Skip to content

CI: a digest-only refresh is one whose diff changes nothing but digests #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cbetta merged 4 commits into from
Oct 23, 2026
Merged

CI: a digest-only refresh is one whose diff changes nothing but digests #42

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9018ba5
fix(ci): a digest-only refresh is one whose diff changes nothing but …
cbetta Oct 23, 2026
20322a9
fix(ci): a digest refresh is judged file by file, with digests as a m…
cbetta Oct 23, 2026
0ea7287
fix(ci): the digest-refresh check fails closed, and catches mode chan…
cbetta Oct 23, 2026
7625b61
fix(ci): the digest-refresh check reads raw file bytes, so a file ove…
cbetta Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,17 +70,29 @@ jobs:
UPDATE_TYPE: ${{ steps.meta.outputs.update-type }}
ECOSYSTEM: ${{ steps.meta.outputs.package-ecosystem }}
NEW_VERSION: ${{ steps.meta.outputs.new-version }}
PREVIOUS_VERSION: ${{ steps.meta.outputs.previous-version }}
run: |
merge=false
if [ "$HAS_APP" != true ]; then
reason="the deps-factory App's secrets aren't set yet"
elif [ "$FROM_DEPENDABOT" = true ]; then
case "$ECOSYSTEM:$UPDATE_TYPE" in
github_actions:*) reason="Actions updates wait for a person" ;;
# Same tag, new digest: Dependabot names the old digest as the previous version (a new tag names the old tag).
# Same tags, new digests: every changed file is modified in place with its mode kept, and its bytes are the same before and after once each digest is a marker (so a pin can't be dropped, nothing can move, and a failed lookup refuses).
docker:*|docker_compose:*)
if [[ "$(tr -d "\`" <<< "$PREVIOUS_VERSION")" =~ ^[0-9a-f]{7,}$ ]]; then merge=true; else reason="a new image tag waits for a person"; fi ;;
set -o pipefail
merge=true
Comment thread
Copilot marked this conversation as resolved.
Resolved
mode() { gh api "repos/$GITHUB_REPOSITORY/git/trees/$1?recursive=1" --jq ".tree[] | select(.path == \"$2\") | .mode"; }
norm() { gh api -H "Accept: application/vnd.github.raw" "repos/$GITHUB_REPOSITORY/contents/$2?ref=$1" | sed -E 's/@sha256:[0-9a-f]{64}/@sha256:DIGEST/g' | sha256sum; }
head="$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR" --jq .head.sha)" || merge=false
base="$(gh api "repos/$GITHUB_REPOSITORY/compare/$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR" --jq .base.sha)...$head" --jq .merge_base_commit.sha)" || merge=false
files="$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR/files" --paginate --jq '.[] | [.status, .filename] | @tsv')" || merge=false
[ -n "$files" ] || merge=false
while [ "$merge" = true ] && IFS=$'\t' read -r status file; do
[ "$status" = modified ] || { merge=false; break; }
Comment thread
cbetta marked this conversation as resolved.
Resolved
ma="$(mode "$base" "$file")" && mb="$(mode "$head" "$file")" && [ -n "$ma" ] && [ "$ma" = "$mb" ] || { merge=false; break; }
a="$(norm "$base" "$file")" && b="$(norm "$head" "$file")" && [ "$a" = "$b" ] || { merge=false; break; }
done <<< "$files"
[ "$merge" = true ] || reason="it changes more than image digests" ;;
*:version-update:semver-patch) merge=true ;;
*:version-update:semver-minor)
if [ "${NEW_VERSION%%.*}" = 0 ]; then reason="a 0.x minor can break"; else merge=true; fi ;;
Expand Down
Loading