From e31d3c44fe8c03cf0adf9a930a561f3c6634ec7d Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 31 Aug 2026 01:20:33 +0000 Subject: [PATCH] ci: pin the publish default to v0.7.0, the framework the tree was built with The default sat at v0.4.0 while the published tree moved to v0.5.0, then v0.6.0, then v0.7.0. That inverts what a default is for: accepting it would have rebuilt every package against a framework three releases behind what is committed here, and pushed the result. The dispatch that looks safest was the one that rewrote the repository. Nothing caught it because nothing could. generated-only compares the committed tree against the catalog's pin, not against this input, so a stale default here is invisible until someone dispatches with it. The v0.7.0 republish was only correct because the ref was typed by hand. The comment above the input already said to bump this with each release. It is restated to say what the value means -- the framework the committed tree was last built with -- because "bump it" was followed three times by nobody, and a rule that names the invariant is harder to skip than one that names a chore. cursor and codex carried no comment here at all, which is how their defaults drifted furthest from anyone's attention; they get the same one, so all four distributions now document the pin identically. Signed-off-by: Claude --- .github/workflows/publish.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 7d99a33..1460754 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -12,9 +12,15 @@ on: type: string default: main framework_ref: + # A tag is the right default -- a release should be reproducible from two pinned + # refs. This names the framework the committed tree was last built with, so a + # dispatch that accepts the defaults reproduces what is published rather than + # rewriting it. It sat at v0.4.0 across three releases while the trees moved to + # v0.5.0, v0.6.0 and v0.7.0, which made the safe-looking default the one that + # would have rewritten every package. Bump it in the same change that republishes. description: Framework ref to build with type: string - default: v0.4.0 + default: v0.7.0 dry_run: description: Build and show the diff without pushing type: boolean