fix(ci): pin ghostty-web to immutable SHA and freeze all CI installs (CI-LOCK-02) - #232
Merged
Conversation
…(CI-LOCK-02) A clean checkout could not reproduce dependencies: packages/app/package.json pinned ghostty-web to the mutable `#main` ref while bun.lock recorded a stale commit (513463a), so `bun install --frozen-lockfile` failed with 'lockfile had changes'. CI also ran non-frozen installs via the shared setup-bun action, so it could silently test a different dependency set than the lock declared. Fixes: - Pin ghostty-web to the reviewed immutable commit 83c0a07b8628b748aed073b232cb4b52a6ca11c1. - Sync bun.lock to that pin (manifest + lock entry). - Add `--frozen-lockfile` to both setup-bun installs (Linux + Windows) and to the release-fork package-templates install. - Add a static repository-policy gate (test/policy/repo-dependencies.test.ts) that fails closed if any git dependency is not pinned to a full 40-char SHA, or any `bun install` in CI (.github/**/*.yml) is not frozen. It validates config only — no second install flow. Mutation-proven: reverting the SHA to `#main`, or dropping `--frozen-lockfile` from any CI install, flips the gate Red. Clean checkout `bun install --frozen-lockfile` now passes with a stable lock. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #231
What
Closes CI-LOCK-02 — makes dependency installation reproducible so the lockfile is authoritative and CI never tests a dependency set different from what
bun.lockdeclares.Changes (5 files)
packages/app/package.json— pinghostty-webfrom mutable#mainto immutable commit83c0a07b8628b748aed073b232cb4b52a6ca11c1.bun.lock— synced to the pin (manifest + lock entry), sobun install --frozen-lockfilepasses on a clean checkout..github/actions/setup-bun/action.yml—--frozen-lockfileon both installs (Linux + Windows)..github/workflows/release-fork.yml—--frozen-lockfileon the package-templates install.packages/opencode/test/policy/repo-dependencies.test.ts— new static gate: fails closed if any git dependency is not pinned to a full 40-char SHA, or anybun installin CI (.github/**/*.yml) is not frozen. Config-only validation — no second install flow.Evidence
bun install --frozen-lockfile: previouslylockfile had changes; now passes with a stable lock (verified sha before/after install identical).packages/opencode,packages/core,packages/apptypecheck: all green.git diff --check: clean.Mutation-proven gate
#main→ gate turns Red.--frozen-lockfilefrom any CI install → gate turns Red.Scope
CI/dependency reproducibility only. No production runtime code, no dependency version bumps (pin to an already-resolved commit), no release/merge.
🤖 Generated with Claude Code