From 0f496aa075c5e15b90a18fe0e6a58e8410c5be90 Mon Sep 17 00:00:00 2001 From: Harish Seshadri Date: Tue, 4 Aug 2026 22:31:05 -0700 Subject: [PATCH] Record the three releases the CHANGELOG skipped, and re-pin to ci-v3.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `ci-v3.2.1` is cut at 605e51c — the publish-verification bound fix (#16). Cutting it is what makes that fix reach anyone: consumers pin by commit SHA, so a fix sitting on unreleased `main` reaches nobody. Two problems are fixed here, and the second is why this is not a docs-only commit. **The CHANGELOG had no record of two releases that had already shipped.** Its heading still read "Unreleased (on `main`, after ci-v3.0.0)" while `ci-v3.1.0` and `ci-v3.2.0` were both cut on 08-03. Nine of the ten bullets under that heading described work that had *already* shipped in `ci-v3.1.0` — verified by checking each bullet's artifact into the tree at 33c5e5f (`tests/example-fidelity.sh`, `tests/consumer-drift-cases.sh`, `.ruby-version`, `examples/edgeproc-core/`, the secret-scan job in `examples/aml-filter/ci.yml`, the `configured` job in `security-audit.yml`). Renaming that heading to `ci-v3.2.1` wholesale would have billed nine shipped entries as new and told consumers to re-pin for work they already had. So each release now has its own section and its own commit SHA: ci-v3.2.1 605e51cbc86f452b56edcf1c9660921da797cbfe the publish-verification bound ci-v3.2.0 7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 the re-pin that runs setup-uv v9 ci-v3.1.0 33c5e5fa421210e6cc91ea30cad708bce29a2407 setup-uv v9 + PRs #9-#14 `ci-v3.1.0` is marked do-not-pin, the way `ci-v2.0.0` already is: its tree runs the v9.0.0 composite but its own refs still name `ci-v3.0.0`, so pinning that tag executes v8.3.2 — the exact split it set out to close. `ci-v3.2.0` is the re-pin. **Every first-party ref moves to ci-v3.2.1** — 41 refs across 23 files, 9 in `.github/` and 32 in `examples/`. This is not optional bookkeeping. The currency half of `validate_first_party_release_lineage` requires every ref to name the newest release tag, and it exempts exactly one state: HEAD sitting on the newest tag's own commit, where a ref may name the immediately-preceding release because a commit cannot contain its own SHA. A CHANGELOG-only commit moves HEAD off 605e51c, the exemption stops firing, and all 41 refs naming `ci-v3.2.0` become "a superseded release, not ci-v3.2.1". Same reason `ci-v2.0.2` and `ci-v2.0.3` each landed a re-pin in the commit after the tag. No brick changed shape in ci-v3.2.1 and no composite behavior changed, so the release-commit bootstrap gap does not apply to it: every composite reached through these refs is byte-identical to the one in this tree. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_019mNrrQ5dDEr6ZwLntu7XtF --- .github/workflows/cloudflare-pages-deploy.yml | 4 +- .github/workflows/frontend-gate.yml | 4 +- .github/workflows/python-gate.yml | 2 +- .github/workflows/python-publish.yml | 2 +- .github/workflows/security-audit.yml | 4 +- .github/workflows/ts-publish.yml | 2 +- CHANGELOG.md | 56 +++++++++++++++++-- examples/almamesh/security-audit.yml | 2 +- examples/aml-filter/ci.yml | 8 +-- examples/aml-filter/deploy.yml | 4 +- examples/aml-filter/security-audit.yml | 4 +- examples/assay/publish.yml | 4 +- examples/edge-proc/ci.yml | 4 +- examples/edge-proc/publish.yml | 2 +- examples/edge-proc/security-audit.yml | 2 +- examples/edge-reco/ci.yml | 14 ++--- examples/edge-reco/deploy.yml | 2 +- examples/edge-reco/security-audit.yml | 2 +- examples/edgeproc-core/ci.yml | 4 +- examples/edgeproc-core/publish.yml | 2 +- examples/edgeproc-core/security-audit.yml | 2 +- examples/privacy-core/ci.yml | 4 +- examples/privacy-core/publish.yml | 2 +- examples/privacy-core/security-audit.yml | 2 +- 24 files changed, 91 insertions(+), 47 deletions(-) diff --git a/.github/workflows/cloudflare-pages-deploy.yml b/.github/workflows/cloudflare-pages-deploy.yml index 959c38f..d97125e 100644 --- a/.github/workflows/cloudflare-pages-deploy.yml +++ b/.github/workflows/cloudflare-pages-deploy.yml @@ -192,7 +192,7 @@ jobs: ref: ${{ github.event.workflow_run.head_sha || github.ref }} - name: Setup pnpm + Node (+ install) - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: ${{ inputs.package-json-file }} node-version: ${{ inputs.node-version }} @@ -213,7 +213,7 @@ jobs: run: bash --noprofile --norc -euo pipefail -c "$TRUSTED_COMMAND" - name: Deploy to Cloudflare Pages - uses: hseshadr/ci/.github/actions/pages-deploy-dist@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/pages-deploy-dist@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: project-name: ${{ inputs.project-name }} dist-dir: ${{ inputs.dist-dir }} diff --git a/.github/workflows/frontend-gate.yml b/.github/workflows/frontend-gate.yml index eef864e..719701e 100644 --- a/.github/workflows/frontend-gate.yml +++ b/.github/workflows/frontend-gate.yml @@ -88,7 +88,7 @@ jobs: persist-credentials: false - name: Setup pnpm + Node (+ install) - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: ${{ inputs.package-json-file }} node-version: ${{ inputs.node-version }} @@ -99,7 +99,7 @@ jobs: - name: Setup Playwright (cached) if: ${{ inputs.install-playwright }} - uses: hseshadr/ci/.github/actions/setup-playwright@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-playwright@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: browsers: ${{ inputs.playwright-browsers }} working-directory: ${{ inputs.playwright-working-directory || inputs.working-directory }} diff --git a/.github/workflows/python-gate.yml b/.github/workflows/python-gate.yml index d4b2cf1..0c85fc5 100644 --- a/.github/workflows/python-gate.yml +++ b/.github/workflows/python-gate.yml @@ -79,7 +79,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: python-version: ${{ inputs.python-version }} sync-args: ${{ inputs.sync-args }} diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index a5d4736..dcbf8b8 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -115,7 +115,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: python-version: ${{ inputs.python-version }} sync-args: ${{ inputs.sync-args }} diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index 3db0afd..a58d49b 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -107,7 +107,7 @@ jobs: # run-sync: false — we `uv export` the lock, not build a venv. - name: Setup Python + uv - uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: working-directory: ${{ inputs.python-working-directory }} run-sync: "false" @@ -163,7 +163,7 @@ jobs: # install: false — `pnpm audit` reads the lockfile + queries the advisory DB # directly; no node_modules needed. - name: Setup pnpm + Node - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: ${{ inputs.frontend-working-directory }}/package.json node-version: ${{ inputs.node-version }} diff --git a/.github/workflows/ts-publish.yml b/.github/workflows/ts-publish.yml index a9c604c..a8196ad 100644 --- a/.github/workflows/ts-publish.yml +++ b/.github/workflows/ts-publish.yml @@ -141,7 +141,7 @@ jobs: registry-url: ${{ inputs.registry-url }} - name: Setup pnpm + Node (+ install) - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: ${{ inputs.package-json-file }} node-version: ${{ inputs.node-version }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 2b549e4..20abae9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,13 +6,21 @@ All notable changes to the shared CI/CD templates. Each release is cut as an imm listed below. `tests/security-policy.sh` rejects a moving `@ci-vN` ref, first-party included. -## Unreleased (on `main`, after ci-v3.0.0) +## ci-v3.2.1 — 2026-08-04 -**No brick changed shape** — no input, output or permission moved, so no caller needs -editing. One entry below changes brick *behaviour*: the publish-verification retry bound -in `python-publish.yml` and `ts-publish.yml`. That one needs a re-pin to reach a consumer. -Everything else is a guard, a test, or a fix to the copy-paste surface in `examples/`, -which needs a re-copy. +Commit `605e51cbc86f452b56edcf1c9660921da797cbfe`. + +**No brick changed shape** — no input, output or permission moved, so re-pinning from +`ci-v3.2.0` is a drop-in. One entry, and it changes brick *behaviour*: the +publish-verification retry bound in `python-publish.yml` and `ts-publish.yml`. **Re-pin +only if you publish** through those workflows or copied one of the `examples/*/publish.yml` +inline jobs; nothing else in this release reaches a consumer. + +**No composite behavior changed**, so the [release-commit +bootstrap](./README.md#the-release-commit-bootstrap) gap does not apply to this release. +All 41 first-party refs at this commit (9 in `.github/`, 32 in `examples/`) already name +`ci-v3.2.0`, and every composite reached through them is byte-identical to the one in this +tree. - **The publish-verification bound was too tight, and it failed a release that had genuinely succeeded.