CI: reproduction check + guard self-tests (this repo had no CI) - #3
Merged
Conversation
This repo had no CI at all. The publish guard runs only in prepublishOnly, so nothing checked a tree BETWEEN releases - exactly when x402-op-authorize drifted from the 0.4.0 it declared. HEAD-based, not gitHead-based, and that is the whole point. The gitHead version PASSES on the case that went wrong: x402 0.4.0 rebuilds byte-identically from its commit in the archived repo, while this monorepo's tree declared 0.4.0 with four changed files. The question that catches it is about the working tree. Composes with the guard's registry check: a tree either declares an unpublished version (skipped here, publishable there) or a published one (must reproduce it). No third state. Subject is dist/, not the whole tarball. Running the strict version showed why: five of seven failed and four differed only in README.md and package.json, because the provenance notes were added after those versions were published. Whole-tarball comparison makes a README typo a red build. dist/ is what consumers execute and what diverged in the real case. Node pinned to 22.22.3 at the site, with the reason: esbuild and typescript are lockfile-pinned, Node is pinned by nothing in the artifact, and 22.22.3 is the version byte-identical reproduction was measured under. The guard self-tests assert the REASON, not the refusal. Editing package.json makes the tree dirty so the guard refuses either way, and a bare non-zero assertion would stay green with the registry check deleted. A second job breaks registry_state and requires the negative control to fire. Both self-tests first give HEAD an upstream: the guard refuses an untracked branch before reaching anything later, and actions/checkout does not configure tracking. Found by running it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Heads up: this lands RED on
l402-op-authorize, and the red is true.@observer-protocol/l402-op-authorize@0.4.0ships adist/coredirectory that the current source does not produce — the same stale-distclass already on record forwdk-op-policy, wherenpm run buildnever cleansdist/so pre-removal output was republished. The published artifact carries files built from code that no longer exists. Not caused by this PR; surfaced by it.HEAD-based, not gitHead-based. The gitHead formulation passes on the case that went wrong: x402 0.4.0 rebuilds byte-identically from its commit in the archived repo, while this monorepo's tree declared 0.4.0 with four changed files.
Subject is
dist/, not the whole tarball. The strict version failed five of seven, four of them differing only in README/package.json because the provenance notes postdate those releases.Node pinned at the site with the reason stated — esbuild and tsc are lockfile-pinned, Node is pinned by nothing in the artifact.
Self-tests assert the reason, not the refusal, plus a job that breaks
registry_stateand requires the negative control to fire.