Skip to content

ci: pin the publish default to v0.7.0, the framework the tree was built with - #2

Merged
open-coder-ai merged 1 commit into
mainfrom
ci/pin-framework-v0.7.0
Aug 31, 2026
Merged

ci: pin the publish default to v0.7.0, the framework the tree was built with#2
open-coder-ai merged 1 commit into
mainfrom
ci/pin-framework-v0.7.0

Conversation

@open-coder-ai

Copy link
Copy Markdown
Owner

publish.yml's framework_ref default sat at v0.4.0 while the published tree moved to v0.5.0, then v0.6.0, then v0.7.0 (1376438).

That inverts what a default is for. Dispatching this workflow and accepting the defaults would have rebuilt every package against a framework three releases behind what is committed here — and pushed the result. The run that looks safest was the one that would have rewritten the repository.

Why nothing caught it

generated-only compares the committed tree against the catalog's pin, not against this input. A stale default here is invisible until someone dispatches with it. Today's v0.7.0 republish came out correct only because the ref was typed by hand rather than taken from the default.

The change

One value, plus a comment. This repository carried no comment at all on this input — which is how its default drifted furthest from anyone's attention. The comment added here states what the value means: the framework the committed tree was last built with. That is the invariant, and a comment naming an invariant is harder to skip than one naming a chore.

The same change is going to all four distribution repositories, since all four were stale at v0.4.0: chock-claude-plugins, chock-cursor-plugins, chock-copilot-plugins.

Checks

  • yaml.safe_load on the patched file: framework_ref=v0.7.0, catalog_ref=main, dry_run=True — the other two inputs are unchanged.
  • Only .github/workflows/publish.yml is touched; no generated content, so generated-only is unaffected.
  • actionlint and zizmor run on this PR in CI.

Generated by Claude Code

…lt with

The default sat at v0.4.0 while the published tree moved to v0.5.0, then
v0.6.0, then v0.7.0. That inverts what a default is for: accepting it
would have rebuilt every package against a framework three releases
behind what is committed here, and pushed the result. The dispatch that
looks safest was the one that rewrote the repository.

Nothing caught it because nothing could. generated-only compares the
committed tree against the catalog's pin, not against this input, so a
stale default here is invisible until someone dispatches with it. The
v0.7.0 republish was only correct because the ref was typed by hand.

The comment above the input already said to bump this with each release.
It is restated to say what the value means -- the framework the committed
tree was last built with -- because "bump it" was followed three times by
nobody, and a rule that names the invariant is harder to skip than one
that names a chore.

cursor and codex carried no comment here at all, which is how their
defaults drifted furthest from anyone's attention; they get the same one,
so all four distributions now document the pin identically.

Signed-off-by: Claude <noreply@anthropic.com>
@open-coder-ai
open-coder-ai marked this pull request as ready for review August 31, 2026 01:26
@open-coder-ai
open-coder-ai merged commit 530f829 into main Aug 31, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants