src && mkdir src` and cloned the branch name into
the shared relative path on the shared self-hosted runner. Concurrent
jobs can replace the tree under a running build (ECO-79).

The checkout step now uses the same inline bootstrap as bread's
check.yml, mirroring bread-ecosystem scripts/ci-checkout.sh (see its
docs/ci-checkout.md):

- verify GITHUB_SHA is a full 40-hex commit id
- mktemp a per-job directory under RUNNER_TEMP
- export BREAD_CI_JOB_DIR through GITHUB_ENV
- clone --no-checkout, detach at GITHUB_SHA, verify HEAD

Later steps read from the per-job directory. A final always step removes
only that directory, and only under RUNNER_TEMP. Dev-mode resolution,
lint-pins, the build and test commands, and the pinned ci/bread-ecosystem.rev
are unchanged.

Refs ECO-83

All checks were successful

Hide all checks

check / check (push) Successful in 18m48s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/eco-83-check-checkout-isolation:fix/eco-83-check-checkout-isolation

git switch fix/eco-83-check-checkout-isolation

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff fix/eco-83-check-checkout-isolation

git switch fix/eco-83-check-checkout-isolation

git rebase main

git switch main

git merge --ff-only fix/eco-83-check-checkout-isolation

git switch fix/eco-83-check-checkout-isolation

git rebase main

git switch main

git merge --no-ff fix/eco-83-check-checkout-isolation

git switch main

git merge --squash fix/eco-83-check-checkout-isolation

git switch main

git merge --ff-only fix/eco-83-check-checkout-isolation

git switch main

git merge fix/eco-83-check-checkout-isolation

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

  

ci

  

enhancement

No labels

bug

ci

enhancement

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Breadway/breadcrumbs!47

No description provided.