docs: correct the README's stale claims and document the staging workflow - #20
Open
LKSNDRTMLKV wants to merge 4 commits into
Open
docs: correct the README's stale claims and document the staging workflow#20LKSNDRTMLKV wants to merge 4 commits into
LKSNDRTMLKV wants to merge 4 commits into
Conversation
…and document the staging workflow and CI gates
…ed design section
Deploying odal-node-docs with
|
| Latest commit: |
5a6a51c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://279f6128.odal-node-docs.pages.dev |
| Branch Preview URL: | https://docs-readme-workflow.odal-node-docs.pages.dev |
Deploying odal-node-landing with
|
| Latest commit: |
5a6a51c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://94f08670.odal-node-landing.pages.dev |
| Branch Preview URL: | https://docs-readme-workflow.odal-node-landing.pages.dev |
A floating tag is mutable. Whoever controls the action repository can repoint v4 at new code, which then runs with whatever permissions the job holds. sync-openapi.yml holds contents: write and pull-requests: write, so it is the highest-value job here to pin — but ci.yml is pinned too, since a compromised action in a read-only job still sees the runner. Pins are v7 rather than the current v4 tip, for two reasons. dpp-engine already pins actions/checkout at 3d3c42e5, the same commit v7 resolves to, so the two public repos now reference an identical SHA rather than merely matching in style. And because a pinned SHA never moves, pinning v4's tip would freeze this repo on a maintenance line permanently; freezing on the current line is the better resting place. The majors were checked against what these workflows actually do, not assumed. checkout still defaults persist-credentials to true, and v6's move of those credentials into a file under RUNNER_TEMP leaves git push working unchanged — which sync-openapi.yml depends on when it pushes its branch; that change's one caveat, Docker container actions, applies to neither workflow. v7's new fork-PR block only affects pull_request_target and workflow_run, and neither is a trigger here. setup-node's v5/v6 automatic caching only ever applies to npm, and both jobs already pass cache: pnpm explicitly with corepack enable ordered ahead of it. deploy.yml needed no change: it uses no actions, only run steps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #19. The README describes a repository that no longer exists in several places, and one of those descriptions asserts a capability the tool has never had.
The claim that mattered
It is not a broken-link check and never was. A markdown link target is an opaque string to
astro check, which is precisely why four[Licensing](/engine/licensing)links passed it and 404'd in production. A contributor reading this would reasonably believe links were covered, and stop looking — the same trap as a comment that describes a guard the code does not implement.Corrected, and the four gates CI actually runs are now listed with what each one does.
Stale after recent work
public/brand/directory that no longer exists — its copy step was publishing a duplicate favicon at a path nothing referenced — and omittedscripts/, which now holds two of the gates.build+check. It runs six steps.main, which the new ruleset forbids.Adds what was undocumented
stagingexists andmainis protected, and nothing in the repository said so. A contributor's first instinct is to branch offmainand open a pull request against it — which now fails at the ruleset rather than at review. There is a short section describing the flow: work branches offstaging, promotion is a separatestaging→mainpull request, andmainrequires a pull request, squash-only merges, passing CI, and permits no bypass for anyone.The Status section also now records what the audit found, in a sentence rather than a list, without pointing at the register — that lives in a private repository and public artefacts stay self-contained.
Verification: build green · 828 links resolve · leakage clean.