** The check itself is right and stays: ask the registry whether the @@ -31,6 +39,42 @@ which needs a re-copy. serve and it still exits **1** after the full budget. The three `examples/*/publish.yml` inline copies carry the same bound, so the surface consumers copy does not ship the defect. + +## ci-v3.2.0 — 2026-08-03 + +Commit `7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790`. + +**This is the release that made `ci-v3.1.0`'s `setup-uv` v9 upgrade actually run.** Its +only change over `ci-v3.1.0` is the first-party re-pin: 41 refs across 23 files move from +`ci-v3.0.0` to `ci-v3.1.0`, and nothing else — verify with + +```bash +git diff ci-v3.1.0 ci-v3.2.0 | grep -E '^[+-]' | grep -vE '^(\+\+\+|---)' \ + | grep -vE 'hseshadr/ci/' +``` + +which prints nothing. This is the `ci-v3.x` tag to pin if you are not taking `ci-v3.2.1`. + +## ci-v3.1.0 — 2026-08-03 + +Commit `33c5e5fa421210e6cc91ea30cad708bce29a2407`. + +**Do not pin this tag — take `ci-v3.2.0` or newer.** This is the +[release-commit bootstrap](./README.md#the-release-commit-bootstrap) in its worst shape: +the composite in this tree runs `setup-uv` v9.0.0, but the tree's own first-party refs +still name `ci-v3.0.0`, so a consumer pinning `ci-v3.1.0` executes the **v8.3.2** +composite — the exact thing this release set out to fix. `ci-v3.2.0` is the re-pin. + +Everything below first shipped here, in the six PRs (#9–#14) between `ci-v3.0.0` and this +commit. Apart from the `setup-uv` bump, none of it changes a brick's shape: each entry is +a guard, a test, or a fix to the copy-paste surface in `examples/`, which needs a re-copy +rather than a re-pin. + +- **`setup-python-uv` runs `astral-sh/setup-uv` v9.0.0** (behavior change). `ci-v3.0.0`'s + tree carried v8.3.2, so every consumer calling `python-gate`, `python-publish` or + `security-audit` executed v8.3.2 on its gate and publish path while its own `ci.yml` + ran v9.0.0 — a split nobody could see from either side. Reaches consumers at + `ci-v3.2.0`, per the note above. - **The drift detector caught its first new control, and the cause was partly this repo.** On 2026-08-02 the scheduled sweep went red: `30 … 29 allowlisted; 1 new` ([run 30739082151](https://github.com/hseshadr/ci/actions/runs/30739082151)); the day diff --git a/examples/almamesh/security-audit.yml b/examples/almamesh/security-audit.yml index c9cb1e8..4286508 100644 --- a/examples/almamesh/security-audit.yml +++ b/examples/almamesh/security-audit.yml @@ -12,7 +12,7 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: run-python-audit: true python-working-directory: backend diff --git a/examples/aml-filter/ci.yml b/examples/aml-filter/ci.yml index f7a6d1a..1d4beab 100644 --- a/examples/aml-filter/ci.yml +++ b/examples/aml-filter/ci.yml @@ -33,7 +33,7 @@ jobs: permissions: contents: read pull-requests: read - uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 frontend: runs-on: ubuntu-latest @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc @@ -51,7 +51,7 @@ jobs: # Weights come from a GitHub RELEASE, not a package registry, so the fetch # needs GH_TOKEN. Job-level `env:` is what reaches a composite's steps — # the composite deliberately takes no secret input. - - uses: hseshadr/ci/.github/actions/restore-model-cache@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/restore-model-cache@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 env: GH_TOKEN: ${{ github.token }} with: @@ -67,7 +67,7 @@ jobs: gh release download model-weights-v1 --repo "$GITHUB_REPOSITORY" --dir "$dir/onnx" --clobber \ --pattern model_quantized.onnx node scripts/download-model.mjs - - uses: hseshadr/ci/.github/actions/setup-playwright@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/setup-playwright@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: working-directory: frontend cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }} diff --git a/examples/aml-filter/deploy.yml b/examples/aml-filter/deploy.yml index 938ff2a..6d1c377 100644 --- a/examples/aml-filter/deploy.yml +++ b/examples/aml-filter/deploy.yml @@ -39,7 +39,7 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc @@ -105,7 +105,7 @@ jobs: fi # --- shared deploy half: identical wrangler step used by every Pages repo --- - - uses: hseshadr/ci/.github/actions/pages-deploy-dist@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/pages-deploy-dist@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: project-name: aml-filter dist-dir: frontend/app/dist diff --git a/examples/aml-filter/security-audit.yml b/examples/aml-filter/security-audit.yml index fbd1571..e998646 100644 --- a/examples/aml-filter/security-audit.yml +++ b/examples/aml-filter/security-audit.yml @@ -8,10 +8,10 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: run-pnpm-audit: true frontend-working-directory: frontend pnpm-audit-level: low gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 diff --git a/examples/assay/publish.yml b/examples/assay/publish.yml index 78cbf57..1dc49fa 100644 --- a/examples/assay/publish.yml +++ b/examples/assay/publish.yml @@ -59,7 +59,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: sync-args: "--frozen --all-extras" @@ -141,7 +141,7 @@ jobs: permissions: id-token: write # OIDC — npm verifies this against the registered trusted publisher. contents: read - uses: hseshadr/ci/.github/workflows/ts-publish.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/ts-publish.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: working-directory: ts # assay has no ROOT package.json/lockfile — the TS package lives wholly in ts/. diff --git a/examples/edge-proc/ci.yml b/examples/edge-proc/ci.yml index de289af..7ed6cf7 100644 --- a/examples/edge-proc/ci.yml +++ b/examples/edge-proc/ci.yml @@ -12,8 +12,8 @@ permissions: pull-requests: read jobs: gate: - uses: hseshadr/ci/.github/workflows/python-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/python-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: sync-args: "--frozen --all-extras" gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 diff --git a/examples/edge-proc/publish.yml b/examples/edge-proc/publish.yml index e60b2d9..c755527 100644 --- a/examples/edge-proc/publish.yml +++ b/examples/edge-proc/publish.yml @@ -43,7 +43,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: sync-args: "--frozen --all-extras" diff --git a/examples/edge-proc/security-audit.yml b/examples/edge-proc/security-audit.yml index 92c0082..ccddb37 100644 --- a/examples/edge-proc/security-audit.yml +++ b/examples/edge-proc/security-audit.yml @@ -8,6 +8,6 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: run-python-audit: true diff --git a/examples/edge-reco/ci.yml b/examples/edge-reco/ci.yml index 71f46b6..7f85220 100644 --- a/examples/edge-reco/ci.yml +++ b/examples/edge-reco/ci.yml @@ -17,10 +17,10 @@ permissions: pull-requests: read jobs: gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 quality: - uses: hseshadr/ci/.github/workflows/python-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/python-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: working-directory: backend sync-args: "--locked --group dev" @@ -31,13 +31,13 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc cache-dependency-path: frontend/pnpm-lock.yaml working-directory: frontend - - uses: hseshadr/ci/.github/actions/restore-model-cache@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/restore-model-cache@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: cache-path: frontend/app/public/models cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }} @@ -53,19 +53,19 @@ jobs: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - uses: hseshadr/ci/.github/actions/setup-pnpm@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/setup-pnpm@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: package-json-file: frontend/package.json node-version-file: frontend/.nvmrc cache-dependency-path: frontend/pnpm-lock.yaml working-directory: frontend - - uses: hseshadr/ci/.github/actions/restore-model-cache@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/restore-model-cache@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: cache-path: frontend/app/public/models cache-key: model-weights-${{ runner.os }}-${{ hashFiles('frontend/app/scripts/download-model.mjs') }} fetch-command: node scripts/download-model.mjs working-directory: frontend/app - - uses: hseshadr/ci/.github/actions/setup-playwright@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + - uses: hseshadr/ci/.github/actions/setup-playwright@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: working-directory: frontend cache-key: playwright-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }} diff --git a/examples/edge-reco/deploy.yml b/examples/edge-reco/deploy.yml index 5b2011e..654215f 100644 --- a/examples/edge-reco/deploy.yml +++ b/examples/edge-reco/deploy.yml @@ -32,7 +32,7 @@ jobs: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.head_repository.full_name == github.repository) }} - uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/cloudflare-pages-deploy.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: project-name: edge-reco dist-dir: frontend/app/dist diff --git a/examples/edge-reco/security-audit.yml b/examples/edge-reco/security-audit.yml index ff6cfd2..ab4875d 100644 --- a/examples/edge-reco/security-audit.yml +++ b/examples/edge-reco/security-audit.yml @@ -8,7 +8,7 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: run-python-audit: true run-pnpm-audit: true diff --git a/examples/edgeproc-core/ci.yml b/examples/edgeproc-core/ci.yml index 3e079ea..d513ab0 100644 --- a/examples/edgeproc-core/ci.yml +++ b/examples/edgeproc-core/ci.yml @@ -13,7 +13,7 @@ permissions: pull-requests: read jobs: gate: - uses: hseshadr/ci/.github/workflows/python-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/python-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: upload-coverage: true # Name the one secret the gate needs. `secrets: inherit` would forward every repo @@ -21,4 +21,4 @@ jobs: secrets: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 diff --git a/examples/edgeproc-core/publish.yml b/examples/edgeproc-core/publish.yml index f7d7ae3..74d087d 100644 --- a/examples/edgeproc-core/publish.yml +++ b/examples/edgeproc-core/publish.yml @@ -43,7 +43,7 @@ jobs: persist-credentials: false - name: Setup Python + uv (+ sync) - uses: hseshadr/ci/.github/actions/setup-python-uv@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/actions/setup-python-uv@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: sync-args: "--frozen --all-extras" diff --git a/examples/edgeproc-core/security-audit.yml b/examples/edgeproc-core/security-audit.yml index d2a9cb4..0fe329a 100644 --- a/examples/edgeproc-core/security-audit.yml +++ b/examples/edgeproc-core/security-audit.yml @@ -8,6 +8,6 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: run-python-audit: true diff --git a/examples/privacy-core/ci.yml b/examples/privacy-core/ci.yml index 70c87d6..3abe5b4 100644 --- a/examples/privacy-core/ci.yml +++ b/examples/privacy-core/ci.yml @@ -13,9 +13,9 @@ permissions: pull-requests: read jobs: gate: - uses: hseshadr/ci/.github/workflows/frontend-gate.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/frontend-gate.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: install-args: "--frozen-lockfile --config.dangerously-allow-all-builds=true" install-playwright: true gitleaks: - uses: hseshadr/ci/.github/workflows/secret-scan.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/secret-scan.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 diff --git a/examples/privacy-core/publish.yml b/examples/privacy-core/publish.yml index bb063bc..2b22eb9 100644 --- a/examples/privacy-core/publish.yml +++ b/examples/privacy-core/publish.yml @@ -37,7 +37,7 @@ jobs: permissions: id-token: write # OIDC — npm verifies this against the registered trusted publisher. contents: read - uses: hseshadr/ci/.github/workflows/ts-publish.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/ts-publish.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: working-directory: "." install-args: "--frozen-lockfile --config.dangerously-allow-all-builds=true" diff --git a/examples/privacy-core/security-audit.yml b/examples/privacy-core/security-audit.yml index 3672856..b789a7f 100644 --- a/examples/privacy-core/security-audit.yml +++ b/examples/privacy-core/security-audit.yml @@ -8,7 +8,7 @@ permissions: contents: read jobs: audit: - uses: hseshadr/ci/.github/workflows/security-audit.yml@7226072bd02e7aecc5b065b3eaf0bfbf4b3e1790 # ci-v3.2.0 + uses: hseshadr/ci/.github/workflows/security-audit.yml@605e51cbc86f452b56edcf1c9660921da797cbfe # ci-v3.2.1 with: run-pnpm-audit: true frontend-working-directory: "."