Skip to content

Commit ad81fbc

Browse files
PatrickJSPatrickJS
committed
feat(actions): add lease-aware bridge client
1 parent 22dcf4a commit ad81fbc

11 files changed

Lines changed: 440 additions & 47 deletions

File tree

‎.github/async-pipeline.lock.json‎

Lines changed: 89 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,96 @@
11
{
2-
"version": 12,
2+
"version": 13,
33
"generator": "@async/pipeline",
44
"config": "pipeline.ts",
55
"workflow": ".github/workflows/async-pipeline.yml",
6-
"hash": "sha256:245ede33a5a3112cc5fc62c901a89daa0d697469a05dadc2ca5616c16b91152e",
7-
"generatedAt": "2026-06-18T10:29:38.400Z",
6+
"hash": "sha256:abf319d10f268c900306617ae2b80e6ca98ae17ef83f30ce739c7aada6a496d9",
7+
"generatedAt": "2026-06-18T22:37:12.003Z",
8+
"actions": [
9+
{
10+
"id": "actions.cache",
11+
"uses": "actions/cache",
12+
"sha": "0057852bfaa89a56745cba8c7296529d2fc39830",
13+
"label": "v4",
14+
"ref": "actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4"
15+
},
16+
{
17+
"id": "actions.checkout",
18+
"uses": "actions/checkout",
19+
"sha": "de0fac2e4500dabe0009e67214ff5f5447ce83dd",
20+
"label": "v6.0.2",
21+
"ref": "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2"
22+
},
23+
{
24+
"id": "actions.setup-node",
25+
"uses": "actions/setup-node",
26+
"sha": "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e",
27+
"label": "v6",
28+
"ref": "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6"
29+
},
30+
{
31+
"id": "async.actions.dependabot-merge",
32+
"uses": "async/actions/dependabot-merge",
33+
"sha": "313494352cd10207bf0331c83e83364eb45c8e02",
34+
"label": "v0.1.5",
35+
"ref": "async/actions/dependabot-merge@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5"
36+
},
37+
{
38+
"id": "async.actions.pages",
39+
"uses": "async/actions/pages",
40+
"sha": "313494352cd10207bf0331c83e83364eb45c8e02",
41+
"label": "v0.1.5",
42+
"ref": "async/actions/pages@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5"
43+
},
44+
{
45+
"id": "async.actions.preview",
46+
"uses": "async/actions/preview",
47+
"sha": "313494352cd10207bf0331c83e83364eb45c8e02",
48+
"label": "v0.1.5",
49+
"ref": "async/actions/preview@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5"
50+
},
51+
{
52+
"id": "async.actions.publish",
53+
"uses": "async/actions/publish",
54+
"sha": "313494352cd10207bf0331c83e83364eb45c8e02",
55+
"label": "v0.1.5",
56+
"ref": "async/actions/publish@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5"
57+
},
58+
{
59+
"id": "async.actions.run",
60+
"uses": "async/actions/run",
61+
"sha": "313494352cd10207bf0331c83e83364eb45c8e02",
62+
"label": "v0.1.5",
63+
"ref": "async/actions/run@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5"
64+
},
65+
{
66+
"id": "async.actions.setup",
67+
"uses": "async/actions/setup",
68+
"sha": "313494352cd10207bf0331c83e83364eb45c8e02",
69+
"label": "v0.1.5",
70+
"ref": "async/actions/setup@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5"
71+
},
72+
{
73+
"id": "deno.setup",
74+
"uses": "denoland/setup-deno",
75+
"sha": "667a34cdef165d8d2b2e98dde39547c9daac7282",
76+
"label": "v2.0.4",
77+
"ref": "denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4"
78+
},
79+
{
80+
"id": "dependabot.fetch-metadata",
81+
"uses": "dependabot/fetch-metadata",
82+
"sha": "25dd0e34f4fe68f24cc83900b1fe3fe149efef98",
83+
"label": "v3.1.0",
84+
"ref": "dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0"
85+
},
86+
{
87+
"id": "pnpm.setup",
88+
"uses": "pnpm/setup",
89+
"sha": "cf03a9b516e09bc5a90f041fc26fc930c9dc631b",
90+
"label": "v1.0.0",
91+
"ref": "pnpm/setup@cf03a9b516e09bc5a90f041fc26fc930c9dc631b # v1.0.0"
92+
}
93+
],
894
"triggers": {
995
"pull_request": {
1096
"types": [

