[systemfsoftware-maker]

Summary

The reusable changeset check now runs changeset-management built from the workflow revision the caller's uses: resolved to, the way release.yml does since #42. Before, a caller with devshell: true ran the copy its own flake.lock pinned, and a caller without it ran a fresh pnpm build of tools-ref (default main).

Both modes now use release.yml's step, which builds github:${{ job.workflow_repository }}/${{ job.workflow_sha }}#release-tools with the :? guards on empty context values. The check runs that binary by its resolved store path:

check=$(realpath "$RELEASE_TOOLS/changeset-management")
if [ "$DEVSHELL" = true ]; then
  nix develop --command sandbox -- "$check" check "$BASE_SHA"
else
  "$check" check "$BASE_SHA"
fi

Decisions a reviewer should check

• realpath is required. The caller's bubblewrap sandbox binds the store root of the command's resolved path (nix/sandbox/sandbox.sh:192) and nothing for the link itself. release-tools is a symlinkJoin, so the unresolved path fails inside the sandbox with bwrap: execvp …-release-tools/bin/changeset-management: No such file or directory. The workflow can't rely on a sandbox fix, because each caller runs the sandbox from its own pinned revision of this repository.
• tools-ref is accepted and ignored. stryker-js-effect still passes tools-ref: main, and removing a declared input fails the callers that pass it. The README says to drop it from callers first. This repository's changeset.yml no longer passes it.
• devshell: false now needs Nix as well. Hosted runners get it from cachix/install-nix-action, and a self-hosted runner has to provide it. The README says so.

Test

world.job(name, { workflow, inputs }) in the e2e harness now runs a job from either reusable workflow. The harness also:

• evaluates each step's if:;
• resolves inputs.*, including || defaults;
• has a sandbox stub that refuses an unresolved command path, matching the real sandbox's ENOENT.

The require-intent job runs twice against a caller whose dev shell pins changeset-management at an older revision, once with devshell: true and once with devshell: false. Each run asserts the exact steps that ran and that the check passed naming @e2e/alpha.

Results of pnpm --filter @systemfsoftware/e2e test:

Tree	Result
this branch	Tests 1 passed (1)
this branch with main's (21fe619) changeset-check.yml	fails at the devshell phase with changeset-management at 0449f15b2db9602a1dfe58bee2598adca2a726ed, the revision the caller's flake.lock pins, ran instead of the workflow's: check 2c034a1…
this branch without the realpath	fails at the same phase with bwrap: execvp /tmp/workflow-release-tools/bin/changeset-management: No such file or directory (…)

Real build and real sandbox

In a clean shell (env -i, Nix profile only), the build exits EXIT=0:

$ nix build --no-link --print-out-paths github:systemfsoftware/pnpm-release-management/f6a432cdff024e9a8df487523a3a95fb66e58883#release-tools
/nix/store/j021qshn7yf50ryi15xc2kzc9px4v6qy-release-tools
changeset-management -> /nix/store/pqci23940gidvx0a3j8hs9xnpnwjh9zr-changeset-management-0.0.0/bin/changeset-management

That binary, run inside stryker-js-effect's own dev shell and sandbox (main 7373776d, after nix develop --command pnpm run bootstrap):

$ nix develop --command sandbox -- $(realpath …-release-tools/bin/changeset-management) check 16c07b4b8b
changeset gate: 3 publishable package(s) changed, each named by an intent — @systemfsoftware/stryker-js, @systemfsoftware/stryker-js-typescript-checker, @systemfsoftware/stryker-js-vitest-runner
EXIT=0
$ nix develop --command sandbox -- …-release-tools/bin/changeset-management check 16c07b4b8b
bwrap: execvp …-release-tools/bin/changeset-management: No such file or directory
EXIT=1

This PR's own Changeset run covers the hosted devshell: true path: changeset.yml calls the workflow on ubuntu-latest, and for a local uses: the job.workflow_sha is this PR's commit.

Not covered

• README.md also changes in fix(version): version a pnpm workspace whose root manifest has no version #28. This PR isn't stacked on fix(version): version a pnpm workspace whose root manifest has no version #28.
• There's no changeset, because only the workflows, the e2e harness and the README change.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[kiro-systemf]

Verified: changeset-check builds release-tools from github:${job.workflow_repository}/${job.workflow_sha} (same :? mechanism as #42), realpath for the sandbox bind; e2e fails on main 21fe619 (caller-lock 0449f15 tool ran) and passes on branch; real flake build exit 0; hosted Changeset run built the PR merge commit; fresh correctness review approve; CI 5/5 on 326bd5c; hunt grep clean.