mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-13 11:57:19 +01:00
garrytanandcapy-ai[bot]
65ca746bda
Review found three spellings that got past the regex guard and still hung --to docx: a data-src decoy, a percent-encoded separator, and an unquoted encoded colon. html-to-docx sizes images on three paths, and buildImage URI-decodes the whole src first. The guard now mirrors all three, drops ICNS (the only input its bundled image-size routes to the looping parser) instead of allowlisting formats, so BMP and TIFF embed as before, and re-parses the result with html-to-docx's own html-to-vdom to fail closed on anything the regex misreads. The golden test tolerates CRLF checkouts on Windows. Version Gate treats a failed file lookup as an empty list, so a partial paginated result cannot decide the exemption. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
83 lines
2.9 KiB
YAML
83 lines
2.9 KiB
YAML
name: Version Gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'VERSION'
|
|
- 'CHANGELOG.md'
|
|
- 'package.json'
|
|
|
|
concurrency:
|
|
group: version-gate-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
check:
|
|
name: Check VERSION is not stale vs queue
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
steps:
|
|
- name: Checkout PR head
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
fetch-depth: 0
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
|
|
- name: Setup Bun
|
|
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
with:
|
|
bun-version: 1.4.2
|
|
|
|
- name: Read versions
|
|
id: versions
|
|
run: |
|
|
set -euo pipefail
|
|
PR_VERSION=$(cat VERSION | tr -d '[:space:]')
|
|
BASE_REF="${{ github.event.pull_request.base.ref }}"
|
|
git fetch origin "$BASE_REF" --depth=1 --quiet || true
|
|
BASE_VERSION=$(git show "origin/$BASE_REF:VERSION" 2>/dev/null | tr -d '[:space:]' || echo "0.0.0.0")
|
|
{
|
|
echo "pr_version=$PR_VERSION"
|
|
echo "base_version=$BASE_VERSION"
|
|
echo "base_ref=$BASE_REF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Detect bump level
|
|
id: bump
|
|
run: |
|
|
LEVEL=$(bun run scripts/detect-bump.ts "${{ steps.versions.outputs.base_version }}" "${{ steps.versions.outputs.pr_version }}")
|
|
echo "level=$LEVEL" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Query queue (util) — fail-open on error
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set +e
|
|
bun run bin/gstack-next-version \
|
|
--base "${{ steps.versions.outputs.base_ref }}" \
|
|
--bump "${{ steps.bump.outputs.level }}" \
|
|
--current-version "${{ steps.versions.outputs.base_version }}" \
|
|
--workspace-root null \
|
|
--exclude-pr "${{ github.event.pull_request.number }}" \
|
|
> next.json 2> next.err
|
|
RC=$?
|
|
if [ "$RC" != "0" ] || [ ! -s next.json ]; then
|
|
echo '{"offline":true}' > next.json
|
|
echo "::warning::util exit=$RC — failing open. stderr:"
|
|
cat next.err || true
|
|
fi
|
|
|
|
- name: Compare PR VERSION to next free slot
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PR_VERSION: ${{ steps.versions.outputs.pr_version }}
|
|
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
|
|
run: |
|
|
if ! PR_CHANGED_FILES=$(gh api --paginate "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --jq '.[].filename'); then PR_CHANGED_FILES=""; fi
|
|
export PR_CHANGED_FILES
|
|
bun run scripts/compare-pr-version.ts next.json "${{ github.event.pull_request.number }}"
|