fix(ci): require shasum match on release PR - #233
Conversation
stanleyyconsensys
changed the title
stanleyyconsensys
changed the title
| required: true | ||
|
|
||
| outputs: | ||
| IS_RELEASE_PR: |
There was a problem hiding this comment.
we need this to tell the main flow if it is release PR
| # manifests so require-clean-release-pr can run a strict dirty check. | ||
| path: | | ||
| packages/*/dist | ||
| packages/*/snap.manifest.json |
There was a problem hiding this comment.
we need manifest to tell if it is a dirty or not
| name: package-dist-${{ github.sha }} | ||
| path: packages | ||
| - name: Require clean working directory | ||
| if: needs.check-release.outputs.IS_RELEASE_PR == 'true' |
There was a problem hiding this comment.
we add needs.check-release.outputs.IS_RELEASE_PR == 'true' every step
becoz we dont wanna the whole step skip, and making the usual feature PR fail
| messages[`error.${error.code}`]?.message ?? | ||
| messages['error.internal']?.message ?? | ||
| 'Internal error'; | ||
| 'Internal error in Snap'; |
There was a problem hiding this comment.
dummy change to make the shasum dirty
stanleyyconsensys
changed the title
There was a problem hiding this comment.
Pull request overview
This PR updates the CI workflows to enforce that snap.manifest.json (including its shasum) matches the built output for release PRs, by restoring build artifacts and running a strict “clean working directory” check only when a PR is detected as a release.
Changes:
- Expose a
IS_RELEASE_PRoutput from thecheck-releasejob/action for downstream gating. - Add a
require-correct-shasumjob that restores build artifacts and fails if the working tree is dirty on release PRs (including shasum drift). - Include
packages/*/snap.manifest.jsonin uploaded build artifacts and make the clean-workdir check configurable viaskip-shasum-diff.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/main.yml |
Adds check-release output plumbing and a new job to enforce strict manifest/shasum cleanliness for release PRs. |
.github/workflows/lint-build-test.yml |
Uploads built snap.manifest.json files alongside dist/ so downstream jobs can verify post-build drift. |
.github/actions/require-clean-working-directory/action.yml |
Adds an input to toggle whether shasum-only drift is ignored vs strictly enforced. |
.github/actions/check-release/action.yml |
Exposes the “is release” determination as a composite-action output for workflow-level consumption. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - name: Checkout repository | ||
| uses: actions/checkout@v7 | ||
| - name: Check release | ||
| id: check-release | ||
| if: github.event_name != 'push' | ||
| uses: ./.github/actions/check-release | ||
| with: | ||
| commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }} |
There was a problem hiding this comment.
it is out of scope for this PR, as the PR didnt touch it
ulissesferreira
changed the title
Explanation
This PR updates the CI workflows to enforce that snap.manifest.json (including its shasum) matches the built output for release PRs, by restoring build artifacts and running a strict “clean working directory” check only when a PR is detected as a release.
Changes:
Expose a IS_RELEASE_PR output from the check-release job/action for downstream gating.
Add a require-correct-shasum job that restores build artifacts and fails if the working tree is dirty on release PRs (including shasum drift).
Include packages/*/snap.manifest.json in uploaded build artifacts and make the clean-workdir check configurable via skip-shasum-diff.
References
Checklist