Repository navigation
ci(pages): guard the dotfile law and take the upload-pages-artifact v5 bump with the opt-in - #86
Merged
Merged
Conversation
…e law tools/ci-selfcheck.py ran the action-pin law over ci.yml and scheduled.yml only, so pkgdown.yaml and release.yml carried pins nothing ever inspected. The one check that did look at pkgdown.yaml was length-only, which is how dependabot's upload-pages-artifact bump from v3 to v5 could swap the comment note without any assertion noticing. Widen the pair set to all four workflows, and add the missing substantive law: upload-pages-artifact v4.0.0 tars with an unconditional `--exclude=".[^/]*"`, and v5.0.0 keeps that exclude behind an `include-hidden-files` input whose declared default is "false". Either major therefore drops every root dotfile -- including the docs/.nojekyll that pkgdown.yaml writes for the Pages deploy -- so require the explicit opt-in whenever such a pin is present. The law carries its own firing control. tools/action_pins.py learns the `# vN.N[.N]` comment form, which the trunk already uses (`deploy-pages # v5.0.1`); without it, scanning pkgdown.yaml would have reddened the tree for a purely cosmetic note.
…ck in v4.0.0 tars the Pages artifact with an unconditional --exclude=.[^/]*, so every dotfile at the artifact root is dropped. v5.0.0 keeps that exclude behind `include-hidden-files`, whose declared default is "false" -- the drop is still the default. Either pin silently un-writes the `docs/.nojekyll` the build step above writes, which is what keeps Jekyll from re-rendering the tree, and nothing else in the pipeline would notice. Take the v5 bump together with the explicit opt-in so the dotfile survives, and keep the pin auditable at its major tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #83's hazard. Supersedes dependabot PR #83.
Why
actions/upload-pages-artifactv4.0.0 tars the Pages artifact with anunconditional
--exclude=".[^/]*", so every dotfile at the artifact root isdropped. v5.0.0 keeps that exclude behind the new
include-hidden-filesinput,whose declared default is
"false"— the drop is still the default there..github/workflows/pkgdown.yamlwritesdocs/.nojekyllin the build step, andthat file is what keeps Jekyll from re-rendering the published tree. Merging
#83 as-is would have silently un-written it, and nothing downstream would have
noticed: the upload/deploy checks were name-only and the pin check was
length-only.
Measured directly off each ref's
action.yml(?ref=raw fetch):include-hidden-files.git,.githubonly--exclude=".[^/]*"unconditionaldefault: "false"${{ inputs.include-hidden-files != 'true' && '--exclude=.[^/]*' || '' }}What
pkgdown.yamltoupload-pages-artifact@fc324d35… # v5.0.0togetherwith
with: include-hidden-files: true, so the dotfile survives.tools/action_pins.pyaccepts a patch-level note (# v5.0.1), which trunkalready carries on
deploy-pages; the note is an audit annotation only —immutability comes from the SHA.
tools/ci-selfcheck.pyruns the pin law over all four workflows, notjust the two the PR gate builds (
pkgdown.yamlandrelease.ymlcarriedpins nothing ever inspected).
upload-pages-artifactpin at major >= 4 inpkgdown.yamlmust set
include-hidden-files: true, with a firing control proving a v4+pin without the opt-in is refused.
/tmp-local checks:python3 tools/ci-selfcheck.pyexits 0,PASS (all CI wiring assertions hold).Test plan
pkgdownworkflow lands the site and.nojekyllis present in thedeployed artifact (the site must not fall back to Jekyll rendering).
CIthree-arm PR gate green.python3 tools/ci-selfcheck.pyexit 0 on the runner.