chore: Add breaking-changes label automation to verify dependent crates by scouten-adobe · Pull Request #2232 · contentauth/c2pa-rs

scouten-adobe · 2026-06-11T14:51:12Z

What

Adds a breaking-changes label that, when applied to a c2pa-rs PR, fans out to the org's downstream binding repos and verifies each still builds against the PR's branch — gating the PR on the results as a required status check.

How it works

.github/workflows/breaking-changes.yml (orchestrator + aggregator):
- On every PR it posts a single always-present required context, breaking-changes-gate (success when the label is absent, so unlabeled PRs never hang).
- When a same-repo PR carries the label, the gate goes pending and a repository_dispatch (c2pa-rs-breaking-change) fans out to each dependent in DEPENDENTS. If BINARY_DEPENDENTS is non-empty, it also triggers one branch build of library-release.yml (via CROSS_ORG_PR_TOKEN, since GITHUB_TOKEN can't start a run).
- A status-triggered job aggregates the per-dependent breaking-changes / <repo> results back into the gate.
- Uses pull_request_target (never checks out PR code) so the gate can be posted on fork PRs too; fork PRs pass-through with a note.
Receivers under docs/breaking-change-automation/receivers/ — one per dependent, tailored to how each consumes c2pa-rs:
- c2pa-node-v2, c2pa-js — rewrite the Cargo c2pa dep to a git+branch source, build, open a draft PR (Variant A).
- c2pa-python, c2pa-cpp — build from a local c2pa-rs checkout, status-only.
- c2pa-ios, c2pa-android — download the branch's library-release.yml artifacts, stage them, build, status-only. Unvalidated (need a real run + runners).
library-release.yml: release job gated to c2pa-v* tags (so branch dispatch produces artifacts without a release), plus a verify_sha input + run-name so receivers can locate the branch build.

Required follow-up before this is live

✅ Done — org secret CROSS_ORG_PR_TOKEN is live (Contents + Pull requests write on the dependents; Commit statuses + Actions write on c2pa-rs).
Add breaking-changes-gate as a required status check on main / v1_api. Do not require the per-dependent contexts.
Merge the receiver PRs, then add each live repo to DEPENDENTS (and BINARY_DEPENDENTS for ios/android). See the README's "To activate iOS/Android".

Receiver PRs

Source-buildable (ready): ci: add c2pa-rs breaking-change receiver workflow c2pa-node-v2#70, ci: add c2pa-rs breaking-change receiver workflow c2pa-js#131, ci: add c2pa-rs breaking-change receiver workflow c2pa-python#284, ci: add c2pa-rs breaking-change receiver workflow c2pa-cpp#234
Prebuilt-binary (unvalidated drafts): ci: add c2pa-rs breaking-change receiver workflow c2pa-swift#116, ci: add c2pa-rs breaking-change receiver workflow c2pa-android#92

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codspeed-hq · 2026-06-11T14:55:49Z

Merging this PR will not alter performance

✅ 30 untouched benchmarks
⏩ 64 skipped benchmarks¹

_{Comparing breaking-changes-automation (5b513ff) with main (8999918)}

64 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

codecov · 2026-06-11T14:57:57Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.56%. Comparing base (8999918) to head (5b513ff).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2232      +/-   ##
==========================================
- Coverage   78.56%   78.56%   -0.01%     
==========================================
  Files         176      176              
  Lines       46407    46407              
==========================================
- Hits        36460    36459       -1     
- Misses       9947     9948       +1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…ed receivers Reclassifies c2pa-js (builds wasm from a Cargo c2pa dep -> Variant A) and c2pa-cpp (has a build-from-source path) as source-buildable; only c2pa-ios and c2pa-android still need the artifact bridge. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Adds the verify_sha correlation input + run-name to library-release.yml, the orchestrator's one-build-per-labeled-PR trigger (gated on BINARY_DEPENDENTS), and the iOS/Android receivers that download and stage the branch artifacts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Follows each repo's documented build-from-local flow: drops the PYTHON= override for c2pa-python; for c2pa-cpp checks out c2pa-rs as a sibling dir and sets LD_LIBRARY_PATH for make test-release (per README). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ok-nick

Excited to see this, much needed!

ok-nick · 2026-06-12T19:12:39Z

+When a c2pa-rs change breaks API/ABI compatibility, the downstream binding repos
+may need code changes before the c2pa-rs PR can land. This automation surfaces
+that *before* merge: apply the **`breaking-changes`** label to a c2pa-rs PR and
+every dependent repo is built against the PR's branch, with the results gating
+the PR as a required status check.


