Per-artifact commit-derived versions: pinnable date tags, and no rebuild when nothing changed #238
@@ -103,6 +103,27 @@ jobs:
|
|||||||
# cache hit and holds AMO to one call per extension CHANGE. Only moving
|
# cache hit and holds AMO to one call per extension CHANGE. Only moving
|
||||||
# backwards is a failure, so this runs on every path — cache hit
|
# backwards is a failure, so this runs on every path — cache hit
|
||||||
# included — rather than only before a sign.
|
# included — rather than only before a sign.
|
||||||
|
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||||
|
# Informational ONLY. Nothing reads this and it must never fail the
|
||||||
|
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||||
|
#
|
||||||
|
# What to watch across pushes, because this is what step 3 will trust:
|
||||||
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||||
|
# STILL. If web moves, its path set is too wide.
|
||||||
|
# * a push touching only docs moves nothing.
|
||||||
|
# * a push touching the extension moves the extension AND web, since
|
||||||
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||||
|
# — the direction that serves stale bytes on a pin.
|
||||||
|
# * dev and main derive the same values for the same source.
|
||||||
|
- name: Shadow — derived artifact version (informational)
|
||||||
|
run: |
|
||||||
|
set -u
|
||||||
|
A=extension
|
||||||
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||||
|
|
||||||
- name: Guard — the derived version must never go backwards
|
- name: Guard — the derived version must never go backwards
|
||||||
env:
|
env:
|
||||||
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
||||||
@@ -320,6 +341,27 @@ jobs:
|
|||||||
# that exists perfectly well under its real name.
|
# that exists perfectly well under its real name.
|
||||||
fetch-depth: 0
|
fetch-depth: 0
|
||||||
|
|
||||||
|
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||||
|
# Informational ONLY. Nothing reads this and it must never fail the
|
||||||
|
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||||
|
#
|
||||||
|
# What to watch across pushes, because this is what step 3 will trust:
|
||||||
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||||
|
# STILL. If web moves, its path set is too wide.
|
||||||
|
# * a push touching only docs moves nothing.
|
||||||
|
# * a push touching the extension moves the extension AND web, since
|
||||||
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||||
|
# — the direction that serves stale bytes on a pin.
|
||||||
|
# * dev and main derive the same values for the same source.
|
||||||
|
- name: Shadow — derived artifact version (informational)
|
||||||
|
run: |
|
||||||
|
set -u
|
||||||
|
A=web
|
||||||
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||||
|
|
||||||
- name: Download signed XPI from Forgejo release asset
|
- name: Download signed XPI from Forgejo release asset
|
||||||
# Fires on every trigger shape. dev and main each bundle the XPI their
|
# Fires on every trigger shape. dev and main each bundle the XPI their
|
||||||
# own sign-extension just published — that is the whole point of the
|
# own sign-extension just published — that is the whole point of the
|
||||||
@@ -486,6 +528,34 @@ jobs:
|
|||||||
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
# Full history: this job derives its artifact's version from the
|
||||||
|
# commit its shipped files last changed in (milestone 313). A
|
||||||
|
# depth-1 clone cannot see that commit — it either derives a wrong,
|
||||||
|
# too-low value or finds nothing at all, and neither is a failure
|
||||||
|
# the build would otherwise notice.
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||||
|
# Informational ONLY. Nothing reads this and it must never fail the
|
||||||
|
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||||
|
#
|
||||||
|
# What to watch across pushes, because this is what step 3 will trust:
|
||||||
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||||
|
# STILL. If web moves, its path set is too wide.
|
||||||
|
# * a push touching only docs moves nothing.
|
||||||
|
# * a push touching the extension moves the extension AND web, since
|
||||||
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||||
|
# — the direction that serves stale bytes on a pin.
|
||||||
|
# * dev and main derive the same values for the same source.
|
||||||
|
- name: Shadow — derived artifact version (informational)
|
||||||
|
run: |
|
||||||
|
set -u
|
||||||
|
A=ml
|
||||||
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||||
|
|
||||||
- name: Determine tag
|
- name: Determine tag
|
||||||
id: tag
|
id: tag
|
||||||
@@ -533,6 +603,34 @@ jobs:
|
|||||||
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
image: git.fabledsword.com/bvandeusen/ci-python:3.14
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
# Full history: this job derives its artifact's version from the
|
||||||
|
# commit its shipped files last changed in (milestone 313). A
|
||||||
|
# depth-1 clone cannot see that commit — it either derives a wrong,
|
||||||
|
# too-low value or finds nothing at all, and neither is a failure
|
||||||
|
# the build would otherwise notice.
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
# --- shadow mode (milestone 313, step 2) -----------------------------
|
||||||
|
# Informational ONLY. Nothing reads this and it must never fail the
|
||||||
|
# build — no `set -e`, and every derivation falls back to UNAVAILABLE.
|
||||||
|
#
|
||||||
|
# What to watch across pushes, because this is what step 3 will trust:
|
||||||
|
# * a push touching only agent/ moves the agent and leaves web and ml
|
||||||
|
# STILL. If web moves, its path set is too wide.
|
||||||
|
# * a push touching only docs moves nothing.
|
||||||
|
# * a push touching the extension moves the extension AND web, since
|
||||||
|
# web bakes in the XPI. If web does not move, its set is too narrow
|
||||||
|
# — the direction that serves stale bytes on a pin.
|
||||||
|
# * dev and main derive the same values for the same source.
|
||||||
|
- name: Shadow — derived artifact version (informational)
|
||||||
|
run: |
|
||||||
|
set -u
|
||||||
|
A=agent
|
||||||
|
T=$(sh scripts/artifacts.sh tag "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
V=$(sh scripts/artifacts.sh version "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
R=$(sh scripts/artifacts.sh revision "$A" 2>&1 || echo UNAVAILABLE)
|
||||||
|
echo "shadow: artifact=$A tag=$T version=$V revision=$R sha=$GITHUB_SHA"
|
||||||
|
|
||||||
- name: Determine tag
|
- name: Determine tag
|
||||||
id: tag
|
id: tag
|
||||||
|
|||||||
Reference in New Issue
Block a user