Land update-wasm version bumps through a PR - #31
Merged
Conversation
Branch protection on main requires the DCO check, which a direct push of a brand-new commit can never satisfy: required-check enforcement needs the check to have already reported success for that exact SHA, and github-actions[bot] isn't an admin so it can't bypass it. update-wasm.yml's direct push to main was therefore rejected on every release since DCO became required (v0.22.2, v0.22.3), silently leaving the playground stranded on the prior version until someone synced it manually. Route the bump through a pull request instead — the flow branch protection is designed for. The bot commits the bump (signed off) on a per-run branch, opens a PR, waits for the DCO check-run to conclude on the PR head, then merges. DCO being green satisfies protection with no admin bypass. Deploy moves after the merge and runs from this job: a merge performed with GITHUB_TOKEN does not trigger ci.yml's push-to-main deploy, so relying on it would leave the site un-deployed. The deploy step now also fetches the book PDF so the rebuilt site isn't missing that asset. Closes #30 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Baiju Muthukadan <baiju.m.mail@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
update-wasm.ymlpushed thekaappi_versionbump straight tomain. Once the required DCO check was added to branch protection, that push became structurally impossible forgithub-actions[bot]: required-status-check enforcement needs the check to have already reported success for that exact commit SHA, which a brand-new commit can never have, andenforce_adminsisfalseso only admins bypass it. The v0.22.2 and v0.22.3 releases both failed at the push step and were synced manually (#30).Fix (issue #30, approach 1)
Route the bump through a pull request — the flow branch protection is designed for:
bot/update-wasm-<version>-<run_id>.GITHUB_TOKENdoes not triggerci.yml's push-to-main deploy. The deploy step now also runsfetch-book.shso the rebuilt site isn't missing the embedded book PDF.Notes / verification
name: DCO), not a commit status — confirmed against a recent PR — so the poll queriescheck-runsand picks the newest DCO run, empty-safe.pull-requests: write(needed to open/merge the PR); repo + org both allow Actions to create PRs.allow_auto_mergeis off on the repo, so this polls-and-merges rather than using--auto.gh-deploycommit always has an author.Closes #30
🤖 Generated with Claude Code