Repository navigation
ci: validate Plugin Hub snapshots via a scratch ref before pushing hub/publish - #113
Merged
Merged
Conversation
The official packager clones the plugin repository from GitHub and checks out the pinned SHA, but the workflow validated the new snapshot commit before pushing it, so the packager always failed with "upload-pack: not our ref". The pipeline had never exercised this path: earlier snapshots were pushed by local script runs, and the automatic runs all found nothing to publish. Push the snapshot to the temporary hub/validate ref first so the packager fetches the exact commit from GitHub exactly as the real Hub build will, and only fast-forward hub/publish after validation passes. The scratch ref is deleted afterwards (also on failure), and the job summary no longer prints pin instructions when validation failed - previously it recommended pinning a commit that was never pushed.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 46 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
The Publish workflow validates a new snapshot commit with the official packager before pushing
hub/publish— but the packager clones the repo from GitHub and checks out that SHA, so validation can never pass for an unpushed commit (upload-pack: not our ref). First exercised by #112's run (log); earlier snapshots were pushed by local script runs, so the path was never hit.Fix: push the snapshot to the scratch
hub/validateref first, validate (packager now fetches the exact commit from GitHub, exactly like the real Hub build), then fast-forwardhub/publishand delete the scratch ref.Testing
Evidence for the bug: run
39265002435failed at the packager step withfatal: remote error: upload-pack: not our ref 7af049c…;hub/publishwas correctly left untouched (push step is ordered after validation).python -c "import yaml; yaml.safe_load(...)"on the edited workflow:YAML OK.Failure-path behavior: summary now reports "Validation failed … Do not pin" instead of printing pin instructions for an unpushed commit.
No Java changes;
./gradlew clean buildunaffected (CI runs it).The merge of this PR itself triggers the fixed pipeline on a real README-bearing snapshot — that run is the end-to-end test (watched; summary will report the commit to pin).
./gradlew clean buildgreenRisk
High tier (CI/publish workflow), contained: on validation failure
hub/publishremains untouched and only the scratchhub/validateref is created/deleted (hub/*is unprotected; concurrency group serializes runs). Fast-forward-only push ofhub/publishis preserved.How to revert
Revert this commit on
master; the workflow returns to the previous order (validate-then-push, which fails for fresh snapshots until #112-era behavior is re-triggered). Nohub/publishhistory is ever rewritten.In-game verification
None — no in-game behavior.
Generated-by: GLM-5.3 (OpenCode)