From fc6d2ecd4f4c3837877d069494a07659db566bad Mon Sep 17 00:00:00 2001 From: Jess Sullivan Date: Wed, 26 Aug 2026 22:52:49 -0400 Subject: [PATCH 1/3] ci: converge scheduling-kit package lane (TIN-3092) --- .bazelrc | 4 +- .bazelversion | 2 +- .github/workflows/ci.yml | 77 ++++++++++++++--------------------- .github/workflows/publish.yml | 3 +- README.md | 2 +- flake.nix | 6 +++ 6 files changed, 42 insertions(+), 52 deletions(-) diff --git a/.bazelrc b/.bazelrc index f1c0ae4..d43e11d 100644 --- a/.bazelrc +++ b/.bazelrc @@ -3,7 +3,9 @@ # ============================================================================= common --enable_bzlmod -common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main +# Keep the in-house registry immutable. Advance this SHA deliberately together +# with remote GF validation; never float the package graph at `main`. +common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/c5986e30831b5fc4f2ed0b70982089b2d15b1c37 common --registry=https://bcr.bazel.build # Build performance diff --git a/.bazelversion b/.bazelversion index 0e79152..2b0aa21 100644 --- a/.bazelversion +++ b/.bazelversion @@ -1 +1 @@ -8.1.1 +8.2.1 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9732942..c33f1bc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,12 +18,11 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v2.5.1 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v3.1.0 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} workspace_mode: isolated - publish_mode: hosted_exception npm_publish_mode: disabled node_versions: '["20", "22"]' publish_node_version: "22" @@ -50,41 +49,24 @@ jobs: # Repo-local lane for the write-time double-booking proof (TIN-2764). The # reusable job above runs `pnpm test:integration` with no database, so the - # homegrown concurrency suite skips there; this job stands up a Postgres - # service and runs the same command with DATABASE_URL set, exercising the - # practitioner-day advisory lock against a real database. This is - # intentionally NOT part of the reusable workflow (which stays untouched). - # - # Runner: GitHub-hosted ubuntu-latest, NOT the org self-hosted pool. A - # `services:` container with `localhost:5432` port mapping only resolves when - # the job runs directly on a Docker-on-host VM. The org's PRIMARY_LINUX runners - # are in-cluster/ARC (k8s) where the service is a sibling pod unreachable on - # localhost without DinD, which would make beforeAll's connect throw and paint - # this proof job a persistent red instead of running it. ubuntu-latest is free - # for this public repo and supports service containers natively. + # homegrown concurrency suite skips there. This lane provisions PostgreSQL + # from the repo's pinned flake on the same GF capability class as package CI; + # it never falls back to a hosted runner or depends on ARC service-container + # localhost semantics. integration-postgres: - name: Integration (Postgres service) - runs-on: ubuntu-latest - services: - postgres: - image: postgres:16-alpine - env: - POSTGRES_PASSWORD: postgres - POSTGRES_DB: scheduling_kit_test - ports: - - 5432:5432 - options: >- - --health-cmd "pg_isready -U postgres" - --health-interval 10s - --health-timeout 5s - --health-retries 10 + name: Integration (GF PostgreSQL) + runs-on: ${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }} env: - # The job runs on the runner host (not inside a job container), so the - # service is reachable on localhost via the mapped port. - DATABASE_URL: postgres://postgres:postgres@localhost:5432/scheduling_kit_test + PGDATA: ${{ runner.temp }}/scheduling-kit-postgres-${{ github.run_id }}-${{ github.run_attempt }} + PGHOST: 127.0.0.1 + PGPORT: "55432" + PGUSER: postgres + PGDATABASE: scheduling_kit_test + DATABASE_URL: postgres://postgres@127.0.0.1:55432/scheduling_kit_test PG_INTEGRATION: "1" steps: - uses: actions/checkout@v4 + - uses: tinyland-inc/ci-templates/.github/actions/nix-setup@v3.1.0 - uses: pnpm/action-setup@v4 with: version: "9.15.9" @@ -93,19 +75,20 @@ jobs: node-version: "22" - run: pnpm install --frozen-lockfile - run: pnpm exec svelte-kit sync - # Preflight: fail with an actionable message if the service container is - # not reachable, rather than letting the suite's beforeAll connect throw a - # confusing error deeper in the run. - - name: Wait for Postgres + - name: Run integration proof with pinned PostgreSQL + shell: bash run: | - for i in $(seq 1 30); do - if pg_isready -h localhost -p 5432 -U postgres; then - echo "postgres is ready" - exit 0 - fi - echo "waiting for postgres (attempt $i)..." - sleep 2 - done - echo "postgres service never became reachable on localhost:5432" >&2 - exit 1 - - run: pnpm test:integration + set -euo pipefail + export CI_NODE_BIN_DIR="$(dirname "$(command -v node)")" + export CI_PNPM_BIN="$(command -v pnpm)" + nix develop .