feat(ci): workflow_dispatch + --force, rewire dead dispatches#73
Merged
Conversation
Adds an on-demand rebuild surface to ci.yml and rewires the stale dispatch glue that PR #60 (legacy workflow cutover) left hanging. ci.yml - New `workflow_dispatch` trigger with a `force: boolean` input. Defaults to false; a force=true dispatch skips the spec-hash cache-probe in every pipeline cell so security-class rebuilds produce fresh artifacts even when the inputs are unchanged. - `pipeline` cell threads `inputs.force` into `make ci-cell` via a FORCE env var so the downstream phpup gets --force. internal/build + Makefile - phpOpts / extOpts / cellOpts grow a Force field; each parse* FlagSet exposes --force. - BuildPHP and BuildExt bypass the LookupBySpec cache-probe when opts.Force is set, printing a "--force, skipping cache-probe" note so the pipeline log is obvious about why the build ran. - BuildCell forwards --force to both downstream BuildPHP and each BuildExt so a cell invocation does the right thing end-to-end. - `make ci-cell FORCE=1` threads through to the CLI. - Unit test: TestBuildPHP_Force_BypassesCacheHit seeds a layout with an identically-spec-hashed bundle, invokes BuildPHP with --force, asserts the runner was called and no "cache hit" line hit stdout. Closes the gap that the plain cache-hit test left. security-rebuild.yml - Pre-existing: `uses: ./.github/workflows/plan-and-build.yml` — but that file was deleted in PR #60, so any dispatch failed at parse-time. Replaced with a single actions/github-script@v7 step that calls actions.createWorkflowDispatch against ci.yml with force=true. Preserves the `repository_dispatch: [security- rebuild]` public entry point. watch-*.yml - Both workflows previously emitted peter-evans/repository-dispatch events (`php-release-detected`, `runner-image-updated`) that no workflow listened for — a silent no-op. Swap both steps to actions/github-script workflow_dispatch calls against ci.yml (force=false — a new upstream signal doesn't by itself invalidate existing bundles; catalog updates land separately). - watch-runner-images.yml also pulls the github token out of the run: block into an env var to quiet the workflow-injection pre-commit guard. The force ergonomics split intentionally: - routine main push + nightly observer poll: no force; pipeline short-circuits unchanged cells via the existing spec-hash probe. - manual "gh workflow run ci.yml -f force=true" + security-rebuild dispatch: force=true rebuilds everything. Verification: make check green; 15/15 Node tests; all 21 Go packages pass. The new TestBuildPHP_Force_BypassesCacheHit fails as expected if the --force conditional is reverted to the old unconditional cache-probe, and passes with the new branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Option B of the post-unification cleanup. Two intertwined changes:
1.
ci.ymlgets an on-demand rebuild surfaceworkflow_dispatchtrigger with aforce: booleaninput (defaults to false).pipelinecells threadinputs.forceintomake ci-cellvia a newFORCEenv var.internal/build:phpup build php|ext|celllearns a--forceflag. When set, the spec-hashLookupBySpeccache-probe is skipped, so every bundle is rebuilt from source even when a matching artifact is already in the target registry.TestBuildPHP_Force_BypassesCacheHitseeds a layout with an identically-spec-hashed bundle, asserts--forcestill invokes the runner.2. Rewire the dead dispatch glue that PR #60 left behind
security-rebuild.ymlpreviously referenced./.github/workflows/plan-and-build.yml, which PR feat(ci): cut over to unified ci.yml, delete legacy workflows (PR 5/6) #60 deleted. Any dispatch failed at parse-time. Now it callsactions.createWorkflowDispatch({workflow_id: 'ci.yml', inputs: { force: 'true' }})viaactions/github-script@v7. Keeps therepository_dispatch: [security-rebuild]entry point.watch-php-releases.yml+watch-runner-images.ymlused to firepeter-evans/repository-dispatch@v4events (php-release-detected,runner-image-updated) that no workflow was listening for. Both now dispatchci.ymlwithforce: false— the.state/commit is still the canonical observer signal, and a routine re-run ofci.ymlon the latest main surfaces any drift without doing the expensive full-rebuild thatforce: trueimplies.Force ergonomics, split intentionally
forcepushto main (normal merge)pull_requestwatch-*.yml→ci.ymlfalserepository_dispatch→security-rebuild.yml→ci.ymltruegh workflow run ci.yml -f force=trueTest plan
make checkgreen locally (15 Node tests + 21 Go packages pass, new--forcetest exercises the new branch)workflow_dispatchaddition is a trigger-surface change, not a behavior change for PRs/pushes — existing matrix should still be fully green)gh workflow run ci.yml -f force=true --ref mainshows up in Actions UI with the newforcetoggle; confirm the pipeline logs showphpup build php: --force, skipping cache-probeon each cell.gh api repos/buildrush/setup-php/dispatches -f event_type=security-rebuildafter merge; confirm it spawns aci.ymlrun withinputs.force = true.Sequenced before Option A (action-surface smoke test) per the design plan — keeps main's scheduled-rebuild posture alive while A lands.