mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-16 09:55:29 +02:00
Garry TanandClaude Fable 5
d7e61e0890
- Token/exec separation restored: slices-report (runs PR-authored code: bun install + the reconcile runner) drops to contents:read; the PR comment moves to a NEW slices-comment job holding the write token with ZERO repo code — no checkout, no bun, only downloaded artifacts + jq/gh. $GITHUB_ENV/BASH_ENV persistence is job-scoped, so the split is the boundary. The matrix-era report job had this property; the consolidation had regressed it. Pinned by the wiring test. - Reconcile exit captured via PIPESTATUS[0] in BOTH lanes: GitHub's default run-step shell has no pipefail, so `$?` after `| tee` was tee's exit — the fail-closed gate was silently fail-open. Wiring test pins it. - PR comment: final-attempt accounting restored the dropped COST accumulation (the dial read $0 forever), flaky passes render as the warning they are (never as failures), and a malformed tests[] artifact skips that file instead of aborting the whole comment under bash -e. - Remaining mutable action tags pinned (free-tests upload-artifact, ci-image checkout/docker trio — the image publisher holds packages:write and feeds the secret-bearing lanes). restore-deps fallback installs --frozen-lockfile; register-gstack-skills validates skill names before its rm -rf. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
28 lines
1.4 KiB
YAML
28 lines
1.4 KiB
YAML
name: Restore deps
|
|
description: >
|
|
Restore the CI image's pre-installed node_modules via recursive copy, or
|
|
fall back to bun install when the lockfile changed. Symlinking breaks bun's
|
|
realpath-based module resolution (realpath escapes the workspace and
|
|
sibling deps stop resolving); hardlink copy fails across overlay-fs layers
|
|
("Invalid cross-device link"). Recursive copy costs ~5s for ~200 packages —
|
|
still far cheaper than a network install. Extracted from five byte-similar
|
|
copies across the eval lanes.
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- shell: bash
|
|
run: |
|
|
if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.bun.lock bun.lock >/dev/null 2>&1; then
|
|
# rm first: `cp -r SRC node_modules` with an existing node_modules
|
|
# NESTS the copy (node_modules/node_modules_cache) and leaves stale
|
|
# deps active. CI workspaces are fresh today, but a reusable
|
|
# composite must survive a rerun/dirty workspace (codex diff review).
|
|
rm -rf node_modules
|
|
cp -r /opt/node_modules_cache node_modules
|
|
else
|
|
# Frozen: this composite is canonical for lanes that run PR code
|
|
# with provider keys in env — a drifted lockfile must fail loudly,
|
|
# never silently re-resolve versions (claude adversarial).
|
|
bun install --frozen-lockfile
|
|
fi
|