SDK nightly (pkg.pr.new) #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SDK nightly (pkg.pr.new) | |
| # Tracks the latest DXOS `main` build so the monorepo keeps pace with the SDK. Opens/updates a | |
| # single "SDK upgrade" PR pointing the `dxos` catalog at the latest pkg.pr.new build. These pins | |
| # may merge to `main` (keeps CI building against the latest SDK), but the release workflow refuses | |
| # to publish against a pkg.pr.new pin — a published npm SDK release goes through `sdk-npm-release`. | |
| # | |
| # The PR branch is fixed (`sdk-upgrade`), so a PR that has not landed is re-pinned to the newest SDK | |
| # each night rather than accumulating a queue of stale PRs — whenever it does land, it lands current. | |
| on: | |
| schedule: | |
| - cron: '0 7 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| upgrade: | |
| runs-on: ubuntu-latest | |
| env: | |
| # Exposed so a step condition can branch on token presence: secrets are not allowed in `if:`. | |
| GH_DXOS_BOT_PAT: ${{ secrets.GH_DXOS_BOT_PAT }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Seven characters exactly: pkg.pr.new emits 7-char SHAs in the @dxos/* cross-package | |
| # dependency URLs, and pnpm keys resolutions on the literal URL — a longer pin resolves | |
| # to the same build but installs a second, duplicate copy of the whole SDK. | |
| - name: Resolve latest dxos main commit | |
| id: sha | |
| run: echo "sha=$(git ls-remote https://github.com/dxos/dxos.git refs/heads/main | cut -c1-7)" >> "$GITHUB_OUTPUT" | |
| # The catalog is repinned before installing, so setup only provisions the toolchain here. | |
| - uses: ./.github/actions/setup | |
| with: | |
| install: 'false' | |
| - name: Point the dxos catalog at the latest pkg.pr.new build | |
| run: node scripts/set-sdk.mjs pkg-pr-new ${{ steps.sha.outputs.sha }} | |
| # Repinning the catalog invalidates the lockfile by design, so this cannot be frozen. | |
| - run: pnpm install --no-frozen-lockfile | |
| # Smoke both artifacts against the repinned SDK — the library and the composerPlugin bundle | |
| # break in different ways. | |
| - run: moon run :build :bundle | |
| # A PR opened with the default GITHUB_TOKEN does not trigger workflows — GitHub suppresses | |
| # those events to prevent recursion — so `check.yml` never runs on it and auto-merge waits | |
| # forever on checks that never arrive. Authoring as a PAT/App identity makes the | |
| # `pull_request` event fire normally. | |
| - name: Warn when the bot PAT is missing | |
| if: ${{ env.GH_DXOS_BOT_PAT == '' }} | |
| run: | | |
| echo "::warning::GH_DXOS_BOT_PAT is not set; the PR is authored by github-actions[bot], so no" \ | |
| "checks run on it and auto-merge can never fire. See RELEASING.md." | |
| - name: Open/update the SDK upgrade PR | |
| id: pr | |
| uses: peter-evans/create-pull-request@v6 | |
| with: | |
| token: ${{ secrets.GH_DXOS_BOT_PAT || secrets.GITHUB_TOKEN }} | |
| branch: sdk-upgrade | |
| commit-message: 'chore(sdk): track dxos/main@${{ steps.sha.outputs.sha }}' | |
| title: 'chore(sdk): track dxos/main@${{ steps.sha.outputs.sha }}' | |
| body: | | |
| Nightly SDK tracking — points the `dxos` catalog at the latest dxos `main` build on | |
| pkg.pr.new and rebuilds every plugin. | |
| **Not releasable:** the release workflow refuses to publish while the catalog is a | |
| pkg.pr.new pin. Merging keeps `main` building against the latest SDK; publish a real | |
| release via the **SDK npm release** workflow once DXOS cuts an npm version. | |
| Auto-merge is enabled — this lands on its own once CI is green. | |
| # The diff is 21 identical URL substitutions plus a lockfile, which is exactly the review a | |
| # human rubber-stamps. `main` never publishes and the release guard blocks releasing from a | |
| # pkg.pr.new pin, so the worst case is a rolling pin that the next nightly replaces. | |
| # Requires `allow_auto_merge` on the repository and a required status check on `main`; | |
| # without a required check GitHub merges immediately rather than waiting for CI. | |
| - name: Enable auto-merge | |
| if: steps.pr.outputs.pull-request-number | |
| env: | |
| GH_TOKEN: ${{ secrets.GH_DXOS_BOT_PAT || secrets.GITHUB_TOKEN }} | |
| run: gh pr merge --auto --squash "${{ steps.pr.outputs.pull-request-number }}" | |
| # A silent nightly failure is the hazard this workflow exists to prevent: tracking stops, and | |
| # the pinned pkg.pr.new artifacts age toward expiry until `main` no longer installs. The action | |
| # skips when no webhook is configured. | |
| - name: Notify on failure | |
| if: failure() | |
| uses: ./.github/actions/notify | |
| with: | |
| webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }} | |
| content: | | |
| **SDK nightly failed** — `${{ github.repository }}` | |
| Tracking `dxos/dxos@${{ steps.sha.outputs.sha }}`. | |
| ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| A failure here stops SDK tracking. pkg.pr.new artifacts expire (~1-6 months), so a pin | |
| left unattended eventually stops installing. If `pnpm install` was the failing step, the | |
| external catalog has most likely drifted from what the pinned SDK resolves — see | |
| "External deps the SDK also resolves" in RELEASING.md. |