fix(workflows): update pinned SHA to commit with reusable/ directory #36
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| # on-main-bump-sha.yml — Auto-bump the YiAgent/OpenCI self-reference SHA after | ||
| # every merge to main. Opens a follow-up PR when the SHA needs updating so the | ||
| # manifest never drifts out of sync. | ||
| # | ||
| # Why: the pinned SHA must point to a commit that contains | ||
| # .github/workflows/reusable/. After structural reorganizations (or simply | ||
| # as main moves forward) the SHA can become stale. This workflow detects | ||
| # that condition and creates a one-commit PR to fix it automatically. | ||
| name: Auto-bump self SHA | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
||
| jobs: | ||
| bump: | ||
| name: Bump YiAgent/OpenCI SHA if stale | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 | ||
| with: { egress-policy: audit } | ||
|
|
||
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: true | ||
|
|
||
| - name: Install yq | ||
| run: | | ||
| sudo wget -qO /usr/local/bin/yq \ | ||
| https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 | ||
| sudo chmod +x /usr/local/bin/yq | ||
|
|
||
| - name: Check if SHA needs bumping | ||
| id: check | ||
| run: | | ||
| current_sha="$(yq -r '.deps["YiAgent/OpenCI"] // ""' manifest.yml)" | ||
| head_sha="$(git rev-parse HEAD)" | ||
|
|
||
| if [ -z "$current_sha" ]; then | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| echo "::notice::YiAgent/OpenCI not in manifest.yml — skipping" | ||
| exit 0 | ||
| fi | ||
|
|
||
| tree_out="$(git ls-tree "$current_sha" .github/workflows/reusable/ 2>/dev/null || true)" | ||
| if [ -n "$tree_out" ] && [ "$current_sha" = "$head_sha" ]; then | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
| echo "::notice::SHA $current_sha is current and valid — nothing to do" | ||
| exit 0 | ||
| fi | ||
|
|
||
| { | ||
| echo "skip=false" | ||
| echo "current_sha=$current_sha" | ||
| echo "new_sha=$head_sha" | ||
| } >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Run bump-self-sha.sh | ||
| if: steps.check.outputs.skip != 'true' | ||
| run: bash scripts/bump-self-sha.sh | ||
|
|
||
| - name: Commit and open PR | ||
| if: steps.check.outputs.skip != 'true' | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| NEW_SHA: ${{ steps.check.outputs.new_sha }} | ||
| OLD_SHA: ${{ steps.check.outputs.current_sha }} | ||
| run: | | ||
| branch="chore/bump-self-sha-${NEW_SHA:0:8}" | ||
| short_old="${OLD_SHA:0:8}" | ||
| short_new="${NEW_SHA:0:8}" | ||
|
|
||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
| git checkout -b "$branch" | ||
| git add manifest.yml .github/workflows/ | ||
| git commit -m "chore(manifest): bump YiAgent/OpenCI SHA to ${short_new}" \ | ||
| -m "Automated update from on-main-bump-sha workflow. old=${OLD_SHA} new=${NEW_SHA}" | ||
|
|
||
| git push origin "$branch" | ||
|
|
||
| # shellcheck disable=SC2016 | ||
| printf 'Automated SHA bump: `%s` to `%s`\n\nThe YiAgent/OpenCI self-reference SHA in manifest.yml was stale. Updated to the latest main HEAD so all reusable workflow calls resolve correctly.\n\n> Generated by the on-main-bump-sha workflow.' \ | ||
| "$short_old" "$short_new" > /tmp/pr-body.md | ||
|
|
||
| gh pr create \ | ||
| --title "chore(manifest): bump YiAgent/OpenCI SHA to ${short_new}" \ | ||
| --body-file /tmp/pr-body.md \ | ||
| --base main \ | ||
| --head "$branch" \ | ||
| --label "chore" 2>/dev/null || true |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 101
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 102
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 1296
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 1661
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 242
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 231
🏁 Script executed:
Repository: YiAgent/OpenCI
Length of output: 15767
Distinguish missing commit objects from missing directory structure in shallow clones.
Line 224 swallows
git ls-treeerrors with2>/dev/null || true, causing shallow clones to produce false "SHA Missing Structure" errors even when the path exists in the commit but the commit object itself is unavailable locally. Check commit-object availability first usinggit cat-file -e, emit a more specific error, and only then perform the path check.Suggested fix
for self_name in "${!SELF_REFS[@]}"; do self_required_path="${SELF_REFS[$self_name]}" self_sha="$(echo "$manifest_map" | awk -F'\t' -v key="$self_name" '$1 == key { print $2; exit }')" [ -z "$self_sha" ] && continue + if ! git cat-file -e "${self_sha}^{commit}" 2>/dev/null; then + emit_error "Missing Commit Object" \ + "manifest.yml: $self_name SHA $self_sha is not present in the local clone. Fetch more history (e.g., checkout with fetch-depth: 0) and rerun." + continue + fi + # git ls-tree returns non-empty output when the path exists at that SHA. tree_output="$(git ls-tree "$self_sha" "$self_required_path/" 2>/dev/null || true)" if [ -z "$tree_output" ]; then emit_error "SHA Missing Structure" \ "manifest.yml: $self_name SHA $self_sha has no '$self_required_path/' directory. Run scripts/bump-self-sha.sh to update to a valid commit." fi done📝 Committable suggestion
🤖 Prompt for AI Agents