From 8459ed8c00b342adcf7b1f2cce1a49ce6baaddae Mon Sep 17 00:00:00 2001 From: lycaon Date: Sat, 18 Jul 2026 14:23:01 -0600 Subject: [PATCH] fix: recognize dynamic site deployment runs --- ops/t4-maintainer/run.sh | 6 +++--- scripts/t4-maintainer-contract.test.mjs | 6 +++++- scripts/t4-maintainer-integration.test.mjs | 6 +++--- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/ops/t4-maintainer/run.sh b/ops/t4-maintainer/run.sh index 3e7f2ffa..54efd07f 100755 --- a/ops/t4-maintainer/run.sh +++ b/ops/t4-maintainer/run.sh @@ -1508,7 +1508,7 @@ publication_workflows_succeeded() { printf '%s' "$runs" | $JQ -e --arg tag "$t4_tag" --arg commit "$commit" ' any(.workflow_runs[]; .name == "CI" and .path == ".github/workflows/ci.yml" and .head_sha == $commit and .event == "push" and .status == "completed" and .conclusion == "success") and any(.workflow_runs[]; .name == "Release app builds" and .path == ".github/workflows/release.yml" and .head_sha == $commit and .event == "push" and .head_branch == $tag and .status == "completed" and .conclusion == "success") and - any(.workflow_runs[]; .name == "Deploy project site" and .path == ".github/workflows/deploy-site.yml" and .head_sha == $commit and .event == "workflow_dispatch" and .status == "completed" and .conclusion == "success") + any(.workflow_runs[]; .path == ".github/workflows/deploy-site.yml" and .head_sha == $commit and .event == "workflow_dispatch" and .status == "completed" and .conclusion == "success") ' >/dev/null } @@ -1520,12 +1520,12 @@ publication_workflows_active_or_recent() { def relevant: (.name == "CI" and .path == ".github/workflows/ci.yml" and .head_sha == $commit and .event == "push") or (.name == "Release app builds" and .path == ".github/workflows/release.yml" and .head_sha == $commit and .event == "push" and .head_branch == $tag) or - (.name == "Deploy project site" and .path == ".github/workflows/deploy-site.yml" and .head_sha == $commit and .event == "workflow_dispatch"); + (.path == ".github/workflows/deploy-site.yml" and .head_sha == $commit and .event == "workflow_dispatch"); any(.workflow_runs[]; relevant and .status != "completed") or ( any(.workflow_runs[]; .name == "CI" and .path == ".github/workflows/ci.yml" and .head_sha == $commit and .event == "push" and .conclusion == "success") and any(.workflow_runs[]; .name == "Release app builds" and .path == ".github/workflows/release.yml" and .head_sha == $commit and .event == "push" and .head_branch == $tag and .conclusion == "success") and - any(.workflow_runs[]; .name == "Deploy project site" and .path == ".github/workflows/deploy-site.yml" and .head_sha == $commit and .event == "workflow_dispatch" and .conclusion == "success") and + any(.workflow_runs[]; .path == ".github/workflows/deploy-site.yml" and .head_sha == $commit and .event == "workflow_dispatch" and .conclusion == "success") and any(.workflow_runs[]; relevant and .conclusion == "success" and ((.updated_at | fromdateiso8601) >= $cutoff)) ) ' >/dev/null diff --git a/scripts/t4-maintainer-contract.test.mjs b/scripts/t4-maintainer-contract.test.mjs index c5616b1b..e78ea22e 100644 --- a/scripts/t4-maintainer-contract.test.mjs +++ b/scripts/t4-maintainer-contract.test.mjs @@ -396,7 +396,6 @@ test("public verification requires exact GitHub provenance despite admin bypass '.path == ".github/workflows/ci.yml"', '.name == "Release app builds"', '.path == ".github/workflows/release.yml"', - '.name == "Deploy project site"', '.path == ".github/workflows/deploy-site.yml"', ".head_branch == $tag", '.status == "completed"', @@ -404,6 +403,11 @@ test("public verification requires exact GitHub provenance despite admin bypass ], "exact-commit workflow verification", ); + assert.doesNotMatch( + workflows, + /\.name == "Deploy project site"/u, + "site workflow identity must use the stable path because run-name is dynamic", + ); const assets = shellFunction(runner, "release_assets_are_public"); for (const name of [ diff --git a/scripts/t4-maintainer-integration.test.mjs b/scripts/t4-maintainer-integration.test.mjs index 3e8625aa..9428cae5 100644 --- a/scripts/t4-maintainer-integration.test.mjs +++ b/scripts/t4-maintainer-integration.test.mjs @@ -257,7 +257,7 @@ case $tool in {"workflow_runs":[ {"name":"CI","path":"$t4_ci_path","head_sha":"$MOCK_T4_COMMIT","event":"push","head_branch":"main","status":"completed","conclusion":"failure","updated_at":"2020-01-01T00:00:00Z"}, {"name":"Release app builds","path":"$t4_release_path","head_sha":"$MOCK_T4_COMMIT","event":"push","head_branch":"v1.2.3","status":"completed","conclusion":"failure","updated_at":"2020-01-01T00:00:00Z"}, - {"name":"Deploy project site","path":"$t4_site_path","head_sha":"$MOCK_T4_COMMIT","event":"workflow_dispatch","head_branch":"v1.2.3","status":"completed","conclusion":"failure","updated_at":"2020-01-01T00:00:00Z"} + {"name":"Deploy project site v1.2.3 mock-dispatch","path":"$t4_site_path","head_sha":"$MOCK_T4_COMMIT","event":"workflow_dispatch","head_branch":"v1.2.3","status":"completed","conclusion":"failure","updated_at":"2020-01-01T00:00:00Z"} ]} JSON elif [[ \${MOCK_WORKFLOWS_ACTIVE:-0} == 1 ]]; then @@ -265,7 +265,7 @@ JSON {"workflow_runs":[ {"name":"CI","path":"$t4_ci_path","head_sha":"$MOCK_T4_COMMIT","event":"push","head_branch":"main","status":"in_progress","conclusion":null,"updated_at":"$mock_workflow_updated_at"}, {"name":"Release app builds","path":"$t4_release_path","head_sha":"$MOCK_T4_COMMIT","event":"push","head_branch":"v1.2.3","status":"queued","conclusion":null,"updated_at":"$mock_workflow_updated_at"}, - {"name":"Deploy project site","path":"$t4_site_path","head_sha":"$MOCK_T4_COMMIT","event":"workflow_dispatch","head_branch":"v1.2.3","status":"queued","conclusion":null,"updated_at":"$mock_workflow_updated_at"} + {"name":"Deploy project site v1.2.3 mock-dispatch","path":"$t4_site_path","head_sha":"$MOCK_T4_COMMIT","event":"workflow_dispatch","head_branch":"v1.2.3","status":"queued","conclusion":null,"updated_at":"$mock_workflow_updated_at"} ]} JSON else @@ -273,7 +273,7 @@ JSON {"workflow_runs":[ {"name":"CI","path":"$t4_ci_path","head_sha":"$MOCK_T4_COMMIT","event":"push","head_branch":"main","status":"completed","conclusion":"success","updated_at":"$mock_workflow_updated_at"}, {"name":"Release app builds","path":"$t4_release_path","head_sha":"$MOCK_T4_COMMIT","event":"push","head_branch":"v1.2.3","status":"completed","conclusion":"success","updated_at":"$mock_workflow_updated_at"}, - {"name":"Deploy project site","path":"$t4_site_path","head_sha":"$MOCK_T4_COMMIT","event":"workflow_dispatch","head_branch":"v1.2.3","status":"completed","conclusion":"success","updated_at":"$mock_workflow_updated_at"} + {"name":"Deploy project site v1.2.3 mock-dispatch","path":"$t4_site_path","head_sha":"$MOCK_T4_COMMIT","event":"workflow_dispatch","head_branch":"v1.2.3","status":"completed","conclusion":"success","updated_at":"$mock_workflow_updated_at"} ]} JSON fi