Skip to content

fix(ci): robust SHA sync in bump-self-sha + final fixes #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
YiWang24 merged 1 commit into from
May 26, 2026
Merged

fix(ci): robust SHA sync in bump-self-sha + final fixes #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/agent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ concurrency:

jobs:
agent:
uses: YiAgent/OpenCI/.github/workflows/reusable-agent.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-agent.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
task: ${{ inputs.task }}
prompt: ${{ inputs.prompt }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci-self-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ concurrency:

jobs:
self-test:
uses: YiAgent/OpenCI/.github/workflows/reusable-self-test.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-self-test.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
runner: ubuntu-latest
secrets: inherit
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
ci:
needs: guard
if: needs.guard.outputs.has-dockerfile == 'true'
uses: YiAgent/OpenCI/.github/workflows/reusable-ci.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-ci.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ github.sha }}
registry: ghcr.io
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependencies.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ concurrency:

jobs:
deps:
uses: YiAgent/OpenCI/.github/workflows/reusable-deps.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-deps.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
runner: blacksmith-2vcpu-ubuntu-2404
2 changes: 1 addition & 1 deletion .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ concurrency:

jobs:
docs:
uses: YiAgent/OpenCI/.github/workflows/reusable-docs.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-docs.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
build-cmd: ${{ vars.DOCS_BUILD_CMD || '' }}
docs-path: ${{ vars.DOCS_DIR || 'docs' }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/issue-ops.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ jobs:
&& !contains(github.actor, '[bot]'))
|| (github.event_name == 'issue_comment'
&& !contains(github.event.comment.user.login, '[bot]'))
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
mode: lifecycle
runner: blacksmith-2vcpu-ubuntu-2404
Expand All @@ -52,7 +52,7 @@ jobs:

maintenance:
if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance')
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
mode: maintenance
runner: blacksmith-2vcpu-ubuntu-2404
Expand All @@ -65,7 +65,7 @@ jobs:

manual:
if: github.event_name == 'workflow_dispatch' && inputs.mode != 'maintenance'
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
mode: ${{ inputs.mode }}
runner: blacksmith-2vcpu-ubuntu-2404
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/on-maintenance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ jobs:
if: |
!contains(fromJSON('["pr-review","flag-audit"]'),
needs.resolve-mode.outputs.mode)
uses: YiAgent/OpenCI/.github/workflows/reusable-maintenance.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-maintenance.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
mode: ${{ needs.resolve-mode.outputs.mode }}
openci-ref: ${{ needs.resolve-mode.outputs.openci-ref }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ concurrency:

jobs:
checks:
uses: YiAgent/OpenCI/.github/workflows/reusable-pr.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-pr.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
enable-ai-review: true
enable-eval: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ concurrency:

jobs:
release:
uses: YiAgent/OpenCI/.github/workflows/reusable-release.yml@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/.github/workflows/reusable-release.yml@119c3eab2c613bdcc1fbed9b97535f34955defba
secrets: inherit
with:
mode: ${{ inputs.mode || 'marketplace' }}
Expand Down
18 changes: 9 additions & 9 deletions .github/workflows/reusable-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Probe secrets
Expand All @@ -149,7 +149,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- id: detect
Expand All @@ -173,7 +173,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- id: build
Expand All @@ -199,7 +199,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- id: scan
Expand All @@ -218,7 +218,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
Expand Down Expand Up @@ -261,7 +261,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: ./.openci/actions/ci/check-migration
Expand All @@ -280,7 +280,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- uses: ./.openci/actions/ci/eval-smoke
Expand All @@ -303,7 +303,7 @@ jobs:
persist-credentials: false
fetch-depth: 0 # required so git ls-tree can resolve the self-ref SHA
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Install yq
Expand Down Expand Up @@ -467,7 +467,7 @@ jobs:
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
with: { persist-credentials: false }
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Download ci-context artifact
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/reusable-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ jobs:
with:
persist-credentials: false
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Probe secrets
Expand Down Expand Up @@ -128,7 +128,7 @@ jobs:
with:
persist-credentials: false
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Detect (or honour caller override)
Expand Down Expand Up @@ -414,7 +414,7 @@ jobs:
persist-credentials: false
fetch-depth: 0 # required so git ls-tree can resolve the self-ref SHA
- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: ${{ inputs.openci-ref }}
- name: Install yq
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/reusable-self-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ jobs:
with: { persist-credentials: false }

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: main

Expand Down Expand Up @@ -187,7 +187,7 @@ jobs:
with: { persist-credentials: false }

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: main

Expand All @@ -210,7 +210,7 @@ jobs:
fetch-depth: 0

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: main

Expand Down Expand Up @@ -255,7 +255,7 @@ jobs:
persist-credentials: false

- name: Resolve OpenCI ref and checkout
uses: YiAgent/OpenCI/actions/_common/resolve-openci@34a93579aac0d1682cc65ab8b7c2c9e2d06b0953
uses: YiAgent/OpenCI/actions/_common/resolve-openci@119c3eab2c613bdcc1fbed9b97535f34955defba
with:
openci-ref: main

