fix: bump reusable-build-test.yml action pins to the SK-416 merge SHA (SK-444)#8
Merged
RobEasthope merged 1 commit intoJun 26, 2026
Conversation
… (SK-444) The six Layer-1 action pins were left on the 132d746 pre-release placeholder for review consistency in SK-416 (PR #7). The build action is new in SK-416 and does not exist at 132d746, so a caller resolving the build step there fails. Bump all six pins to d0a5949 — SK-416's merge commit and the first SHA where build coexists with the other five — so the file is internally uniform and correct. reusable-lint.yml stays at 132d746 (its actions all predate the bump). The (pre-release internal pin) wording stays; SK-413's release-tag backfill supersedes these interim pins later.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe reusable build-test workflow updates the pinned SHAs for its shared action steps. Step conditions and inputs remain unchanged. ChangesReusable workflow pin refresh
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
|
Claude finished @RobEasthope's task in 40s —— View job Code Review — SK-444
Verdict: LGTM ✓ The change is exactly right. Notes below. What changedAll six Correctness
Minor notes (non-blocking)
Not in scope (acknowledged)The PR description correctly calls out that bumping consumer caller pins to the SK-444 merge SHA is a follow-up task. That split is appropriate — no caller exists yet, so nothing to bump. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
RobEasthope
deleted the
sk-444-bump-reusable-build-testyml-action-pins-to-the-sk-416-merge
branch
June 26, 2026 16:56
RobEasthope
added a commit
that referenced
this pull request
Jun 30, 2026
## What Reconstructs `shared-workflows`' **entire release history** and graduates the current code to a stable **`v1.0.0`** (A-585). The repo publishes no npm package, so a "release" here is a **git tag (`vX.Y.Z`) + GitHub release** over the reusable workflows and composite actions. ## Versioning methodology The merged PR **titles are not reliable** — Conventional-Commit discipline was loose when the repo was stood up (the GO/NO GO gate shipped as `ci:`, the versioned ruleset as `chore:`). So every PR was re-classified by **what it actually changed to the product surface** (the `reusable-*.yml` workflows + `.github/actions/*` consumers use, and their reference docs), read from the diff. Pre-1.0 rules: `feature` → minor, `fix` → patch, breaking → minor (stay in `0.x`), and `1.0.0` is a deliberate "graduate to stable" milestone. | Version | PR | True category | Headline | |---|---|---|---| | 0.1.0 | #1 | feature | bootstrap: 3 reusable workflows | | 0.2.0 | #5 | feature | Layer-1 composite-action layer | | 0.3.0 | #6 | feature | reusable-lint bundle | | 0.4.0 | #7 | feature | reusable build-test bundle + `build` action | | 0.4.1 | #8 | fix | repoint build-test pins so the build lane resolves | | 0.5.0 | #9 | feature | reusable pkg-release workflow | | 0.6.0 | #15 | refactor **(breaking)** | rename release → pkg-release | | 0.7.0 | #16 | **feature** *(titled `ci:`)* | GO/NO GO aggregator gate + docs | | 0.8.0 | #17 | **feature** *(titled `chore:`)* | versioned canonical estate ruleset | | 1.0.0 | HEAD | milestone | graduate to stable public surface | Non-release PRs (self-host CI, ADR, dep bump, SK→A rename, skill adoptions/re-syncs, check-run rename) are folded into the body of the release window they merged in — the way a release-please changelog aggregates. ## Changes - **`changelog/`** — hand-authored dated entries (one per release) + the schema doc (`changelog/README.md`), adapted from the estate's `eslint-config`/`agent-skills` convention. - **`package.json`** — `0.0.0` → `1.0.0` (stays `private`; the version is the release anchor, not an npm publish). - **`reusable-lint.yml`** — pin the five sibling Layer-1 actions to the **`v0.8.0`** tag (`@7f543be`) instead of the bare pre-release commit, so Dependabot can track them (`v0.8.0` is the latest backfilled tag that carries every action and predates this commit, avoiding a self-reference to `v1.0.0`). - **`CLAUDE.md` / `README`** — replace the "no release tag exists yet" wording. ## After merge The git tags + GitHub releases are cut once this lands: `v0.1.0`–`v0.8.0` at their historical merge commits, `v1.0.0` at this PR's squash-merge commit, with notes sourced from each `changelog/` entry. This unblocks consumers pinning a tag (+ Dependabot) instead of a moving SHA (A-420 / A-446). ## Deferred (follow-up) - **release-please automation** + a tag-only release workflow — the forward release process is a separate decision now the backfill exists. ## Note for review > Backfilling git tags at historical commits is a deliberate divergence from the estate precedent (`eslint-config`/`agent-skills` backfilled changelog *entries* but tagged only going forward) — chosen here because A-585 explicitly wants the *full tag history* reconstructed. The pre-existing Prettier drift on the vendored `.claude`/`.agents` skill bundles is untouched (out of scope). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Marked the reusable workflows and composite actions as stable at **v1.0.0**. * Updated workflow references to use the newer version tags. * **Documentation** * Clarified release and versioning guidance across the repository. * Added and expanded changelog documentation and release notes structure. * **Chores** * Updated internal workflow pins to the latest approved release. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps all six Layer-1 action
uses:pins in.github/workflows/reusable-build-test.ymlfrom the132d746pre-release placeholder tod0a5949— SK-416's merge commit (PR #7).Why
SK-416 left all six pins on
132d746for review consistency. Five of those actions (setup-project,typecheck,test-vitest,shellcheck,test-bats) already existed at132d746, but the sixth —build— is new in SK-416, so it does not exist there. A caller resolving thebuildstep against132d746fails (action not found → build lane breaks).d0a5949is the first commit wherebuildcoexists with the other five (git ls-tree d0a5949 .github/actionslists all six;buildis absent at132d746), so the file is now internally uniform and correct.reusable-lint.ymlis intentionally untouched — its actions all predate the bump, so its132d746pins are correct.The
(pre-release internal pin)wording stays; SK-413's release-tag backfill supersedes these interim pins later.Scope
This PR is part 1 of SK-444 (the in-repo fix that unblocks SK-420). Bumping the consumer caller pins is split into a follow-up issue — no
reusable-build-testcaller exists yet (the template's shared-caller swap is deferred under SK-411; the fleet rollout is SK-420). Crucially, callers must pin to the SK-444 merge SHA (where the corrected file lives), notd0a5949.Verification
grep -c d0a5949 .github/workflows/reusable-build-test.yml→ 6;grep -c 132d746→ 0reusable-lint.ymlpins unchangedCloses SK-444.
Summary by CodeRabbit