ReviewOS

also looking at this

craft-native/craft

ci: pin the pantry action to a commit

#45
Closed chris wants to merge ci/pin-pantry-action into main
7 files +35 -15
11 days ago

Every job in this repository is hung right now. Not failing — hung. All of them, Linux and macOS alike, sitting on Setup Pantry:

lint:                     Setup Pantry (provides Bun, Zig, etc.)
create-craft:             Setup Pantry (provides Bun, Zig, etc.)
ts-maps:                  Setup Pantry (provides Bun, Zig, etc.)
typescript-sdk:           Setup Pantry (provides Bun, Zig, etc.)
zig-core (ubuntu-latest): Setup Pantry (provides Bun, Zig, etc.)
zig-core (macos-latest):  Setup Pantry (provides Bun, Zig, etc.)

The earlier "6-hour hangs" on #44 that I put down to overnight infrastructure noise were this same step — GitHub killing it at the ceiling, not a slow Zig build.

One night, two outages, same action

timewhat
02:36pantry f0772d1 stops shipping packages/action/dist
02:48every craft job fails at step one — File not found: .../packages/action/dist/index.js
03:00pantry e199adab — "fix(action): ship the built action, which every workflow using it needs"
10:49every craft job hangs on Setup Pantry instead

craft can fix neither, and should not be exposed to either. This is the third time in two days an unpinned @main reference to another repository has decided whether CI here runs — zig-js was the first, this action the second and third.

The pin

All 15 references across six workflows now point at ef37fca8440cdb483fb355fefa5ae3cc6e669a69 — pantry 0.11.36, which is the revision @main resolved to for the last fully green run on main (32266347343, 14:49):

Download action repository 'pantry-pm/pantry@main' (SHA:ef37fca8440cdb483fb355fefa5ae3cc6e669a69)
pantry pantry 0.11.36 (e54f9aca2)

Not an arbitrary older commit — the one demonstrably working a few hours ago.

filerefs
ci.yml7
release.yml3
mobile-e2e.yml2
benchmarks.yml, binary-size.yml, native-lifecycle.yml1 each

Bumping it becomes a commit that names the revision, with CI proving it first. Same argument #39 made for the first-party Zig dependencies; .github/workflows/README.md now states it once for both.

Verified

All six workflows parse and keep their jobs; the pinned SHA exists upstream (chore: update arkade.dev, circleci.com, 2026-08-19T14:09Z); pickier clean.

This PR's own CI is the test — if it gets past Setup Pantry while main is still hanging, the pin is doing exactly what it is for.

7 changed files on the files tab, with 0 review threads.

Sign in to comment on this pull request.