Skip to content

Review: Improve composability (upstream #269) #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
msystemsuser wants to merge 4 commits into
base: base/pr-269
Choose a base branch
from
Open

Review: Improve composability (upstream #269) #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9713cd5
Improve composability
anttiharju Sep 26, 2026
9c3391b
Fix action releases
anttiharju Sep 26, 2026
7c6887c
Tmp lock to use a working version
anttiharju Sep 26, 2026
d22f14c
[skip ci] Apply review fixes
mergestorm-cyclone[bot] Sep 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 13 additions & 13 deletions .github/actions/detect-changes/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,15 @@ runs:
using: "composite"
steps:
- id: actionlint
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.github/*/**.yml
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: prettier
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
**.md
Expand All @@ -25,47 +25,47 @@ runs:
flake.nix
changes: ${{ inputs.changes }}
- id: compare-changes-action
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.release/compare-changes-action/**
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: find-changes-action
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.release/find-changes-action/**
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: homebrew-tap
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.release/homebrew-tap/**
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: github
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.release/archive.sh
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: nix
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.release/nur-packages/**
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: rs
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
**.rs
Expand All @@ -75,7 +75,7 @@ runs:
flake.nix
changes: ${{ inputs.changes }}
- id: rust
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.cargo/**
Expand All @@ -87,20 +87,20 @@ runs:
flake.nix
changes: ${{ inputs.changes }}
- id: shellcheck
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
workflow: wildcard/shellcheck.yml
changes: ${{ inputs.changes }}
- id: src
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
src/**
flake.lock
flake.nix
changes: ${{ inputs.changes }}
- id: zensical
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
docs/**
Expand All @@ -109,7 +109,7 @@ runs:
flake.nix
changes: ${{ inputs.changes }}
- id: zizmor
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
**/action.yml
Expand Down
1 change: 1 addition & 0 deletions .github/actions/release/action/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ runs:
shell: sh
env:
action: ${{ inputs.action }}
GH_TOKEN: ${{ github.token }}
run: |
.release/render.sh "$action-changes-action" --output "release-$action"
- name: Commit changes
Expand Down
11 changes: 9 additions & 2 deletions .github/workflows/example.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,14 +13,21 @@ jobs:
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@v7
with:
persist-credentials: false

- name: Find changes
id: changes
uses: anttiharju/find-changes-action@v0 # handles checkout
uses: anttiharju/find-changes-action@v0.12.19

- id: shellcheck
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
workflow: wildcard/shellcheck.yml
changes: ${{ steps.changes.outputs.array }}

- if: steps.shellcheck.outputs.changed == 'true'
name: shellcheck
run: git ls-files -z '*.sh' | xargs --null shellcheck --color=always
18 changes: 14 additions & 4 deletions .github/workflows/plan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,16 @@ jobs:
contents: read
packages: write
steps:
- name: Checkout
uses: actions/checkout@v7
with:
persist-credentials: false
- name: Find changes
id: changes
uses: anttiharju/find-changes-action@v0 # handles checkout
uses: anttiharju/find-changes-action@v0.12.19
- name: Compare changes
id: flake
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
.cargo/zig/**
Expand Down Expand Up @@ -134,9 +138,16 @@ jobs:
username: ${{ github.actor }}
password: ${{ github.token }}
steps:
- name: Checkout
uses: actions/checkout@v7
with:
persist-credentials: false
fetch-depth: 0
fetch-tags: true

@mergestorm-vortex mergestorm-vortex Bot Sep 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue · Important

fetch-tags on a shallow checkout may not bring the tag render.sh needs

fetch-tags: true
This replaces the explicit git fetch origin 'refs/tags/*:refs/tags/*' workaround for anttiharju#258. The checkout here is shallow (no fetch-depth, so depth 1), and actions/checkout's fetch-tags only lifts git's default tag-following (--no-tags is dropped, but the tags refspec is only added for fetch-depth: 0), i.e. it can fetch tags that point at the fetched commit rather than all tag refs. If the latest tag points at an older main commit (the normal case for a push-to-main run), render.sh (tag="$(git tag --sort=-creatordate | head -n1)") sees no tags, values.sh bails out with TAG=v0.0.0 and emits TBD checksums, so the rendered action / Test action (release binary) step is wrong or fails. Confirm this on a real run (or set fetch-depth: 0, or keep the explicit tag fetch) before relying on it.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid concrete bugs, skip the
rest with a brief reason, keep changes minimal, and validate. Skip Decision required,
policy forks, and "consider X" alternatives. Do not add new features, refactors, or
architecture beyond the fix; prefer the smallest diff.