Expand Down
2 changes: 1 addition & 1 deletion manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ deps:
softprops/action-gh-release: "b4309332981a82ec1c5618f44dd2e27cc8bfbfda" # v3.0.0

# ── Self (OpenCI vendoring itself via remote action reference) ──────────
YiAgent/OpenCI: "f6d93cbfd9e1a8aa63c45830f1f9f499168549e4" # resolve-openci bootstrap
YiAgent/OpenCI: "119c3eab2c613bdcc1fbed9b97535f34955defba" # resolve-openci bootstrap

# ─────────────────────────────────────────────────────────────────────────────
# Reusable workflow catalog (consumed via `uses: YiAgent/OpenCI/.github/workflows/<id>.yml@<ref>`)
Expand Down
15 changes: 11 additions & 4 deletions scripts/bump-self-sha.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,18 +98,25 @@
perl -pi -e "s|\Q${old_sha}\E|${new_sha}|g" "$MANIFEST"
info "Updated manifest.yml"

# ── 5. Update all workflow files that reference the old SHA ──────────────────
# ── 5. Update all YiAgent/OpenCI SHA references ──────────────────────────────
# Instead of searching only for the manifest.yml SHA (which can diverge from
# workflow files), replace ANY YiAgent/OpenCI@<40-char-hex> reference with
# the new SHA. This works even when workflow files have a different old SHA
# than manifest.yml (e.g., after a revert-workflow-files cycle).

updated=0
while IFS= read -r -d '' f; do
if grep -q "$old_sha" "$f" 2>/dev/null; then
perl -pi -e "s|\Q${old_sha}\E|${new_sha}|g" "$f"
# Compare checksums to detect if perl actually changed the file.
before=$(shasum -a 256 "$f" 2>/dev/null || true)
perl -pi -e "s|(YiAgent/OpenCI/[^\s@]+)\@[a-f0-9]{40}|\1\@${new_sha}|g" "$f"

@greptile-apps greptile-apps Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Deprecated Perl back-reference in replacement string

\1 in the replacement side of s/// is deprecated in Perl — it is documented as equivalent to $1 today, but perlop explicitly warns that the behaviour may change in future versions. The idiomatic form is $1, which carries no deprecation risk and makes the intent unambiguous to readers unfamiliar with the edge-case rule that \N in a replacement string is treated as a back-reference rather than an octal escape.

after=$(shasum -a 256 "$f" 2>/dev/null || true)
if [ "$before" != "$after" ]; then

Check failure on line 113 in scripts/bump-self-sha.sh

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use '[[' instead of '[' for conditional tests. The '[[' construct is safer and more feature-rich. 


See more on https://sonarcloud.io/project/issues?id=YiAgent_OpenCI&issues=AZ5iQovX05_yYf-q1O0z&open=AZ5iQovX05_yYf-q1O0z&pullRequest=171
info "Updated $f"
updated=$((updated + 1))
fi
done < <(find "$REPO_ROOT/.github/workflows" "$REPO_ROOT/actions" \
-name "*.yml" -o -name "*.yaml" 2>/dev/null | tr '\n' '\0')
Comment on lines 117 to 118

@greptile-apps greptile-apps Bot May 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 find -o without explicit -print0 and tr conversion

Two compounding robustness concerns: (1) find … -name "*.yml" -o -name "*.yaml" without an explicit action relies on implicit -print being appended to the whole expression — standard in GNU/BSD find but not guaranteed by POSIX; (2) piping through tr '\n' '\0' means any filename with an embedded newline would be split incorrectly. Using \( -name "*.yml" -o -name "*.yaml" \) -print0 eliminates both concerns.

Suggested change
done < <(find "$REPO_ROOT/.github/workflows" "$REPO_ROOT/actions" \
-name "*.yml" -o -name "*.yaml" 2>/dev/null | tr '\n' '\0')
perl -pi -e 's|(YiAgent/OpenCI/[^\s@]+)\@[a-f0-9]{40}|$1\@'"${new_sha}"'|g' "$f"
after=$(shasum -a 256 "$f" 2>/dev/null || true)
if [ "$before" != "$after" ]; then
info "Updated $f"
updated=$((updated + 1))
fi
done < <(find "$REPO_ROOT/.github/workflows" "$REPO_ROOT/actions" \
\( -name "*.yml" -o -name "*.yaml" \) -print0 2>/dev/null)


echo ""
echo "Done. Updated manifest.yml + $updated workflow file(s) to $new_sha"
echo "Done. Updated manifest.yml + $updated workflow/action file(s) to $new_sha"
echo "Stage and commit: git add manifest.yml .github/workflows actions/ && git commit -m 'chore(manifest): bump YiAgent/OpenCI SHA to $new_sha'"
Loading