chore(ci): every workflow step runs a just recipe - #4098
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No workflow `run:` step names a `.sh` file any more. Each script a workflow needs has a pass-through recipe under its area module (`just gh release`, `just rs package-binary`, `just swift publish`, ...), and `just gh check` enforces the rule with sh/gh/check-runs.ts. Module recipes that take paths are `[no-cd]` so relative arguments mean what they did to the script. Jobs outside the nix dev shell install just through the new .github/actions/just (taiki-e/install-action, just 1.58.0), which also replaces nightly's and android's `cargo install just`. The direnv hook test moves to the nightly `just gh test` with the other tooling self-tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
I dispatched both repo workflows from this branch with
(written by Claude Opus 5.5) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5e68f1fb7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| sh/gh/release.test.sh | ||
| python3 sh/rs/package-rename.test.py | ||
| sh/go/publish-wrapper.test.sh | ||
| .claude/hooks/direnv.test.sh |
There was a problem hiding this comment.
When the nightly gh test matrix entry reaches this command, it fails with Permission denied because .claude/hooks/direnv.test.sh is tracked as mode 100644. I reproduced the failure with nix develop --command just gh test; the previous workflow explicitly used bash, so moving the test here makes its only CI wiring fail unconditionally. Invoke it through Bash or make the file executable.
AGENTS.md reference: AGENTS.md:L23-L23
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 40524f6: the recipe runs it as bash .claude/hooks/direnv.test.sh, like the old check.yml step.
(written by Claude Opus 5.5)
| - "just gh release" | ||
| - "go/ffi/**" | ||
| - "sh/go/package-ffi.sh" | ||
| - "sh/go/publish-ffi.sh" | ||
| - "rs/moq-ffi/build.sh" | ||
| - "just go package-ffi" | ||
| - "just go publish-ffi" | ||
| - "just rs package-ffi" |
There was a problem hiding this comment.
GitHub interprets these paths entries as repository-relative glob patterns, not commands, so names such as just gh release and just go package-ffi cannot match changes to sh/gh/release.sh, sh/go/package-ffi.sh, or the relevant justfiles. Consequently, PRs changing only those release helpers no longer trigger this dry-run workflow. The same command-as-path replacement occurs in release-kt-lib.yml, release-py.yml, and release-swift-lib.yml; retain the actual source paths in all of these filters.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 40524f6: restored the real script paths in the paths: filters of release-go-ffi, release-kt-lib, release-py and release-swift-lib.
(written by Claude Opus 5.5)
| for (const [name, job] of Object.entries(workflow.jobs ?? {})) { | ||
| for (const step of job.steps ?? []) { | ||
| for (const line of step.run?.split("\n") ?? []) { | ||
| if (/\.sh\b/.test(line)) violations.push(`${path} (${name}): ${line.trim()}`); |
There was a problem hiding this comment.
When a workflow directly invokes a script with another extension, this guard still passes because it only matches .sh. There is already a concrete violation in release-brew.yml, where line 161 runs python3 ../sh/gh/install-formula.py ..., yet just gh check reports zero violations despite the new CONTRIBUTING.md rule forbidding workflow script paths. Either migrate that invocation to a recipe or make this check detect all direct script paths.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 40524f6: check-runs.ts now flags .sh, .py, .ts, .js and .mjs paths. That caught two more steps, now recipes: just gh install-formula in release-brew and just js bench in nightly.
(written by Claude Opus 5.5)
- Restore real script paths in release workflow path filters. - Run the direnv hook test through bash; it is not executable. - Flag .py/.ts/.js script paths too, and move the brew install-formula and JS broadcast benchmark steps behind recipes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 participant
Completes /quest/m1/tooling/workflows-call-just.md.
Problem
About 97 workflow
run:lines called scripts by path, so moving a script or changing its arguments meant editing up to twenty workflows. Thejustmenu wasn't the whole command surface.Approach
gh:release,alert,formula,install-formula,trigger-repo-publishrs:package-binary,package-windows,package-nfpm,package-ffi,package-libmoq,package-gst,gst-smokeswift:package-ffi,verify,verify-ffi,publish,publish-ffigo:publish-ffi,publish-wrapperdart package,obs packageandjs bench[positional-arguments]and"$@", so quoting survives. The swift/go/kt/dart/obs module recipes are[no-cd], so a relative--outputor--tarballstill resolves from the repo root. I checked thatjust go package-wrapper --output Xwrites to./X, notgo/X.$GITHUB_WORKSPACE/artifactsto the existinginfra <repo> publishrecipe, which otherwise resolvesartifactsinsideinfra/<repo>.justfor non-nix jobs (plain ubuntu, macOS and Windows runners): a new composite action.github/actions/justinstalls a checksum-verified prebuilt throughtaiki-e/install-action(SHA-pinned,just@1.58.0to match nixpkgs). It runs right after checkout in each job, and replaces nightly's and android'scargo install just@1.52.0.just gh checkrunssh/gh/check-runs.ts. It parses every workflow withBun.YAMLand fails on anyrun:line naming a.sh,.py,.ts,.jsor.mjsfile. It reads onlyrun:steps, sopaths:filters naming a script are fine. The rule is one line in a new CI section ofCONTRIBUTING.md.just gh test, with the other tooling self-tests, following the line's rule that PRs don't test the tooling itself.Impact
swift package,go package-ffi|package-wrapperandkt packageare now[no-cd]. Their callers were workflows running from the repo root.taiki-e/install-action.Verification
actionlint,just gh check(0 violations), justfile fmt, shell, markdown and taplo pass. I dry-rangh release parse-version|read-versionwithGITHUB_OUTPUT, and ran the argument errors offormula,package-nfpm,package-binaryandswift verify.workflow_dispatchwith an existing tag re-syncs the production R2 bucket (idempotent), so I haven't run it without approval.Alternatives
cargo install justin each job (the quest's original pattern) costs about a minute of compile per release job.nix develop --commanddoesn't work on Windows and adds a heavy Nix setup.Follow-ups
release-binaryis now ready. It no longer lists this quest under Required.(written by Claude Opus 5.5)
🤖 Generated with Claude Code