ci: checkout on Node 24, and fail when the SPM pins get dropped - #5
Merged
Conversation
actions/checkout@v4 runs on Node 20, which the runners now force onto Node 24 with a deprecation warning on every job. v7 for both workflows. release.yml keeps its SHA pin, ci.yml keeps its tag, as each already was. The second half is the trap behind the Package.resolved churn. CopyCore/Package.resolved answers to two tools: `xcodebuild` writes all three pins into it, because CopyCore is the workspace's root package and the generated .xcodeproj is gitignored, so Xcode has nowhere else to keep them; `swift test --package-path CopyCore` resolves CopyCore alone and rewrites the same file with GRDB only. Measured, it is exactly that deterministic: three pins after a build, one after the tests. So running the tests before committing drops the Sparkle and KeyboardShortcuts pins with nothing to say so, and the next release would resolve them to whatever `from:` allows. That is an unreviewed Sparkle in an app that updates itself. CI now reads the committed file before the tests touch it and fails with the command that puts the pins back. It reads the JSON rather than grepping it. The first draft grepped for `"identity" : "x"`, SwiftPM's own spacing, and went red against the same file written by any other formatter. Claude-Session: https://claude.ai/code/session_01UraqY8Ld2E3zzGVN636Lw7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small things, both found while working on the four PRs merged today.
checkout on Node 24
actions/checkout@v4targets Node 20, which the runners now force onto Node 24 and warn about on every single job. Both workflows move to v7.release.ymlkeeps its SHA pin (3d3c42e5...isv7.0.1, resolved from the API rather than typed from memory),ci.ymlkeeps its floating tag. Each file keeps the style it already had.A guard for the SPM pins
CopyCore/Package.resolvedanswers to two tools, and they disagree:xcodebuildwrites all three pins into it. CopyCore is the workspace root package and the generated.xcodeprojis gitignored, so Xcode has nowhere else to keep them.swift test --package-path CopyCoreresolves CopyCore on its own and rewrites the same file with GRDB only.Measured, and it is exactly that deterministic:
So the obvious workflow (run the tests, then
git commit -am) silently drops the Sparkle and KeyboardShortcuts pins. The next release then resolves them to whateverfrom:allows, which means an unreviewed Sparkle version in an app that updates itself. It already happened twice in the commits merged today; I caught it and reverted both.CI now reads the committed file before the tests touch it, and fails with the exact command that restores it.
The check parses the JSON with
jqrather than grepping. My first draft grepped for"identity" : "x", which is SwiftPM's own spacing, and I proved it goes red against the same content written by any other formatter. Tested three ways before pushing: committed file passes, reformatted file with all three pins passes, dropped pins fail.Not done here
This makes the trap loud; it does not remove it. Removing it means either pinning Sparkle and KeyboardShortcuts to exact versions in
project.yml, so the resolved file stops mattering for them, or giving up on committing pins for the app-level packages. Both are policy calls, so I left them for you.https://claude.ai/code/session_01UraqY8Ld2E3zzGVN636Lw7