From 4fc1a823861fc6bf4ec3d9611efdab3ca4ce40ac Mon Sep 17 00:00:00 2001 From: "Nabheet S. Sandhu" Date: Sat, 31 Oct 2026 18:47:56 -0600 Subject: [PATCH] ci: read the guard's inert list from the base revision MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The guard normalised `package.json` on both sides with the inert devDependency list from the commit under test, so a PR could add a dependency to that list and skip the release the dependency was meant to cut — `.github/**` is non-shipping, so the workflow change never counted either. The literal stays in the file: it is the list this commit publishes under, and the next run reads it from the base. This run reads the base copy instead, so an entry only takes effect after it has landed through review. A base with no literal (guard newly added) yields [], which treats every devDependency change as shipping — the fail-closed direction. --- .github/workflows/ci.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d4295d0..45f56d8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -178,6 +178,18 @@ jobs: # jq -S normalises key order; on any error (e.g. package.json absent # on one side) treat it as shipping. INERT_DEVDEPS='["@biomejs/biome","markdownlint-cli2"]' + + # The literal above is the list this commit publishes under. The guard + # compares against the copy on the base revision instead, so a PR that + # adds a dependency to the list cannot skip that dependency's own + # release — the entry has to land through review first. No literal on + # the base (guard newly added) means everything ships, the + # fail-closed direction. + INERT_DEVDEPS="$(git show "${BASE}:.github/workflows/ci.yml" 2>/dev/null \ + | sed -n "s/^[[:space:]]*INERT_DEVDEPS='\(.*\)'[[:space:]]*$/\1/p" \ + | head -n1 || true)" + [ -n "$INERT_DEVDEPS" ] || INERT_DEVDEPS='[]' + pkg_shipping_changed() { local before after # Single quotes are deliberate: $inert/$k are jq variables, not