Wire sha-exempt allowlist into validate + bump workflows#2233
Draft
tobinsouth wants to merge 2 commits into
Draft
Wire sha-exempt allowlist into validate + bump workflows#2233tobinsouth wants to merge 2 commits into
tobinsouth wants to merge 2 commits into
Conversation
Adds the sha-exempt input (claude-plugins-community#47) to both workflows, with an initially empty list: - validate-plugins.yml: names listed here may omit source.sha (invariant I5) instead of failing CI repo-wide - bump-plugin-shas.yml: the same names are skipped by the nightly bump so it does not re-pin a deliberately unpinned entry Action pins bumped to the commit introducing the input. Neither action changed otherwise between the old pins and this one. Empty lists mean no behavior change until a name is added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Hardcoded allowlist for plugins that may omit
source.sha(invariant I5), wired into both workflows. List starts empty — zero behavior change until a name is added.validate-plugins.yml:sha-exemptnames skip the I5 hard error (a present-but-malformed sha still fails)bump-plugin-shas.yml: the same names are skipped by the nightly bump — otherwise an unpinned entry looks permanently stale and gets re-pinned, undoing the exemptionTo exempt a plugin: add its name to both
sha-exemptlists (space-separated). Comments at each site say so.Why
I5 is a hard error here, so an entry that intentionally tracks a branch (how
nvidia-skillsarrived in #2088) breaksvalidatefor every PR with no escape hatch short of demoting I5 to a warning for all entries.Depends on
2324c6d8). Before marking ready: merge #47, then repoint bothuses:pins to the resulting merge commit onmain(the branch SHA may become unreachable after branch deletion).Verified the pin bumps are otherwise clean:
git log <old-pin>..main -- .github/actions/{validate-plugins,bump-plugin-shas}/is empty for both old pins, so only the sha-exempt change rides along.After merge
Add names as needed, e.g.
sha-exempt: "some-plugin other-plugin"in both files.