#ci-postgres --command bash <<'POSTGRES_PROOF' + set -euo pipefail + export PATH="$CI_NODE_BIN_DIR:$(dirname "$CI_PNPM_BIN"):$PATH" + initdb --username="$PGUSER" --auth=trust "$PGDATA" + pg_ctl -D "$PGDATA" -l "$RUNNER_TEMP/scheduling-kit-postgres.log" \ + -o "-h $PGHOST -p $PGPORT" -w start + trap 'pg_ctl -D "$PGDATA" -w stop -m fast >/dev/null 2>&1 || true' EXIT + createdb --maintenance-db=postgres "$PGDATABASE" + pg_isready -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" + "$CI_PNPM_BIN" test:integration + POSTGRES_PROOF diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8420c83..f8e5ffc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -23,12 +23,11 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v2.5.1 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v3.1.0 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} workspace_mode: isolated - publish_mode: hosted_exception npm_publish_mode: disabled node_versions: '["20", "22"]' publish_node_version: "22" diff --git a/README.md b/README.md index bd17e0b..5f4cde0 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,7 @@ bazel_dep(name = "tummycrypt_scheduling_kit", version = "0.11.1") with the registry line (already in this repo's `.bazelrc`): ```text -common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/main +common --registry=https://raw.githubusercontent.com/tinyland-inc/bazel-registry/c5986e30831b5fc4f2ed0b70982089b2d15b1c37 ``` npm-ecosystem consumers outside the Bazel module graph install the derived diff --git a/flake.nix b/flake.nix index 7bf84f2..2b3aaf6 100644 --- a/flake.nix +++ b/flake.nix @@ -76,6 +76,12 @@ checks.docs = docsSite; checks.release-metadata = releaseMetadataCheck; + # Remote-only database proof used by the GF integration lane. Keeping + # PostgreSQL in the locked flake avoids a hosted service-container path. + devShells.ci-postgres = pkgs.mkShellNoCC { + packages = [ pkgs.postgresql_16 ]; + }; + devShells.default = pkgs.mkShellNoCC { packages = with pkgs; [ actionlint From 5e3541ffa082853e9b5cffdcd74400cab4d7d6b8 Mon Sep 17 00:00:00 2001 From: Jess Sullivan Date: Wed, 26 Aug 2026 22:56:10 -0400 Subject: [PATCH 2/3] ci: scope GF PostgreSQL data to runner step --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c33f1bc..e35d3c0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,7 +57,6 @@ jobs: name: Integration (GF PostgreSQL) runs-on: ${{ fromJSON(vars.PRIMARY_LINUX_RUNNER_LABELS_JSON) }} env: - PGDATA: ${{ runner.temp }}/scheduling-kit-postgres-${{ github.run_id }}-${{ github.run_attempt }} PGHOST: 127.0.0.1 PGPORT: "55432" PGUSER: postgres @@ -83,6 +82,7 @@ jobs: export CI_PNPM_BIN="$(command -v pnpm)" nix develop .#ci-postgres --command bash <<'POSTGRES_PROOF' set -euo pipefail + export PGDATA="$RUNNER_TEMP/scheduling-kit-postgres-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" export PATH="$CI_NODE_BIN_DIR:$(dirname "$CI_PNPM_BIN"):$PATH" initdb --username="$PGUSER" --auth=trust "$PGDATA" pg_ctl -D "$PGDATA" -l "$RUNNER_TEMP/scheduling-kit-postgres.log" \ From 30abe9e9ea7bae76b9deff19d095c6338ea3a760 Mon Sep 17 00:00:00 2001 From: Jess Sullivan Date: Wed, 26 Aug 2026 22:58:40 -0400 Subject: [PATCH 3/3] ci: canary GF Bzlmod lock bootstrap --- .github/workflows/ci.yml | 5 ++++- .github/workflows/publish.yml | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e35d3c0..1866daf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v3.1.0 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@a929a9c7451a6213c7535e6d57a231a279463c00 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} @@ -36,6 +36,9 @@ jobs: build_command: pnpm build package_check_command: pnpm check:package bazel_targets: "//:typecheck //:pkg //:test" + # Bootstrap the first committed lock from GF. After the remote artifact is + # committed, enable verify_bzlmod_lock in the signed follow-up. + emit_bzlmod_lock_artifact: true # Cache-first shared-cache-backed Bazel validation (TIN-2110 pilot). # Routes the Bazel validation through the fail-closed cache-attachment # contract + --config=ci-cached --remote_cache=$BAZEL_REMOTE_CACHE diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f8e5ffc..e2d54d7 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -23,7 +23,7 @@ concurrency: jobs: package: - uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@v3.1.0 + uses: tinyland-inc/ci-templates/.github/workflows/js-bazel-package.yml@a929a9c7451a6213c7535e6d57a231a279463c00 with: runner_mode: repo_owned runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }} @@ -41,6 +41,7 @@ jobs: build_command: pnpm build package_check_command: pnpm check:package bazel_targets: "//:typecheck //:pkg //:test" + emit_bzlmod_lock_artifact: true # Cache-first shared-cache-backed Bazel validation (TIN-2110 pilot). # Same opt-in lane as CI; endpoint injected at runtime, no executor. cache_backed: true