| … | … | @@ -25,6 +25,46 @@ steps: |
| 25 | 25 | # into /tmp, so npm leaves a broken symlink and the published tree lacks hyper-svc (the |
| 26 | 26 | # daemon then crashes importing it in control.js). It is self-contained (own node_modules), |
| 27 | 27 | # so vendor a dereferenced copy into the closure. Same shape as hypernote's copy-deps. |
| 28 | - name: verify vendored siblings are in hosted git history |
| 29 | run: | |
| 30 | # A vendored sibling is copied from the WORKING TREE, so whatever is checked out on the build |
| 31 | # machine is what ships to the fleet — reviewed or not. On 2026-07-28 that meant atproto-room |
| 32 | # shipped 27 commits (incl. 0.2.14 projection-drift and 0.2.16 _isCreator) that were only on a |
| 33 | # feature branch, and hyper-svc shipped 2 unpushed commits. Nothing surfaced it. |
| 34 | # |
| 35 | # This makes git AUTHORITATIVE for what ships: refuse to build unless every sibling's HEAD is |
| 36 | # reachable from some hosted branch. Reachability, NOT equality with the default branch — |
| 37 | # atproto-room legitimately ships from statebase-fork-heal, and a default-branch check would |
| 38 | # block a repo that is perfectly fine. |
| 39 | # |
| 40 | # Untracked files WARN rather than block: cp -rL ships them too, but they are usually probe |
| 41 | # scripts, and blocking on them would make the build unusable. Escape hatch for an emergency: |
| 42 | # PGV3_ALLOW_UNPUSHED_SIBLINGS=1. |
| 43 | rc=0 |
| 44 | for pkg in hyper-svc atproto-repo atproto-identity atproto-store atproto-did-peer; do |
| 45 | SRC=/storage/projects/code/hypercore-kb/hyper-fleeky/$pkg |
| 46 | [ -d "$SRC" ] || SRC="$HOME/hyper-fleeky/$pkg" |
| 47 | [ -d "$SRC/.git" ] || { echo " $pkg: not a git checkout — skipped"; continue; } |
| 48 | GD="$HOME/git-repos/$pkg.git" |
| 49 | if [ ! -d "$GD" ]; then echo " $pkg: NOT HOSTED ($GD) — refuse"; rc=1; continue; fi |
| 50 | LOCAL=$(git -C "$SRC" rev-parse HEAD 2>/dev/null) |
| 51 | SHORT=$(echo "$LOCAL" | cut -c1-7) |
| 52 | if [ -n "$(git -C "$SRC" status --porcelain --untracked-files=no 2>/dev/null | head -1)" ]; then |
| 53 | echo " $pkg: MODIFIED tracked files — refuse (commit or stash)"; rc=1; continue |
| 54 | fi |
| 55 | REFS=$(git --git-dir="$GD" for-each-ref --contains "$LOCAL" --format='%(refname:short)' refs/heads 2>/dev/null | tr '\n' ' ') |
| 56 | if [ -z "$REFS" ]; then echo " $pkg: $SHORT NOT in hosted history — refuse (push it)"; rc=1; continue; fi |
| 57 | U=$(git -C "$SRC" ls-files --others --exclude-standard 2>/dev/null | wc -l) |
| 58 | if [ "$U" -gt 0 ]; then echo " $pkg: $SHORT ok (on: $REFS) — WARN: $U untracked file(s) also vendored" |
| 59 | else echo " $pkg: $SHORT ok (on: $REFS)"; fi |
| 60 | done |
| 61 | if [ "$rc" -ne 0 ]; then |
| 62 | if [ -n "$PGV3_ALLOW_UNPUSHED_SIBLINGS" ]; then echo "PGV3_ALLOW_UNPUSHED_SIBLINGS set — continuing"; rc=0 |
| 63 | else echo "REFUSING TO BUILD: a vendored sibling is not in hosted git history. Push it, or set PGV3_ALLOW_UNPUSHED_SIBLINGS=1."; fi |
| 64 | fi |
| 65 | exit $rc |
| 66 | timeout: 60 |
| 67 | |
| 28 | 68 | - name: vendor hyper-svc sibling into the closure |
| 29 | 69 | run: | |
| 30 | 70 | SRC=/storage/projects/code/hypercore-kb/hyper-fleeky/hyper-svc |