From e8e97979634bbd388bbd399ecf4aa153d461a600 Mon Sep 17 00:00:00 2001 From: "Nabheet S. Sandhu" Date: Sat, 31 Oct 2026 18:48:18 -0600 Subject: [PATCH] ci: read the guard's inert list from the base revision MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The guard normalised `package.json` on both sides with the inert devDependency list from the commit under test, so a PR could add a dependency to that list and skip the release the dependency was meant to cut — `.github/**` is non-shipping, so the workflow change never counted either. The literal stays in the file: it is the list this commit publishes under, and the next run reads it from the base. This run reads the base copy instead, so an entry only takes effect after it has landed through review. A base with no literal (guard newly added) yields [], which treats every devDependency change as shipping — the fail-closed direction. --- .github/workflows/ci.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4760d1f..aae1d7b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -178,6 +178,18 @@ jobs: # jq -S normalises key order; on any error (e.g. package.json absent # on one side) treat it as shipping. INERT_DEVDEPS='["@biomejs/biome","markdownlint-cli2"]' + + # The literal above is the list this commit publishes under. The guard + # compares against the copy on the base revision instead, so a PR that + # adds a dependency to the list cannot skip that dependency's own + # release — the entry has to land through review first. No literal on + # the base (guard newly added) means everything ships, the + # fail-closed direction. + INERT_DEVDEPS="$(git show "${BASE}:.github/workflows/ci.yml" 2>/dev/null \ + | sed -n "s/^[[:space:]]*INERT_DEVDEPS='\(.*\)'[[:space:]]*$/\1/p" \ + | head -n1 || true)" + [ -n "$INERT_DEVDEPS" ] || INERT_DEVDEPS='[]' + pkg_shipping_changed() { local before after # Single quotes are deliberate: $inert/$k are jq variables, not