‎.github/workflows/async-pipeline.yml‎

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -62,18 +62,16 @@ jobs:
6262
run: pnpm install --frozen-lockfile
6363

6464
- name: Run pipeline task pack
65-
uses: async/actions/run@v0
65+
uses: async/actions/run@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
6666
with:
6767
command: "pnpm async-pipeline github check && pnpm async-pipeline run-task pack"
6868
check-generated: false
6969
artifact-name: async-pipeline-${{ github.job }}-pack-runs
7070
env:
7171
CI: true
72-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
73-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
7472

7573
- name: Create or update GitHub Release
76-
uses: async/actions/publish@v0
74+
uses: async/actions/publish@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
7775
with:
7876
package-path: "."
7977
mode: github-release
@@ -82,35 +80,34 @@ jobs:
8280
env:
8381
CI: true
8482
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
8683

8784
- name: Publish GitHub Packages mirror
88-
uses: async/actions/publish@v0
85+
uses: async/actions/publish@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
8986
with:
9087
package-path: "."
9188
mode: github-packages
9289
registry: "https://npm.pkg.github.com"
9390
dist-tag: "latest"
91+
token-env-name: GITHUB_TOKEN
9492
env:
9593
CI: true
9694
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
97-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
9895

9996
- name: Publish npm package
100-
uses: async/actions/publish@v0
97+
uses: async/actions/publish@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
10198
with:
10299
package-path: "."
103100
mode: npm
104101
registry: "https://registry.npmjs.org"
105102
dist-tag: "latest"
103+
token-env-name: NODE_AUTH_TOKEN
106104
provenance: true
107105
env:
108106
CI: true
109-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
110107
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
111108

112109
- name: Run release doctor
113-
uses: async/actions/publish@v0
110+
uses: async/actions/publish@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
114111
with:
115112
package-path: "."
116113
mode: doctor
@@ -119,7 +116,6 @@ jobs:
119116
env:
120117
CI: true
121118
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
122-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
123119

124120
release-doctor:
125121
name: release-doctor
@@ -148,7 +144,7 @@ jobs:
148144
run: pnpm install --frozen-lockfile
149145

150146
- name: Run release doctor
151-
uses: async/actions/publish@v0
147+
uses: async/actions/publish@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
152148
with:
153149
package-path: "."
154150
mode: doctor
@@ -185,17 +181,16 @@ jobs:
185181
run: pnpm install --frozen-lockfile
186182

187183
- name: Run pipeline task pack
188-
uses: async/actions/run@v0
184+
uses: async/actions/run@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
189185
with:
190186
command: "pnpm async-pipeline github check && pnpm async-pipeline run-task pack"
191187
check-generated: false
192188
artifact-name: async-pipeline-${{ github.job }}-pack-runs
193189
env:
194190
CI: true
195-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
196191

197192
- name: Publish main package preview
198-
uses: async/actions/preview@v0
193+
uses: async/actions/preview@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
199194
with:
200195
package-path: "."
201196
target-registry: "https://npm.pkg.github.com"
@@ -230,7 +225,7 @@ jobs:
230225
run: pnpm install --frozen-lockfile
231226

232227
- name: Run pipeline job
233-
uses: async/actions/run@v0
228+
uses: async/actions/run@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
234229
with:
235230
command: "pnpm async-pipeline github check && pnpm async-pipeline run verify"
236231
check-generated: false
@@ -269,7 +264,7 @@ jobs:
269264
run: pnpm install --frozen-lockfile
270265

271266
- name: Run package preview target
272-
uses: async/actions/run@v0
267+
uses: async/actions/run@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
273268
with:
274269
command: "pnpm async-pipeline github check && pnpm async-pipeline run-task pack"
275270
check-generated: false
@@ -278,7 +273,7 @@ jobs:
278273
CI: true
279274

280275
- name: Publish package preview
281-
uses: async/actions/preview@v0
276+
uses: async/actions/preview@313494352cd10207bf0331c83e83364eb45c8e02 # v0.1.5
282277
with:
283278
package-path: "."
284279
target-registry: "https://npm.pkg.github.com"

‎API_SURFACE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Contract: `@async/github-app.runtime`
2323

