From 304435992ca253964fd57d37739eba8cb7dd31e6 Mon Sep 17 00:00:00 2001 From: nicodes Date: Tue, 29 Sep 2026 06:32:36 -0600 Subject: [PATCH] engineering: one cicd revision, vendored and called alike This repository consumed nicodes/cicd twice and the two disagreed: the helpers under scripts/engineering came from one revision, and the reusable workflows called with @ came from another. Neither half is wrong on its own, which is why it went unnoticed -- "which revision of cicd is this product on" had no answer. Both now name nicodes/cicd v0.2.1, and pins.mjs refuses a product where they differ, so they can only move together from here. The workflow pins carry the version in a trailing comment. The pin is still the commit -- a tag can be deleted and recreated, and SOURCE.json records a commit so a tag there could not be compared with it at all -- and the comment is what makes the SHA legible in review. v0.2.1 is also the first cicd release with its own helper checkouts pinned consistently. Those reusable workflows check cicd out again for helpers/, and GitHub resolves only the caller's ref; until now a product that pinned backup.yml by SHA still ran helpers from whatever commit was written inside it, 24 to 34 commits behind, at two different revisions. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dependabot.yml | 2 +- scripts/engineering/SOURCE.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml index f2aa279..f6cf8ff 100644 --- a/.github/workflows/dependabot.yml +++ b/.github/workflows/dependabot.yml @@ -24,6 +24,6 @@ concurrency: jobs: auto-merge: - uses: nicodes/cicd/.github/workflows/dependabot.yml@fade862978fc1a2ba625d9486443aa0e6723f8bf + uses: nicodes/cicd/.github/workflows/dependabot.yml@fa8e3e772d386255665a2813b754365ef0f2aae3 # v0.2.1 with: dispatch-target: ci.yml diff --git a/scripts/engineering/SOURCE.json b/scripts/engineering/SOURCE.json index 5510614..b32de65 100644 --- a/scripts/engineering/SOURCE.json +++ b/scripts/engineering/SOURCE.json @@ -1,6 +1,6 @@ { "repository": "https://github.com/nicodes/cicd", - "revision": "fade862978fc1a2ba625d9486443aa0e6723f8bf", + "revision": "fa8e3e772d386255665a2813b754365ef0f2aae3", "files": { "helpers/dependency-policy.py": "3a602b3f46d0e2a6dfe38328ca5741eecce57c120830bb57c484fc1da0ba0265", "helpers/merge-checked.py": "b86a1e741697e3f0034da2d3b7decc9af06a0d9e0f23cbd2d001dc90bd4c530e"