Repository navigation
ci: check the hub contract in component CI - #657
Merged
Merged
Conversation
Private-repo PR CI now fails when a pnpm script or scripts/ file that a hub workflow calls is missing (server v1.0.5 removed smoke:backend:* and broke deploy CI), and runs ci.yml's Application-checks node:test suites (about 4s), including the production migration approval guard that would have stopped the 0034 incident. Both incidents were replayed against an assembled workspace and go red. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AsperforMias
requested review from
KurosawaGeeker and
hikariming
as code owners
November 8, 2026 15:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two production incidents this week passed private-repo PR CI and only failed later:
smoke:backend:*, which hubci.ymlstill called. Deploy CI failed and nothing deployed until hub v1.0.2.0034wasn't listed in the production approval list, so production silently skipped it.New
.github/compose/check-hub-contract.mjs, run from the assembled workspace:pnpm <script>andscripts/…path in the hub workflows resolves, honouring each step'sworking-directory.--run-tests, it also runs thenode:testsuites fromci.yml's Application checks job: 15 suites, 238 tests, about 4s. Builds stay deploy-only, so private Actions minutes stay low.Wiring:
component-ci.ymlruns it with--run-testson every private-repo PR and push. It's skipped with a notice while the latest hub release predates the script.ci.ymlruns the name check, so a hub workflow edit that calls a missing script fails on main.Verified on an assembled workspace (this branch + server
test/migration-approval-guard+ frontend main):smoke:deployment:selftestfails it.0035migration fails it, via FindAny/ghfind-server's new guard test.The runbook "Release order" paragraph and
deployment.zh.md(sections 4.3, 6 and 7) now describe the check.🤖 Generated with Claude Code