Repository navigation
feat(release): configure native component releases - #2071
Conversation
|
Operator acceptance correction: no temporary compatibility bridges or copied publisher/authentication mechanics belong in this change. The consumer remains blocked until all required native Homeboy and reusable-action primitives are implemented and verified. Current downstream editing was paused after inspection found duplicated SSH setup around the native subtree command. The owning action is being completed so branch publication executes within its managed credential/liveness/result/cleanup lifecycle. The final consumer must contain only declarative configuration and thin supported invocations, with real clean-runner quality-gate verification. No merge/release/activation is authorized by this draft. AI assistance: GPT-6 Astra via OpenCode applied the operator correction and coordinated GPT-5.6 Luna direct upstream implementation. |
- Remove dispatch-repo/dispatch-event/DISPATCH_TOKEN from release.yml. Blocks Engine no longer notifies Static Site Importer; consumers resolve published coordinates themselves (homeboy release resolve, the mirror repo, or the npm registry). - Re-pin action-ref/extension-ref from unreleased candidate commits to released tags: homeboy-action v2.19.0 and homeboy-extensions wordpress-v3.48.6, both verified by cloning and checking tag ancestry/content directly. - Fix the php/figma job if: conditions (was invalid YAML in a prior uncommitted edit) so a sibling job's failure never blocks or skips the others. - Map PHP_TRANSFORMER_MIRROR_DEPLOY_KEY to the reusable workflow's PUBLISH_SSH_KEY secret explicitly for the php job instead of secrets: inherit (the names do not match). - Revert php-transformer-dev-trunk.yml's shell-based mirror to the working baseline; homeboy-action's native git-operation routing needed for the single-invocation replacement released in v2.19.0, but the Homeboy CLI's git subtree/release.subtree feature (Extra-Chill/homeboy#14851) has not shipped in a released Homeboy tag yet (confirmed by downloading v0.382.0 and running `homeboy git subtree --help`). Document the exact target invocation and the precise remaining blocker in the workflow header instead of reintroducing a hand-rolled subtree shell with manual SSH handling. - Document all of the above in docs/release-components.md, including why php-transformer's release.subtree config is currently inert. Verification: - actionlint on both changed workflow files: clean. - ruby -ryaml load of both changed workflow files: clean. - Bare-cloned Extra-Chill/homeboy, homeboy-action, and homeboy-extensions to verify tag ancestry/content for every pinned SHA instead of trusting tag names. - Downloaded the actual released homeboy v0.382.0 binary and ran `homeboy release <component> --dry-run` for all three components; each parses its homeboy.json correctly and fails only on the expected non-trunk-branch preflight guard.
… pins Re-pin release.yml and its own extension-ref/action-ref inputs from candidate SHAs to their now-released tags: homeboy-action v2.19.1 (contains the previously pinned v2.19.0 commit plus two released fixes) and, per job, the homeboy-extensions tag for the extension that job actually declares (nodejs-v3.7.4 for the JS job, wordpress-v3.48.6 for php/figma) instead of reusing one wordpress-namespaced SHA across all three jobs regardless of which extension each needs. Verified homeboy v0.383.0's released `git subtree` behaviorally against a disposable bare-repository fixture: preview mutates nothing, --apply publishes a tree byte-identical to the source subtree, a re-run is idempotent, --branch-only excludes tag publication, fast_forward branch_policy refuses to force-push over divergent history, and sibling components are never cross-published. That same verification also found a reproducible bug: v0.383.0's git subtree exits non-zero via an internal JSON serialization error on every run that actually succeeds (confirmed by inspecting the destination ref directly; a genuinely broken remote instead produces a normal, correctly serialized failure). Since homeboy-action's run-operations.sh maps any nonzero homeboy exit code straight to a failed step, swapping php-transformer-dev-trunk.yml to the native single-invocation replacement today would turn a working, correctly-reporting bridge into one that silently still publishes correctly but reports every run as failed CI. Keep the existing shell-based split-ref.sh bridge until a released Homeboy tag fixes git subtree's success-path result serialization; document the exact blocker and evidence in both the workflow header and docs/release-components.md.
8b9aa54 to
1dd990d
Compare
|
Rebased onto current trunk ( The remaining red check, Every other check on this branch passes. AI disclosure: rebase, verification, and this comment by Claude (claude-sonnet-4-6) via Claude Code on Chris Huber's behalf. |
Summary
Extra-Chill/homeboy-action@v2.19.1invocation.0.383.4, with action-managed SSH credentials and pinned GitHub host verification.split-ref.sh; convert the retained historical disaster-recovery backfill to native Homeboy subtree commands.Verification
git ls-remote --tagsverified released peeled commits: actionv2.19.1->d9c6d0ee1560612f55645b4b94d0f45ae7dba9b3,wordpress-v3.48.6->7f28a979517a96e003d0510d64bc5139c259837d,nodejs-v3.7.4->c9a119745e5d961dccb0206e1231faa01c62f0ae.v0.383.4release checksum verified; binary reportedhomeboy 0.383.4+3baca4731a0a2ecf603cfdba29c674d3c98a05fd.--applyexited 0; rerun reportedalready-identical; source and mirror trees matched;--branch-onlycreated no tag; normal mode createdv0.1.0; sibling mirror remained untouched.actionlint .github/workflows/release.yml .github/workflows/php-transformer-dev-trunk.ymlpassed.bash -n php-transformer/tools/packagist-split/backfill.sh,shellcheck php-transformer/tools/packagist-split/backfill.sh, andgit diff --checkpassed.Remaining blocker
Npm publishing remains an upstream activation gap tracked in
Extra-Chill/homeboy-action#492. The referenced released credential contract report was unavailable, so no publish step was fabricated. Keep this PR draft until that contract is released and the repository-level npm credential or trusted-publishing configuration is provisioned.No merge, release, tag, live publication, or secret change was performed.
Finalization occurred outside Homeboy under operator authorization.
AI disclosure: GPT-5.6 Luna via OpenCode implemented and verified this change; GPT-6 Astra via OpenCode orchestrated the session.