Per-artifact commit-derived versions: pinnable date tags, and no rebuild when nothing changed #238
@@ -103,6 +103,27 @@ jobs:
|
||||
# cache hit and holds AMO to one call per extension CHANGE. Only moving
|
||||
# backwards is a failure, so this runs on every path — cache hit
|
||||
# included — rather than only before a sign.
|
||||
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||
# Informational ONLY. Nothing reads this and it must never fail the
|
||||
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||
#
|
||||
# What to watch across pushes, because this is what step 3 will trust:
|
||||
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||
# STILL. If web moves, its path set is too wide.
|
||||
# * a push touching only docs moves nothing.
|
||||
# * a push touching the extension moves the extension AND web, since
|
||||
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||
# — the direction that serves stale bytes on a pin.
|
||||
# * dev and main derive the same values for the same source.
|
||||
- name: Shadow — derived artifact version (informational)
|
||||
run: |
|
||||
set -u
|
||||
A=extension
|
||||
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||
|
||||
- name: Guard — the derived version must never go backwards
|
||||
env:
|
||||
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||||
@@ -320,6 +341,27 @@ jobs:
|
||||
# that exists perfectly well under its real name.
|
||||
fetch-depth: 0
|
||||
|
||||
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||
# Informational ONLY. Nothing reads this and it must never fail the
|
||||
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||
#
|
||||
# What to watch across pushes, because this is what step 3 will trust:
|
||||
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||
# STILL. If web moves, its path set is too wide.
|
||||
# * a push touching only docs moves nothing.
|
||||
# * a push touching the extension moves the extension AND web, since
|
||||
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||
# — the direction that serves stale bytes on a pin.
|
||||
# * dev and main derive the same values for the same source.
|
||||
- name: Shadow — derived artifact version (informational)
|
||||
run: |
|
||||
set -u
|
||||
A=web
|
||||
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||
|
||||
- name: Download signed XPI from Forgejo release asset
|
||||
# Fires on every trigger shape. dev and main each bundle the XPI their
|
||||
# own sign-extension just published — that is the whole point of the
|
||||
@@ -486,6 +528,34 @@ jobs:
|
||||
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
# Full history: this job derives its artifact's version from the
|
||||
# commit its shipped files last changed in (milestone 313). A
|
||||
# depth-1 clone cannot see that commit — it either derives a wrong,
|
||||
# too-low value or finds nothing at all, and neither is a failure
|
||||
# the build would otherwise notice.
|
||||
fetch-depth: 0
|
||||
|
||||
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||
# Informational ONLY. Nothing reads this and it must never fail the
|
||||
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||
#
|
||||
# What to watch across pushes, because this is what step 3 will trust:
|
||||
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||
# STILL. If web moves, its path set is too wide.
|
||||
# * a push touching only docs moves nothing.
|
||||
# * a push touching the extension moves the extension AND web, since
|
||||
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||
# — the direction that serves stale bytes on a pin.
|
||||
# * dev and main derive the same values for the same source.
|
||||
- name: Shadow — derived artifact version (informational)
|
||||
run: |
|
||||
set -u
|
||||
A=ml
|
||||
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||
|
||||
- name: Determine tag
|
||||
id: tag
|
||||
@@ -533,6 +603,34 @@ jobs:
|
||||
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
# Full history: this job derives its artifact's version from the
|
||||
# commit its shipped files last changed in (milestone 313). A
|
||||
# depth-1 clone cannot see that commit — it either derives a wrong,
|
||||
# too-low value or finds nothing at all, and neither is a failure
|
||||
# the build would otherwise notice.
|
||||
fetch-depth: 0
|
||||
|
||||
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||
# Informational ONLY. Nothing reads this and it must never fail the
|
||||
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||
#
|
||||
# What to watch across pushes, because this is what step 3 will trust:
|
||||
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||
# STILL. If web moves, its path set is too wide.
|
||||
# * a push touching only docs moves nothing.
|
||||
# * a push touching the extension moves the extension AND web, since
|
||||
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||
# — the direction that serves stale bytes on a pin.
|
||||
# * dev and main derive the same values for the same source.
|
||||
- name: Shadow — derived artifact version (informational)
|
||||
run: |
|
||||
set -u
|
||||
A=agent
|
||||
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||
|
||||
- name: Determine tag
|
||||
id: tag
|
||||
|
||||
Reference in New Issue
Block a user