Repository navigation
chore: add hk pre-push config and pin the Test runner (RIG-9272) - #10
Merged
mattwilkinsonn merged 9 commits intoNov 11, 2026
Conversation
The tag publisher now packs @rigelbuild/solid-virtual once, uploads the tarball and a SHA256SUMS file as a workflow artifact, and attaches both to a GitHub Release for the same vX.Y.Z-rigel.N tag. The release job runs only after the npm publish succeeds, so an asset never exists for an unpublished version. The packed tarball is the one npm received, with workspace:* already rewritten to the real virtual-core version. Co-authored-by: Matt Wilkinson <matt@rigel.build>
Add a minimal hk pre-push step that parses the tag publisher workflow with yq. It mirrors the devenv release-workflow check so a malformed publisher is caught before push. Co-authored-by: Matt Wilkinson <matt@rigel.build>
🚀 Changeset Version PreviewNo changeset entries found. Merging this PR will not cause a version bump for any packages. |
The tarball is packed before npm publish, uploaded as an artifact, and that exact file is published. The GitHub Release asset is then the npm tarball byte for byte, and a failure after npm accepts the version leaves the asset to attach. The contract test now asserts pack, upload, then publish order, a single contents: write held by the release job, and --verify-tag. The hook runs the node contract tests over the workflow and script globs. The header comment names the release job. Co-authored-by: Matt Wilkinson <matt@rigel.build>
The contract test stores the pack, upload, and publish indexes and asserts each is found before comparing order, so a deleted or renamed step fails the test. The contents: write count is null-safe. The upload comment now states only what the ordering guarantees: the asset is the file npm receives, and no step runs after publish. Co-authored-by: Matt Wilkinson <matt@rigel.build>
Collaborator
Author
Wrap the verify-tag assertion as prettier 3.7 formats it, so the autofix job stops rewriting .github/. Co-authored-by: Matt Wilkinson <matt@rigel.build>
2 of 4 tasks
Matt ruled on RIG-9386: @rigelbuild/solid-virtual stays an npm dependency, with no flake pin and no release asset. This restores the publisher and its contract test to rigel-release, so this PR carries only hk.pkl. Refs RIG-9386 Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
changed the title
Co-authored-by: Matt Wilkinson <matt@rigel.build>
The ubuntu-latest image moved to 26.04, which Playwright does not support for chromium. The Test job fails at browser install on every PR. Pinning the runner keeps the Test job on a supported image until Playwright catches up. Stacked on virtual#10 (RIG-9272 chain) so the hk pre-push gate sees hk.pkl. Refs RIG-9206 Co-authored-by: Matt Wilkinson <matt@rigel.build>
2 of 4 tasks
rigel-mintaka
changed the title
…RIG-9272) A pre-push hook in a linked worktree exports GIT_DIR. Both fork release test scripts spread process.env into every child git call, so their scratch-repo writes landed in the real repo. Build one child env with GIT_DIR, GIT_WORK_TREE, GIT_INDEX_FILE, and GIT_COMMON_DIR removed, and pass it to every spawn. Add a sentinel regression test that fails without the scrub. Set hk default_branch to origin/rigel-release. The local rigel-release branch does not exist in a worktree, so hk fell back to an empty-tree base. Refs RIG-9272 Co-authored-by: Matt Wilkinson <matt@rigel.build>
Collaborator
Author
rigel-mintaka
marked this pull request as ready for review
November 11, 2026 08:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Changes
Three CI changes for the fork.
1. Hk pre-push config (
hk.pkl). The pre-push hook runs the fork release contract tests before push.default_branchis noworigin/rigel-release. The localrigel-releasebranch does not exist in a worktree, so the old value fell back to an empty-tree base.2. Hook git isolation (
.github/scripts/*.test.mjs). A pre-push hook in a linked worktree exportsGIT_DIR. The test scripts passedprocess.envto every childgit, so scratch-repo writes reached the real repo. Both files now build one child env withGIT_DIR,GIT_WORK_TREE,GIT_INDEX_FILE, andGIT_COMMON_DIRremoved. A regression test pointsGIT_DIRat a sentinel repo and asserts its refs are unchanged. It fails without the scrub.3. Test runner pin, RIG-9206 (
.github/workflows/pr.yml). TheTestjob runs onubuntu-24.04.ubuntu-latestnow resolves to an image Playwright does not support for chromium, soplaywright install chromiumfailed on every PR.Why only
Testis pinned.Testis the only PR-gate job that installs chromium.preview,provenance,version-preview, andCIdo not run Playwright.release.ymlandpublish-rigelbuild.ymlalso install chromium onubuntu-latest. This PR does not change them, so they keep the same exposure.✅ Checklist
pnpm run test:pr. Both test scripts pass on a VM with the fixed tree; CI is the verification for theTestjob.🚀 Release Impact
Spec-impact: none
Refs RIG-9272
Co-authored-by: Matt Wilkinson matt@rigel.build