feat(registry): verify declared actions and i18n keys at publish - #46
Merged
Conversation
brika build now declares server actions as {id,file,name} entries (id is the
12-hex computeActionId hash). The publish schema validates the shape and
validateManifestCapabilities checks each declared action's source file is
present in the tarball, using the exact path the entry names.
Bumps @brika/compiler to nightly 0.4.0-57e2df6836d4 (the gate report's ActionEntry now carries the id under 'id'; ActionEntry parses both keys so pre-rename rows keep serving, and the report persists the new shape). Two new publish rejections in the manifest validator: - actions drift: brika build declares the discovered actions in the manifest's actions[] with the exact scan the gate re-runs, so declared and re-derived must agree entry for entry. An absent array (pre-collection toolchain) is exempt; a present one that disagrees means the manifest was built against different sources. - i18n usage: every i18n key the plugin's code statically references must exist in some bundled locale (the same edge-safe analyzeI18nUsage that brika verify runs); a missing key would render raw at runtime. Skipped when the plugin bundles no locales; warnings do not gate. Also syncs the schema fork with blocks[].fields and the localized readme map so parsing no longer strips them.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
brika-store | ec6d3c2 | Jul 05 2026, 04:03 PM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
brika-registry | ec6d3c2 | Jul 05 2026, 04:03 PM |
maxscharwath
changed the title
Sonar new-code gate: validate's cognitive complexity dropped back under the threshold by moving the bundle gate + actions drift + i18n usage checks into runCompileGates, and the drift lookups use find instead of filter[0].
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion to brikalabs/brika#136: the registry now independently re-derives and verifies what the author's build declared.
What this does
@brika/compiler@0.4.0-57e2df6836d4(nightly from the brika branch). The gate report'sActionEntryrenamedactionId→id; the registry'sActionEntryparses both keys, so version rows published before the rename keep serving through the report API while new publishes persist the new shape.brika buildwrites discovered actions into the manifest'sactions[]using the exact same static scan the publish gate re-runs over the untarred sources, so declared and re-derived must agree entry for entry (id + file + name). Manifests without anactions[]array (older toolchains) are exempt. A mismatch rejects with a "run brika build and republish" message naming the offending action.analyzeI18nUsageruns in the Worker over the tarball sources and the bundledlocales/<lang>/*.json(deep-merged with hub semantics). At()key the code references that exists in NO locale rejects the publish — it would render raw at runtime. No locales bundled → gate skipped; warnings (unresolvable calls, stale keys) never gate.ActionSchema+ declared-action file backing (earlier commit on this branch), plusblocks[].fieldsand the localizedreadmemap soz.objectparsing no longer strips them.Verification
ActionEntrymigration, D1 round-trip on the new shape), typecheck and biome clean.bun test(unrelated; they need the Playwright runner).