fix(watchdog): check that a rebuild is actually triggered, not just that a mirror builds - #14
Merged
Merged
Conversation
…hat a mirror builds Tagging generoi/gds-mcp v0.6.3 did not make it installable. Nothing in that repo calls update.yml, so the index only picked the tag up on the 3h cron; until then `composer update` printed "Nothing to modify in lock file" and exited 0 against a stale index. Read downstream as "already up to date". The watchdog could not have caught it, for two reasons: 1. `MANUAL` exempted gds-mcp from check 1. That is right for "no Build workflow" — it is hand-released, not a mirror — but it also meant nothing ever asked whether a release triggers a rebuild. Four of the seven MANUAL packages had no trigger at all: gds-mcp, gds-block-animations, gds-content-translation, gravityforms-elisadesk. 2. Check 5 read `.github/workflows/build.yml` and nothing else. Every hand-released package puts the call in release.yml, so the packages whose only rebuild trigger is this hook were the ones it never looked at — gds-assistant, b2b-roles and gravityforms-altcha were all skipped. Adds check 6 (NO_REBUILD_HOOK, info) over every non-archived satis package, MANUAL included, and rewrites the lookup to scan all workflow files. Also drops the raw media type in favour of `.content` + base64. The raw Accept header does not reliably return raw bytes across gh versions; when it returns JSON instead, the grep matches nothing and every repo silently looks unhooked — the same false-negative shape as the bug being fixed. An audit of all 72 vcs packages puts the current state at 63 hooked, 9 not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
Tagging
generoi/gds-mcpv0.6.3 did not make it installable. Nothing in that repo callsupdate.yml, so the index only picked the tag up on the 3h cron. Until then:Composer exits 0 against a stale index, so downstream this reads as "already up to date" rather than as a failure. The mirror had to be rebuilt by hand.
Why the watchdog could not have caught it
1. The
MANUALexemption was doing more than it looked like. It exempts hand-released packages from check 1 ("no Build workflow"), which is correct — they aren't mirrors. But nothing then asked whether a release triggers a rebuild. Four of the sevenMANUALpackages had no trigger at all:gds-assistant(release.yml)gds-mcpb2b-roles(release.yml)gds-block-animationsgravityforms-altcha(release.yml)gds-content-translationgravityforms-elisadeskThese need a trigger more than the mirrors do: a mirror is bumped daily by its updater, whereas a hand-tagged package moves only when someone tags it.
2. Check 5 hardcoded
build.yml:Every hand-released package puts the call in
release.yml, so the three packages whose only rebuild trigger is this hook were silently skipped by the check meant to verify it works.Changes
NO_REBUILD_HOOKover every non-archived satis package,MANUALincluded. Severityinfo: the 3h cron still indexes the tag, so it costs latency, not correctness.hook_workflow()scans every file in.github/workflowsinstead of guessing a filename..content+ base64 instead of the raw media type. The rawAcceptheader does not reliably return raw bytes acrossghversions; when it returns JSON instead, the grep matches nothing and every repo silently looks unhooked — the same false-negative shape as the bug being fixed. This one bit me while auditing: my first pass using the raw header reportedgds-assistantas unhooked when itsrelease.ymlplainly carries the call.active.txt, reused by checks 5–6 rather than re-querying archived state.MANUALexempts check 1 only.Verification
hook_workflow()was extracted verbatim and run against repos with known answers:gds-assistant→release.ymlis precisely the case the old check missed. YAML parses and the step list is unchanged; the extracted run-block passesbash -n.Current state of the fleet
A full audit of all 72
type: vcspackages: 63 hooked, 9 not.build.yml, never had the step (2) —qliro-one-for-woocommerce,wb-paytrail-maksutavatfilebird-pro,gf-pardot-pro,wp-mail-smtp-pro; already reported by check 1Once those merge, check 6 should report only the last two groups.
Note
I could not read the
PACKAGIST_UPDATE_PATallow-list myself (403 — needsadmin:org), so I can't say which of the 63 hooked repos actually get instant rebuilds. The watchdog's app token can read it; this PR makes that check cover the hand-released packages for the first time.🤖 Generated with Claude Code