We should also consider running this suite on every release. That may be planned already, though it would be good to call out. Sometimes things don't break API compatibility but they do break test cases/functionality in downstream SDKs that we can't predict. Same idea when the build system changes.

It may also be worth considering requiring this as as status check before finally merging. If we know it doesn't affect anything (such as not a feat: , fix: , build: PR, or just in general) it can be explicitly overridden.

ok-nick · 2026-06-12T19:18:47Z

+
+The orchestrator runs on **`pull_request_target`** rather than `pull_request`.
+That's required so the gate status can be posted on fork PRs too — under
+`pull_request` the `GITHUB_TOKEN` is read-only for forks, which would leave the
+required gate context unset and block every external-contributor PR. The
+fan-out job is safe under `pull_request_target` because it never checks out or
+executes PR code; it only reads trusted event metadata and posts statuses /
+dispatches. **Do not add a checkout of the PR head to that workflow.**
+


I think we just need to be careful not to run CI on PRs that edit this workflow. I've seen recommendations to use workflow_run to ensure any functionality accessing secrets is gated on the main branch rather than the fork.

ok-nick · 2026-06-12T19:21:18Z

+repos consume c2pa-rs differently, the receivers differ — use the ready-made
+ones where they exist:
+
+| Dependent | Receiver to install | Notes |


I wonder if we can move the build logic to the other repo, maybe as a reusable workflow we call or a makefile that way we don't need custom logic here for each SDK.

ok-nick · 2026-06-12T19:22:12Z

+**The artifact bridge is in place.** That workflow already uploads per-target
+workflow artifacts (`release-artifacts-<os>-<target>`, containing the same
+`c2pa-v*-<target>.zip` files as the release assets) on every run, and its
+`release` job is gated to `c2pa-v*` tag pushes — so dispatching it against a
+branch produces downloadable artifacts without cutting a release:


This sounds cool, so we will have all the artifacts available directly in c2pa-rs?

scouten-adobe · 2026-06-19T21:33:51Z

Withdrawing for now pending some conversations about our release process.

chore: Add breaking-changes label automation to verify dependent crates

5eebf9d

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scouten-adobe and others added 3 commits June 11, 2026 08:05

ok-nick reviewed Jun 12, 2026

View reviewed changes

scouten-adobe closed this Jun 19, 2026

Navigation Menu

Uh oh!

chore: Add breaking-changes label automation to verify dependent crates - #2232

chore: Add breaking-changes label automation to verify dependent crates#2232
scouten-adobe wants to merge 4 commits into
mainfrom
breaking-changes-automation

scouten-adobe commented Jun 11, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

ok-nick left a comment

Uh oh!

ok-nick Jun 12, 2026

Uh oh!

ok-nick Jun 12, 2026

Uh oh!

ok-nick Jun 12, 2026

Uh oh!

ok-nick Jun 12, 2026

Uh oh!

scouten-adobe commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

scouten-adobe commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How it works

Required follow-up before this is live

Receiver PRs

Uh oh!

codspeed-hq Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

codecov Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ok-nick left a comment

Choose a reason for hiding this comment

Uh oh!

ok-nick Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

ok-nick Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

ok-nick Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

ok-nick Jun 12, 2026

Choose a reason for hiding this comment

Uh oh!

scouten-adobe commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

scouten-adobe commented Jun 11, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 11, 2026 •

edited

Loading

codecov Bot commented Jun 11, 2026 •

edited

Loading