From 1931f8a6e03ee6f73521bbcdf122ee78b7bd5cad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Say=C3=A3o=20Lobato=20Abreu?= Date: Fri, 9 Oct 2026 21:27:15 -0300 Subject: [PATCH 1/2] fix(ci): isolate native report queues and retry identity propagation --- .github/workflows/reports-native.yml | 26 ++++++++++++++----- CHANGELOG.md | 2 ++ .../github-actions-optional/reports-native.md | 2 ++ 3 files changed, 24 insertions(+), 6 deletions(-) diff --git a/.github/workflows/reports-native.yml b/.github/workflows/reports-native.yml index 30182b787..4350b2c81 100644 --- a/.github/workflows/reports-native.yml +++ b/.github/workflows/reports-native.yml @@ -7,8 +7,8 @@ permissions: contents: read concurrency: - group: reports-pages - cancel-in-progress: false + group: ${{ github.event_name == 'pull_request' && format('reports-native-pr-{0}', github.event.pull_request.number) || github.ref == 'refs/heads/main' && 'reports-native-pages' || format('reports-native-ref-{0}', github.ref) }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: reports: @@ -20,6 +20,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: + fetch-depth: 0 persist-credentials: false - name: Checkout dev-tools workflow helpers uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 @@ -128,12 +129,25 @@ jobs: runs-on: ubuntu-latest steps: - name: Verify public documentation identity + shell: bash env: PAGE_URL: ${{ needs.deploy.outputs.page-url }} LOGO_SHA: ${{ needs.reports.outputs.logo-sha }} DASH_SHA: ${{ needs.reports.outputs.dash-sha }} run: | - curl --fail --location --retry 8 --retry-all-errors --retry-delay 5 --max-time 30 "${PAGE_URL}images/fast-forward-logo-dark.svg" -o "$RUNNER_TEMP/published-logo.svg" - curl --fail --location --retry 8 --retry-all-errors --retry-delay 5 --max-time 30 "${PAGE_URL}images/dash-reading.png" -o "$RUNNER_TEMP/published-dash.png" - printf '%s %s\n' "$LOGO_SHA" "$RUNNER_TEMP/published-logo.svg" | sha256sum --check --strict - printf '%s %s\n' "$DASH_SHA" "$RUNNER_TEMP/published-dash.png" | sha256sum --check --strict + verify_asset() { + local asset_name="$1" expected_sha="$2" destination="$RUNNER_TEMP/$1" + for attempt in $(seq 1 12); do + if curl --fail --silent --show-error --location --max-time 30 "${PAGE_URL}images/${asset_name}" -o "$destination" && + printf '%s %s\n' "$expected_sha" "$destination" | sha256sum --check --strict; then + return 0 + fi + if [ "$attempt" -lt 12 ]; then + sleep 5 + fi + done + echo "Identity verification failed after 12 attempts: $asset_name" >&2 + return 1 + } + verify_asset fast-forward-logo-dark.svg "$LOGO_SHA" + verify_asset dash-reading.png "$DASH_SHA" diff --git a/CHANGELOG.md b/CHANGELOG.md index 247cd366e..27df2a735 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +- Isolate native Pages PR builds from production deployment queues, preserve full repository history in generated metrics, and retry downloaded identity hashes during CDN propagation. + - Keep required per-version statuses current across normal and Dependabot reruns through checkout-free lifecycle publishers using verified GitHub run and job metadata. - Keep Composer audit and nested dependency-health checks plugin-free after CI installs without plugins, so consumer allowlists do not block vulnerability or dependency analysis. - Isolate completed per-version status publication from repository-controlled test jobs, preserve access to private GitHub job metadata, and disable persisted checkout credentials in the reusable test workflow. diff --git a/resources/github-actions-optional/reports-native.md b/resources/github-actions-optional/reports-native.md index e1bb5f94f..def1c3de1 100644 --- a/resources/github-actions-optional/reports-native.md +++ b/resources/github-actions-optional/reports-native.md @@ -11,3 +11,5 @@ The caller's `contents: read`, `pages: write` and `id-token: write` values are c The build requires template 2.1.0 or newer, records its selected version/reference and validates rendered identity assets against the installed template. Deployment verification compares the public assets' SHA-256 values with those produced by the build. It preserves generation of documentation, coverage and metrics; failures stop publication. Existing ^2.0 template constraints accept 2.1.0. Consumers with a committed lock must update `fast-forward/phpdoc-bootstrap-template` before running this workflow. A locally cached vendor directory can still contain an older template; use clean dependency resolution and inspect the logged version. + +PR builds use separate per-PR concurrency groups and may cancel their own obsolete runs; they never share the production deployment queue. Main deployments remain serialized, and other feature refs have their own queues. Metrics use a full repository checkout. Public identity checks retry the complete download-and-hash operation up to twelve times per asset, so stale HTTP 200 responses during Pages propagation do not pass validation or immediately fail a successful deployment. From ad5b386cf6e569d535eed1fcc7bacfe242f85a55 Mon Sep 17 00:00:00 2001 From: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 10 Oct 2026 00:28:22 +0000 Subject: [PATCH 2/2] Update wiki submodule pointer for PR #364 --- .github/wiki | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/wiki b/.github/wiki index 46c969e74..961cfbb2e 160000 --- a/.github/wiki +++ b/.github/wiki @@ -1 +1 @@ -Subproject commit 46c969e7462dee289401aaf6049b59ac1fd8c91c +Subproject commit 961cfbb2e6dffeba2a77ad64cbce45c3cda903b5