Skip to content

fix: make latest-deps gate lockless-safe and exact-head - #13

Merged
ORESoftware merged 4 commits into
mainfrom
automation/zed-latest-deps-gate-20260912
Sep 16, 2026
Merged

ORESoftware merged 4 commits into
mainfrom
automation/zed-latest-deps-gate-20260912

Conversation

@ORESoftware

Copy link
Copy Markdown
Contributor

Follow-up to merged #12. The original gate assumed every package repository committed .zpkg.lock and checked out GitHub's synthetic PR merge ref.

This bounded follow-up changes only the gate hook/workflow:

  • allow lockless package-author repositories to run zed install, validate the generated ephemeral lock, frozen-replay it, compile, pack, then remove the ephemeral lock;
  • keep tracked locks strict and fail on drift from the newest versions allowed by .zpkg.toml;
  • check out ${{ github.event.pull_request.head.sha || github.sha }} explicitly and verify HEAD before running the gate;
  • retain pinned checkout, pinned Zed v0.3.0 checksum verification, disabled persisted credentials, compile/build/pack coverage.

No package/runtime source changes. Keep draft until exact-head CI and zed-latest-deps are terminal green.

@ORESoftware
ORESoftware marked this pull request as ready for review September 16, 2026 04:52
@ORESoftware
ORESoftware merged commit d06459f into main Sep 16, 2026
4 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant