fix(objectql,service-queue): lifecycle settings 覆盖不再能绕过消费者的保留窗下限 (#5195) #233
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Console Pin Freshness | |
| # Is `.objectui-sha` still CURRENT? (#3340 P0) | |
| # | |
| # ⚠️ NOT ci.yml's "Console Pin Gate" (#4290). The names are close and the | |
| # questions are opposite ends of the same fact: | |
| # | |
| # Console Pin Gate (#4290) "does the PINNED SHA still BUILD?" — clones | |
| # objectui at the pin and builds the SPA. | |
| # Console Pin Freshness "is the PIN still CURRENT?" — compares the pin | |
| # (this workflow) against objectui `main`. | |
| # | |
| # A two-month-old pin builds perfectly (Pin Gate green) while hiding two months | |
| # of frontend releases from the release record (this gate red). Keep both. | |
| # | |
| # WHERE IT BLOCKS | |
| # --------------- | |
| # On the changesets **Version Packages / release PR** only. Between pin bumps an | |
| # ordinary code PR sits behind objectui almost always — that is the normal state | |
| # of the repo, not a defect, and failing every PR over it would train everyone to | |
| # ignore this check. So the job runs everywhere and blocks only on the release | |
| # lane, where a lagging pin silently drops frontend changes from the release | |
| # record (#3340: four changes, two of them `minor` features, lost from v16). | |
| # | |
| # WHY THE JOB IS NEVER SKIPPED | |
| # ---------------------------- | |
| # It carries no job-level `if:` and no paths filter on purpose. A check that | |
| # does not run reports nothing, and a *required* context that reports nothing | |
| # leaves every PR stuck "Expected — waiting for status". Advisory mode is | |
| # expressed in the EXIT CODE, not by skipping: the report is printed in full | |
| # either way, so a green run on an ordinary PR still shows how far the pin has | |
| # drifted. | |
| # | |
| # REQUIRED-CHECK ENFORCEMENT IS NOT SELF-DECLARED | |
| # ----------------------------------------------- | |
| # A workflow cannot make itself required. A maintainer must add the | |
| # `Console Pin Freshness` context to the branch-protection rule for `main` | |
| # (Settings → Branches → main → Require status checks to pass). Until then this | |
| # workflow REPORTS on the release PR without blocking the merge button. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Job name == the branch-protection context. Keep it stable: renaming it | |
| # silently detaches the required check (the #3622 lesson ci.yml records). | |
| pin-freshness: | |
| name: Console Pin Freshness | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| # "A change to the guard runs the guard" — the rule this repo applies to | |
| # every other scripts/ gate. No install: the script is dependency-free. | |
| - name: Self-test the gate | |
| run: node scripts/check-objectui-pin-fresh.mjs --self-test | |
| - name: Check objectui pin freshness | |
| env: | |
| # Only ITEMIZES an already-established lag (`git ls-remote` decides the | |
| # verdict), but the token keeps the API off the 60/hr anonymous limit | |
| # so the report names the commits and changesets instead of degrading. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Read through env, never inlined into the shell: a PR title is | |
| # attacker-controlled text. | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| EVENT: ${{ github.event_name }} | |
| run: | | |
| # The changesets action opens the version PR from `changeset-release/<base>` | |
| # with the title configured in release.yml. Either identifies the lane; | |
| # both are checked so a future rename of one does not silently disarm | |
| # the gate. | |
| if [ "$EVENT" != "pull_request" ] \ | |
| || [ "$HEAD_REF" = "changeset-release/main" ] \ | |
| || [ "$PR_TITLE" = "chore: version packages" ]; then | |
| echo "::notice::Release lane — the objectui pin-freshness gate BLOCKS here (#3340)." | |
| node scripts/check-objectui-pin-fresh.mjs | |
| else | |
| echo "::notice::Not the Version Packages PR — pin freshness is reported but does not block (a pin lagging between bumps is normal). It blocks on the release PR." | |
| node scripts/check-objectui-pin-fresh.mjs --advisory | |
| fi |