From 1d10d029b22f2369f909f12c0a85bd0b2a498740 Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Fri, 21 Aug 2026 07:53:19 +0200 Subject: [PATCH] ci(deploy-preview): preview when the pins that drive rendering change The trigger watched platform/** only, but schema-version and context-ref live in deploy-preview.yml itself and decide whether rendering works at all. A pin bump therefore merged with no readiness preview: today's bump PRs ran workflow lint, hygiene and the language CI jobs, and no Deploy Validate. That is how github-workflows v0.15.0 reached every service repository. It carried a context-resolution bug that failed all five fragment renders, and every PR pinning it merged without attempting one; the bug surfaced later on an unrelated PR that happened to touch platform/. The workflow file joins the filter so a render is attempted whenever the pins move. This does not make the scorecard block a merge -- the only required check is Pipeline Complete, which aggregates ci.yml jobs and not this workflow. --- .github/workflows/deploy-preview.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index b5563cc..0226f9d 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -8,6 +8,11 @@ on: pull_request: paths: - 'platform/**' + # schema-version and context-ref live in this file, and they decide whether + # rendering works at all. Without this, a pin bump to a broken toolkit or a + # stale context digest merges with no preview -- which is how a release with a + # context-resolution bug reached every repository. + - '.github/workflows/deploy-preview.yml' permissions: {}