2424
| Feature | Title | Release | Stability | Lifecycle | Replacement | Docs |
2525
| --- | --- | --- | --- | --- | --- | --- |
26-
| `runtime.actions-bridge` | Actions bridge mode renders workflow YAML and pulls approved change sets with repo-local GITHUB_TOKEN receipts | public | preview | active | | [docs](https://github.com/async/github-app/blob/main/README.md) |
26+
| `runtime.actions-bridge` | Actions bridge mode renders workflow YAML and pulls approved change sets with repo-local GITHUB_TOKEN receipts, lease ids, branch-prefix checks, and allowed-path checks | public | preview | active | | [docs](https://github.com/async/github-app/blob/main/README.md) |
2727
| `runtime.auth` | Auth providers support GitHub App installation tokens, user tokens, static tokens, and Actions GITHUB_TOKEN fallback | public | preview | active | | [docs](https://github.com/async/github-app/blob/main/README.md) |
2828
| `runtime.change-set` | Change sets validate safe paths and commit upserts or deletes serially with branch, commit, PR, and index receipt metadata | public | preview | active | | [docs](https://github.com/async/github-app/blob/main/README.md) |
2929
| `runtime.content` | Content helpers map records to JSON, JSONC read-only-by-default, Markdown, and MDX file formats without schema ownership | public | preview | active | | [docs](https://github.com/async/github-app/blob/main/README.md) |

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Changelog
22

3+
## 0.1.1 - 2026-06-18
4+
5+
- Add branch-prefix, allowed-path, and pull-request controls to the Actions bridge renderer and pull command so generated workflows can scope repo writes without changing backend APIs.
6+
- Skip change sets whose metadata excludes the Actions worker, reject bridge pulls when the queued target branch is outside the configured prefix, and echo backend lease ids in bridge receipts.
7+
38
## 0.1.0 - 2026-06-17
49

510
- Initial GitHub integration package for Async.

‎README.md‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,15 @@ For organizations that cannot approve a GitHub App install, render a repo-local
130130
import { renderActionsBridgeWorkflow } from "@async/github-app/actions";
131131

132132
const yaml = renderActionsBridgeWorkflow({
133-
asyncEndpoint: "${{ vars.ASYNC_PROJECT_URL }}"
133+
asyncEndpoint: "${{ vars.ASYNC_PROJECT_URL }}",
134+
branchPrefix: "async/bridge/",
135+
allowedPathGlobs: ["pipeline.ts", "package.json", "docs/**"]
134136
});
135137
```
136138

137-
Write the result to `.github/workflows/async-github-bridge.yml` in the customer repo.
139+
Prefer `@async/pipeline` generated workflows for new repos so workflow triggers,
140+
permissions, action pins, locks, and secret routing stay centrally managed. The
141+
standalone renderer remains available for compatibility.
138142

139143
The generated workflow:
140144

@@ -143,8 +147,9 @@ The generated workflow:
143147
- requests `contents: write` and `pull-requests: write`
144148
- uses `ASYNC_PROJECT_TOKEN` plus repo-local `GITHUB_TOKEN`
145149
- pulls approved change sets from Async
150+
- enforces configured branch-prefix and allowed-path constraints
146151
- commits branches and optionally opens PRs
147-
- posts receipts back to Async
152+
- posts lease-aware receipts back to Async
148153

149154
Repo setting required for PR creation: enable “Allow GitHub Actions to create and approve pull requests”. If that is unavailable, Async can use branch-only mode and let a human open the PR.
150155

‎api-contract.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@
7272
},
7373
{
7474
"id": "runtime.actions-bridge",
75-
"title": "Actions bridge mode renders workflow YAML and pulls approved change sets with repo-local GITHUB_TOKEN receipts",
75+
"title": "Actions bridge mode renders workflow YAML and pulls approved change sets with repo-local GITHUB_TOKEN receipts, lease ids, branch-prefix checks, and allowed-path checks",
7676
"releaseTag": "public",
7777
"stability": "preview",
7878
"group": "runtime",

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@async/github-app",
3-
"version": "0.1.0",
3+
"version": "0.1.1",
44
"description": "Reusable GitHub App, webhook, Actions bridge, and content change-set helpers for Async packages.",
55
"license": "MIT",
66
"type": "module",
@@ -77,7 +77,7 @@
7777
},
7878
"devDependencies": {
7979
"@async/api-contract": "0.1.1",
80-
"@async/pipeline": "0.9.1",
80+
"@async/pipeline": "0.9.2",
8181
"@types/node": "24.12.4",
8282
"typescript": "6.0.3"
8383
}

‎pnpm-lock.yaml‎

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)