From 16d7ddf991082c8d3d39948e1f0b69f3aab801d3 Mon Sep 17 00:00:00 2001 From: panicboat Date: Sat, 31 Oct 2026 10:34:32 +0900 Subject: [PATCH] feat!: drop the config-path input and fail on pull request lookup errors No caller passes config-path, and the release workflows always read the default path, so setting it would split the flows onto different files. Ignoring lookup errors made a GitHub API failure skip the label resolver and report success with no apply on main. The backend output has no reader. Claude-Session: https://claude.ai/code/session_01N1XYRqYewzhQfyJcM9zFjG Signed-off-by: panicboat --- .../internal--claude-code-action.yaml | 5 ----- ...usable--label-base-deploy--dispatcher.yaml | 7 ------- ...reusable--label-base-deploy--resolver.yaml | 7 ------- scripts/workflows/test.sh | 19 +++++++++++++++++++ 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/internal--claude-code-action.yaml b/.github/workflows/internal--claude-code-action.yaml index 23e0f9e..b6aeebe 100644 --- a/.github/workflows/internal--claude-code-action.yaml +++ b/.github/workflows/internal--claude-code-action.yaml @@ -74,9 +74,6 @@ on: passed: description: 'Verdict of a docs-sync run' value: ${{ jobs.claude.outputs.passed }} - backend: - description: 'Backend that produced the output (subscription or bedrock)' - value: ${{ jobs.claude.outputs.backend }} jobs: claude: @@ -92,7 +89,6 @@ jobs: outputs: body: ${{ steps.check.outputs.body }} passed: ${{ steps.check.outputs.passed }} - backend: ${{ steps.check.outputs.backend }} steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -297,7 +293,6 @@ jobs: backend=bedrock output="$BEDROCK_OUTPUT" fi - echo "backend=${backend}" >> "$GITHUB_OUTPUT" if verdict="$(STRUCTURED_OUTPUT="$output" bash .shared-workflows/scripts/review-output/check.sh "$OUTPUT_KIND")"; then body="$(jq -r '.body' <<<"$verdict")" if [ "$backend" = "bedrock" ]; then diff --git a/.github/workflows/reusable--label-base-deploy--dispatcher.yaml b/.github/workflows/reusable--label-base-deploy--dispatcher.yaml index e54a38f..547a6d9 100644 --- a/.github/workflows/reusable--label-base-deploy--dispatcher.yaml +++ b/.github/workflows/reusable--label-base-deploy--dispatcher.yaml @@ -8,11 +8,6 @@ on: required: true type: string description: 'GitHub App ID for authentication' - config-path: - required: false - type: string - default: 'workflow-config.yaml' - description: 'Path to the workflow config that maps stack paths to services' secrets: private-key: required: true @@ -38,7 +33,6 @@ jobs: with: github-token: ${{ steps.app-token.outputs.token }} state: all - continue-on-error: true - name: Dispatch Labels uses: panicboat/deploy-actions/label-dispatcher@9c5aea836b982c12d283c4bea8fac965d7242eda # v0.1.0 @@ -46,4 +40,3 @@ jobs: pr-number: ${{ steps.pr-info.outputs.number }} repository: ${{ github.repository }} github-token: ${{ steps.app-token.outputs.token }} - config-path: ${{ inputs.config-path }} diff --git a/.github/workflows/reusable--label-base-deploy--resolver.yaml b/.github/workflows/reusable--label-base-deploy--resolver.yaml index f3c82c4..c50621a 100644 --- a/.github/workflows/reusable--label-base-deploy--resolver.yaml +++ b/.github/workflows/reusable--label-base-deploy--resolver.yaml @@ -8,11 +8,6 @@ on: required: true type: string description: 'GitHub App ID for authentication' - config-path: - required: false - type: string - default: 'workflow-config.yaml' - description: 'Path to the workflow config that defines the stacks and services' secrets: private-key: required: true @@ -43,7 +38,6 @@ jobs: with: github-token: ${{ steps.app-token.outputs.token }} state: all - continue-on-error: true # Flux pushes image updates to main with no pull request, and the action rejects an empty pr-number. - name: Label Resolver @@ -54,7 +48,6 @@ jobs: repository: ${{ github.repository }} pr-number: ${{ steps.pr-info.outputs.number }} github-token: ${{ steps.app-token.outputs.token }} - config-path: ${{ inputs.config-path }} deploy-terragrunt: name: 'Deploy Terragrunt (${{ matrix.target.service }}:${{ matrix.target.environment }})' diff --git a/scripts/workflows/test.sh b/scripts/workflows/test.sh index 39c61e7..1d035bb 100755 --- a/scripts/workflows/test.sh +++ b/scripts/workflows/test.sh @@ -115,6 +115,25 @@ test_renovate_keeps_production_out_of_automerge() { assert_eq "production" "$(jq -r '[.packageRules[] | select(.automerge != null)] | last | if (.matchFileNames // [] | index("**/production/**")) != null then "production" else "other" end' "${repo_root}/default.json")" } +test_label_base_deploy_fails_when_the_pull_request_lookup_fails() { + local name + for name in dispatcher resolver; do + assert_eq "null" "$(yq '.jobs[].steps[] | select(.id == "pr-info") | .continue-on-error' "${workflows_dir}/reusable--label-base-deploy--${name}.yaml")" + done +} + +test_label_base_deploy_reads_the_default_config_path() { + local name + for name in dispatcher resolver; do + assert_eq "null" "$(yq '.on.workflow_call.inputs["config-path"]' "${workflows_dir}/reusable--label-base-deploy--${name}.yaml")" + done +} + +test_claude_job_does_not_expose_the_backend() { + assert_eq "null" "$(yq '.on.workflow_call.outputs.backend' "${claude_workflow}")" + assert_eq "null" "$(yq '.jobs.claude.outputs.backend' "${claude_workflow}")" +} + test_workflows_do_not_read_apply_trigger() { assert_eq "" "$(grep -rl --exclude='*test.sh' 'apply_trigger\|validate-apply-trigger' "${workflows_dir}" "${repo_root}/scripts" || true)" }