fix(reconcile): generate own self-heal companion with a stable-release install - #489
Merged
Merged
Conversation
…e install Cascade's own pin-reconcile companion was hand-authored and installed the newest release tag unfiltered, so its CI could self-install an rc or a draft. Generate the companion from the same reconcile generator that emits a user's companion, in a new own-repo variant, and install the latest non-prerelease release instead. The own-repo variant scans both the workflow and composite-action trees, runs reconcile in own-repo mode, and commits the regenerated workflows with the updated action_pins.yaml. A drift-lock test holds the file byte-for-byte against the generator. Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
Contributor
|
All PR Validation checks passed. |
The own-repo self-heal companion (.github/workflows/pin-reconcile.yaml) is cascade-generated and drift-locked but lives outside cascade's own manifest workflow plan, so verify's orphan scan wrongly claimed it as manifest drift once it began carrying the shared GeneratedFileMarker. Give the own-repo emission a distinct provenance marker (OwnRepoGeneratedFileMarker) and teach findOrphans to skip files carrying it, while a file bearing the plain GeneratedFileMarker that is not planned is still flagged. Regenerate pin-reconcile.yaml with the new marker and lock it in tests. Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Cascade's own self-heal companion (
.github/workflows/pin-reconcile.yaml) was hand-authored separately from the generator that emits the equivalent companion for users, so the two drifted. Its install step resolved the newest release withgh release list -R stablekernel/cascade -L 1, which includes prereleases, letting cascade's own CI self-install an rc. Cascade's own repo must only self-update to a stable, non-prerelease release.Fix
WithOwnRepo()functional option, existing two-argNewReconcileGeneratorand its caller untouched). The own-repo companion is emitted from the same template as the user emission and differs only where it must: it installs the latest non-prerelease release, scans both.github/workflows/and.github/actions/for governed refs, and stages plus commits the regenerated workflows and the pin manifest..github/workflows/pin-reconcile.yamlwith the generator output. The only behavioral change versus the prior committed file is the release selector, nowgh release list -R stablekernel/cascade --exclude-pre-releases --exclude-drafts -L 1 --json tagName -q '.[0].tagName'. The versioned asset globcascade_*_linux_amd64.tar.gzis preserved.reconcile --check --check-output pin-reconcile-result.json,--changed-filewiring, result upload) with a shape test. The detector lives inside pr.yaml's multi-purposeworkflow-driftjob, which builds the binary from source and shares an advisory frame with the non-reconcile verify step, so its shape is locked in place rather than regenerated into the required gate.CONTRIBUTING.md: cascade's own self-heal companion is generated from the same template as the user emission, installs a stable release, and is drift-locked.Verification
go build ./...,go test ./...,go test ./... -race, andgolangci-lint run ./...all clean.internal/generate/action_pins.yamlturned the consistency lint red; running the exact command the generated companion emits (cascade reconcile --own-repo --action-pins internal/generate/action_pins.yaml --changed-file ...) re-adopted the real ref and regenerated, turning the lint green again. Scratch edits restored.