ci(hardwood): guard vendored bundle with provenance file + PR check - #49
Merged
Merged
Conversation
Add public/hardwood/SOURCE_COMMIT.txt recording that the deployed bundle is the "July monolith" build (restored in e99e60e; BballTactics source f7b01e3 per project memory). Add a pull_request-only CI step that fails when any public/hardwood/ file changes without also bumping SOURCE_COMMIT.txt, so a stale bundle like PR #43 can't ship silently again. Claude-Session: https://claude.ai/code/session_01Vw2vZeTuaUDVaCvvRk1NME
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Livelihood stream: Games (protects shipped Hardwood asset / infra safety)
Why:
public/hardwood/is a vendored build from the separate BballTactics repo; in PR #43 a stale/mismatched bundle shipped and regressed live/hardwood, requiring a same-day revert (e99e60e). This records the bundle's provenance and adds a CI gate so a bundle change can never merge again without an updated provenance note.Files changed:
public/hardwood/SOURCE_COMMIT.txt(new) — records that the deployed bundle is the "July monolith" build, restored in zero-nexte99e60e; BballTactics source SHAf7b01e3per project memory (labeled as recorded provenance, with an explicit UNKNOWN fallback if it can't be confirmed on rebuild); plus rebuild/re-sync instructions..github/workflows/ci.yml— newpull_request-only step "Guard vendored Hardwood bundle provenance" that fails the build if anypublic/hardwood/file changed butSOURCE_COMMIT.txtdid not, with a fix message.push-to-main runs are unaffected (guarded byif: github.event_name == 'pull_request').YAML validation:
Test output (
yarn test):🤖 Generated with Claude Code