In `@.github/workflows/plan.yml` (line 145, Important):
`fetch-tags: true`
This replaces the explicit `git fetch origin 'refs/tags/*:refs/tags/*'` workaround for #258. The checkout here is shallow (no `fetch-depth`, so depth 1), and `actions/checkout`'s `fetch-tags` only lifts git's default tag-following (`--no-tags` is dropped, but the tags refspec is only added for `fetch-depth: 0`), i.e. it can fetch tags that point at the fetched commit rather than all tag refs. If the latest tag points at an older main commit (the normal case for a push-to-main run), `render.sh` (`tag="$(git tag --sort=-creatordate | head -n1)"`) sees no tags, `values.sh` bails out with `TAG=v0.0.0` and emits `TBD` checksums, so the rendered action / `Test action (release binary)` step is wrong or fails. Confirm this on a real run (or set `fetch-depth: 0`, or keep the explicit tag fetch) before relying on it.


- name: Find changes
id: changes
uses: anttiharju/find-changes-action@v0 # handles checkout
uses: anttiharju/find-changes-action@v0.12.19

- name: Detect changes
id: changed
Expand Down Expand Up @@ -181,7 +192,6 @@ jobs:
env:
GH_TOKEN: ${{ github.token }}
run: |
git fetch origin 'refs/tags/*:refs/tags/*' # TODO: https://github.com/anttiharju/compare-changes/issues/258
.release/render.sh compare-changes-action

- if: always() && !cancelled() && steps.changed.outputs.compare-changes-action == 'true' && github.event_name != 'push' && steps.semantic.outputs.type != 'major'
Expand Down
10 changes: 7 additions & 3 deletions .release/compare-changes-action/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,16 +17,20 @@ jobs:
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@v7
with:
persist-credentials: false
- name: Find changes
id: changes
uses: anttiharju/find-changes-action@v0 # handles checkout
uses: anttiharju/find-changes-action@v0.12.19
- id: shellcheck
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
workflow: wildcard/shellcheck.yml # see .github/workflows/wildcard/shellcheck.yml below
changes: ${{ steps.changes.outputs.array }}
- id: shellcheck
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
paths: |
**.sh
Expand Down
21 changes: 18 additions & 3 deletions .release/find-changes-action/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,14 @@ jobs:
example:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
with:
persist-credentials: false

- name: Find changes
id: changes
uses: anttiharju/find-changes-action@v0 # handles checkout
uses: anttiharju/find-changes-action@v0.12.19

