Zayin/Signage
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 5 Wiki Activity

ci: pin the platform harness to the released Core v0.2.5
CI / lint (pull_request) Successful in 19s
Details
CI / typecheck (pull_request) Successful in 18s
Details
CI / test (pull_request) Successful in 23s
Details
CI / build (pull_request) Successful in 19s
Details
CI / package (pull_request) Successful in 22s
Details
CI / integration (pull_request) Successful in 8m47s
Details

Browse Source 
Integration still fetched Core at PR #92's head (5e9433d): the right
pin while that PR was in review, but it predates #94 (display
credential renewal) and #93 (the registry move), both in v0.2.5. Signage
now proves itself against the release it will run on.

The pin contract also accepts a release tag (refs/tags/vX.Y.Z) alongside
a pull request head or main, and the fetch compares the ref's commit
(^{commit}) so an annotated tag pins the same way a lightweight one
does. v0.2.5 is lightweight; that should not be a hidden requirement.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
2026-10-14 00:05:15 -05:00
co-authored by Claude Opus 5.5
parent ba4821ec63
commit c1213dad08
4 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+1 -1
View File
@@ -3,7 +3,7 @@ name: CI
# Signage is a standalone repository: every job installs it with --frozen-lockfile from its own # Signage is a standalone repository: every job installs it with --frozen-lockfile from its own
# pnpm-lock.yaml and takes Ekklesia's module-development packages (@ekklesia/*) from Ekklesia's # pnpm-lock.yaml and takes Ekklesia's module-development packages (@ekklesia/*) from Ekklesia's
# public package registry (.npmrc; platform ADRs 0053 and 0054). Only the integration job fetches # public package registry (.npmrc; platform ADRs 0053 and 0054). Only the integration job fetches
# Core source: one immutable commit through the pinned Gitea pull ref in ci/platform.env, used as the # Core source: one immutable commit through the pinned Gitea ref in ci/platform.env, used as the
# generic deployment harness and image source, never as a workspace dependency. # generic deployment harness and image source, never as a workspace dependency.
# #
# The same trust rules as the platform's own CI (docs/development/security.md there): # The same trust rules as the platform's own CI (docs/development/security.md there):
ci/check-cleanup.sh
+2 -2
View File
@@ -40,9 +40,9 @@ check '[[ -n "$own" && -n "$run" ]] && ((own > run)) && ((own > last_step))' \
check 'sed -n "${last_step},\$p" <<<"$job" | grep -q "if: always()"' "that last step always runs" check 'sed -n "${last_step},\$p" <<<"$job" | grep -q "if: always()"' "that last step always runs"
check 'grep -q "EKKLESIA_SMOKE_MODULE_RELEASE_DIR" "$root/ci/integration.sh" && grep -q "bash scripts/smoke-deploy.sh" "$root/ci/integration.sh"' \ check 'grep -q "EKKLESIA_SMOKE_MODULE_RELEASE_DIR" "$root/ci/integration.sh" && grep -q "bash scripts/smoke-deploy.sh" "$root/ci/integration.sh"' \
"the integration delegates its external package to the platform smoke" "the integration delegates its external package to the platform smoke"
check 'grep -Eq "^EKKLESIA_PLATFORM_REF=refs/(pull/[0-9]+/head|heads/main)$" "$root/ci/platform.env" && grep -Eq "^EKKLESIA_PLATFORM_COMMIT=[0-9a-f]{40}$" "$root/ci/platform.env"' \ check 'grep -Eq "^EKKLESIA_PLATFORM_REF=refs/(pull/[0-9]+/head|heads/main|tags/v[0-9]+\.[0-9]+\.[0-9]+)$" "$root/ci/platform.env" && grep -Eq "^EKKLESIA_PLATFORM_COMMIT=[0-9a-f]{40}$" "$root/ci/platform.env"' \
"the platform harness is pinned by full ref and commit" "the platform harness is pinned by full ref and commit"
check 'grep -q "rev-parse refs/remotes/pinned" "$root/ci/fetch-platform.sh" && grep -q "does not resolve to EKKLESIA_PLATFORM_COMMIT" "$root/ci/fetch-platform.sh"' \ check 'grep -qF "rev-parse \"refs/remotes/pinned^{commit}\"" "$root/ci/fetch-platform.sh" && grep -q "does not resolve to EKKLESIA_PLATFORM_COMMIT" "$root/ci/fetch-platform.sh"' \
"the fetch verifies that the pinned ref resolves to the pinned commit" "the fetch verifies that the pinned ref resolves to the pinned commit"
# Normal CI builds the canonical archive once and hands those exact bytes to integration through a # Normal CI builds the canonical archive once and hands those exact bytes to integration through a
ci/fetch-platform.sh
+1 -1
View File
@@ -32,7 +32,7 @@ git -C "$out" init --quiet
git -C "$out" remote add origin "$repository" git -C "$out" remote add origin "$repository"
git -C "$out" fetch --quiet --no-tags --depth=1 origin "+${ref}:refs/remotes/pinned" || git -C "$out" fetch --quiet --no-tags --depth=1 origin "+${ref}:refs/remotes/pinned" ||
fail "cannot fetch the pinned platform ref." fail "cannot fetch the pinned platform ref."
[[ "$(git -C "$out" rev-parse refs/remotes/pinned)" == "$commit" ]] || [[ "$(git -C "$out" rev-parse "refs/remotes/pinned^{commit}")" == "$commit" ]] ||
fail "the pinned ref does not resolve to EKKLESIA_PLATFORM_COMMIT." fail "the pinned ref does not resolve to EKKLESIA_PLATFORM_COMMIT."
git -C "$out" -c advice.detachedHead=false checkout --quiet --detach "$commit" git -C "$out" -c advice.detachedHead=false checkout --quiet --detach "$commit"
rm -rf "$out/.git" rm -rf "$out/.git"
ci/platform.env
+5 -4
View File
@@ -1,5 +1,6 @@
# The companion Core harness Signage uses to install and run its real external package. The pull ref # The companion Core harness Signage uses to install and run its real external package: a released
# remains reachable after its branch is deleted; the full commit pin makes the checkout immutable. # Core, by its tag. A pull request's ref (refs/pull/N/head) is used only while Signage depends on a
# Core change still in review. The full commit pin makes the checkout immutable either way.
EKKLESIA_PLATFORM_REPOSITORY=https://git.zayin.net/Zayin/Ekklesia.git EKKLESIA_PLATFORM_REPOSITORY=https://git.zayin.net/Zayin/Ekklesia.git
EKKLESIA_PLATFORM_REF=refs/pull/92/head EKKLESIA_PLATFORM_REF=refs/tags/v0.2.5
EKKLESIA_PLATFORM_COMMIT=5e9433d96b413117374a6132d89400867414c2c8 EKKLESIA_PLATFORM_COMMIT=437720f2286e962829f2ec8c1c6137ea24f87b9f