also looking at this
ci: pin the first-party Zig dependencies to commits
#39
2 files
+62
-15
| @@ -2,32 +2,53 @@ name: First-party Zig dependencies | ||
| 2 | 2 | description: > |
| 3 | 3 | Clone the first-party Zig packages craft depends on by relative path |
| 4 | 4 | (zig-js and its zig-regex / zig-gc) into the directory build.zig.zon |
| 5 | resolves to. | |
| 5 | resolves to, at the revisions pinned in pins.env. | |
| 6 | 6 | |
| 7 | 7 | runs: |
| 8 | 8 | using: composite |
| 9 | 9 | steps: |
| 10 | 10 | # These are co-developed first-party packages, so there is no published |
| 11 | # tarball to fetch and the dependency is a relative path. The destination is | |
| 12 | # derived from that same relative path rather than hardcoded, so the two | |
| 13 | # cannot drift apart. | |
| 11 | # tarball to fetch and the dependency is a relative path — which means Zig's | |
| 12 | # package manager has no `.url` + hash to verify and nothing records which | |
| 13 | # revision a build used. | |
| 14 | 14 | # |
| 15 | # Unpinned, which is the honest cost of a path dependency: an unrelated push | |
| 16 | # to zig-js can turn a craft build red. Pinning belongs with a future | |
| 17 | # `.url` + hash dependency, which first needs zig-js to publish its own | |
| 18 | # dependencies the same way. | |
| 15 | # So the revision is recorded here instead, in pins.env. Cloning the default | |
| 16 | # branch, which this did until now, hands the question of whether craft's CI | |
| 17 | # is green to whoever last pushed to another repository. See pins.env for | |
| 18 | # what that cost and for how to bump one. | |
| 19 | 19 | # |
| 20 | 20 | # Idempotent, because several jobs call this and some run more than one |
| 21 | # build step. | |
| 21 | # build step. A checkout already at the pinned revision is left alone; one | |
| 22 | # at any other revision is replaced, so a stale cache cannot silently win. | |
| 22 | 23 | - shell: bash |
| 23 | 24 | run: | |
| 24 | 25 | set -euo pipefail |
| 26 | ||
| 27 | # shellcheck source=pins.env | |
| 28 | . "$GITHUB_ACTION_PATH/pins.env" | |
| 29 | ||
| 25 | 30 | deps="$GITHUB_WORKSPACE/packages/zig/../../../../Libraries" |
| 26 | 31 | mkdir -p "$deps" |
| 27 | for repo in zig-js zig-regex zig-gc; do | |
| 28 | if [ -d "$deps/$repo/.git" ]; then | |
| 29 | echo "$repo already present" | |
| 30 | else | |
| 31 | git clone --depth 1 "https://github.com/zig-utils/$repo" "$deps/$repo" | |
| 32 | ||
| 33 | fetch_pinned() { | |
| 34 | local repo="$1" sha="$2" dest="$deps/$1" | |
| 35 | ||
| 36 | if [ -d "$dest/.git" ] && [ "$(git -C "$dest" rev-parse HEAD)" = "$sha" ]; then | |
| 37 | echo "$repo already at $sha" | |
| 38 | return | |
| 32 | 39 | fi |
| 33 | done | |
| 40 | ||
| 41 | rm -rf "$dest" | |
| 42 | git init --quiet "$dest" | |
| 43 | git -C "$dest" remote add origin "https://github.com/zig-utils/$repo" | |
| 44 | # Fetch the one commit rather than the branch: the pin may point at | |
| 45 | # something that is no longer the tip, and --depth 1 on a branch would | |
| 46 | # not reach it. | |
| 47 | git -C "$dest" fetch --quiet --depth 1 origin "$sha" | |
| 48 | git -C "$dest" checkout --quiet FETCH_HEAD | |
| 49 | echo "$repo pinned at $sha" | |
| 50 | } | |
| 51 | ||
| 52 | fetch_pinned zig-js "$zig_js" | |
| 53 | fetch_pinned zig-regex "$zig_regex" | |
| 54 | fetch_pinned zig-gc "$zig_gc" | |
| @@ -0,0 +1,26 @@ | ||
| 1 | # Commit pins for craft's first-party Zig dependencies. | |
| 2 | # | |
| 3 | # `build.zig.zon` reaches these by relative path, so there is no `.url` + hash | |
| 4 | # for Zig's package manager to verify and nothing else records which revision a | |
| 5 | # build used. Cloning the default branch instead — which is what this action did | |
| 6 | # until now — means an unrelated push to another repository decides whether | |
| 7 | # craft's CI is green. That is not hypothetical: zig-js sized a SIMD loop by | |
| 8 | # `@sizeOf(@Vector(8, u8))`, which is 8 on aarch64 and 16 on x86_64, and every | |
| 9 | # Linux job here failed to compile for three days over it while macOS stayed | |
| 10 | # green. | |
| 11 | # | |
| 12 | # To bump one: put the new SHA here and let CI prove it. That is a reviewable | |
| 13 | # commit that says which revision changed and why, which "whatever main happened | |
| 14 | # to be at 13:32" never was. | |
| 15 | # | |
| 16 | # Local development is unaffected: developers build against their own sibling | |
| 17 | # checkouts, and this file is read only by the CI action next to it. | |
| 18 | ||
| 19 | # fix(lexer): size the SIMD identifier scan by lane count, not byte size (#625) | |
| 20 | zig_js=eba3f7cfb8b32d6d84099b10f0e063fa0e0c53c7 | |
| 21 | ||
| 22 | # fix(parser): make class-set construction failure-atomic (#20) | |
| 23 | zig_regex=cfb24da9f1dd9e759cefec7d6e1dfa094998e9d8 | |
| 24 | ||
| 25 | # refactor(heap): compare the build mode by tag name, across the Zig rename | |
| 26 | zig_gc=89b6652c81ba892119b7b9ce3b0d07fc78a009ff | |