- name: Echo changed files
shell: sh
Expand Down Expand Up @@ -106,11 +111,15 @@ jobs:
permissions:
contents: read
steps:
- name: Checkout
uses: actions/checkout@v7
with:
persist-credentials: false
- name: Find changes
id: changes
uses: anttiharju/find-changes-action@v0 # handles checkout
uses: anttiharju/find-changes-action@v0.12.19
- id: shellcheck
uses: anttiharju/compare-changes-action@v0
uses: anttiharju/compare-changes-action@v0.12.19
with:
workflow: wildcard/shellcheck.yml # storing the stub workflow under wildcard/ prevents it from polluting your repository's $url/actions UI!
changes: ${{ steps.changes.outputs.array }}
Expand All @@ -119,6 +128,12 @@ jobs:
run: git ls-files -z '*.sh' | xargs --null shellcheck --color=always
```

## Checkout

This action assumes that your repository does not have a directory named `.tmp-anttiharju-compare-changes` for how it uses `actions/checkout` internally. It does not replace your existing checkout. A `.gitignore` file with `*` in `.tmp-anttiharju-compare-changes` hides the temporary files from your Git status. The action also removes the temporary directory and its checkout credentials after use, including after a failed step.

If you need repository files, use `actions/checkout` separately. This way composability of the steps is retained and this action does not need to pass through all inputs and outputs of `actions/checkout`.

## More information

Refer to https://github.com/anttiharju/compare-changes
20 changes: 20 additions & 0 deletions .release/find-changes-action/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,24 +48,44 @@ runs:
LINUX_X64_SHA: "$PKG_LINUX_X64_SHA"
run: |
"$$GITHUB_ACTION_PATH/scripts/verify.sh"
- name: Prepare checkout
shell: sh
run: |
mkdir .tmp-anttiharju-compare-changes # no -p on purpose: why would you have directory with this name in your repository?
printf '*\n' > .tmp-anttiharju-compare-changes/.gitignore
- if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
path: .tmp-anttiharju-compare-changes/${{ github.repository }}
fetch-depth: 2
persist-credentials: true
- if: github.event_name == 'push'
name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
path: .tmp-anttiharju-compare-changes/${{ github.repository }}
persist-credentials: true
- name: Run
id: run
working-directory: .tmp-anttiharju-compare-changes/${{ github.repository }}
shell: sh
env:
BINARY: ${{ steps.check.outputs.directory }}/compare-changes
run: |
"$$BINARY" --find
- if: always()
name: Clean up checkout
shell: sh
run: |
directory=".tmp-anttiharju-compare-changes/$$GITHUB_REPOSITORY"
if [ -f "$$directory/.git/config" ]; then
credentials="$$(git config --file "$$directory/.git/config" --get "includeIf.gitdir:$$PWD/$$directory/.git.path" || true)"

@mergestorm-vortex mergestorm-vortex Bot Sep 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue · Important

Credential cleanup may silently no-op

credentials="$(git config --file "$directory/.git/config" --get "includeIf.gitdir:$PWD/$directory/.git.path" || true)"
git config --get is a literal key lookup, so this only finds the value if the key string is byte-identical to what actions/checkout wrote into .git/config (the key depends on that action's internal convention — whether it records the gitdir as the working-tree path or with the /.git suffix, and whether $PWD matches the resolved path it used). If it differs in any way, --get returns empty, the case glob doesn't match, and rm -f never runs: the $RUNNER_TEMP/git-credentials-*.config file (which holds a live token for the repo) is left behind silently, while the new README section promises the action "removes the temporary directory and its checkout credentials after use". rm -rf .tmp-anttiharju-compare-changes does not help because that file lives outside the temp dir. Safer: read whatever key exists, e.g. git config --file "$directory/.git/config" --get-regexp 'includeIf\.gitdir.*\.path' | awk '{print $2}', instead of reconstructing the key by convention.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid concrete bugs, skip the
rest with a brief reason, keep changes minimal, and validate. Skip Decision required,
policy forks, and "consider X" alternatives. Do not add new features, refactors, or
architecture beyond the fix; prefer the smallest diff.

In `@.release/find-changes-action/action.yml` (line 83, Important):
`credentials="$(git config --file "$directory/.git/config" --get "includeIf.gitdir:$PWD/$directory/.git.path" || true)"`
`git config --get` is a *literal key* lookup, so this only finds the value if the key string is byte-identical to what `actions/checkout` wrote into `.git/config` (the key depends on that action's internal convention — whether it records the gitdir as the working-tree path or with the `/.git` suffix, and whether `$PWD` matches the resolved path it used). If it differs in any way, `--get` returns empty, the `case` glob doesn't match, and `rm -f` never runs: the `$RUNNER_TEMP/git-credentials-*.config` file (which holds a live token for the repo) is left behind silently, while the new README section promises the action "removes the temporary directory and its checkout credentials after use". `rm -rf .tmp-anttiharju-compare-changes` does not help because that file lives outside the temp dir. Safer: read whatever key exists, e.g. `git config --file "$directory/.git/config" --get-regexp 'includeIf\.gitdir.*\.path' | awk '{print $2}'`, instead of reconstructing the key by convention.

case "$$credentials" in
"$$RUNNER_TEMP"/git-credentials-*.config) rm -f "$$credentials" ;;
esac
fi
rm -rf .tmp-anttiharju-compare-changes
outputs:
array:
description: "JSON array of changed files."
Expand Down