fix(ra): let a failed disc hash explain itself in the log (#415) #281
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Checks | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| name: Lint, Analysis & Test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # `contents: write` is only exercised by the Dependabot lockfile sync | |
| # below. Fork PRs get a read-only token no matter what this says, so it | |
| # grants nothing to untrusted branches. | |
| contents: write | |
| steps: | |
| # Dependabot PRs are checked out at the branch tip rather than the | |
| # pull_request merge ref, because the sync step below pushes to that | |
| # branch and the rest of the job has to gate the corrected tree. The merge | |
| # ref is frozen at the event's SHA and would still carry the stale lock. | |
| # Everyone else (including forks, whose head_ref does not exist in this | |
| # repo) keeps the default checkout. | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.actor == 'dependabot[bot]' && github.head_ref || '' }} | |
| - name: Setup Flutter | |
| uses: subosito/flutter-action@v2 | |
| with: | |
| # Pinned via .fvmrc (the single source of truth for the SDK version), | |
| # not `channel: stable`. An unpinned stable silently moves under CI: | |
| # 3.47.0 shipped a `dart format` that relaid out a file nobody had | |
| # touched and an `unawaited_return_in_try_block` lint that fires in | |
| # four existing files, so main went red without a commit. | |
| # Bump .fvmrc deliberately, in its own PR, with the fallout fixed. | |
| flutter-version-file: .fvmrc | |
| channel: 'stable' | |
| cache: true | |
| # Dependabot resolves pubspec.lock on whatever Dart its own runner has, | |
| # which is how #338 landed a lock full of Dart 3.13 packages (meta 1.19.0, | |
| # vector_math 2.4.2, ...) that every checkout at the pinned 3.44.9 then | |
| # downgraded again. Its SDK is not configurable, so re-resolve on the pin | |
| # and push the result back to its branch instead of failing the PR and | |
| # making a human do it. Only Dependabot's own branches are touched. | |
| # | |
| # This push uses GITHUB_TOKEN, which deliberately does not retrigger | |
| # workflows: no second run, no loop. The steps below then gate the | |
| # corrected tree in this same run, so one green run means the lock that | |
| # reaches main is the lock the pinned SDK actually resolves. | |
| - name: Sync lockfile to the pinned SDK | |
| if: github.actor == 'dependabot[bot]' | |
| run: | | |
| set -euo pipefail | |
| # Capture pub's own report: its `<`/`>` lines already name the package | |
| # and both versions, which a diff of the lock does not. | |
| PUB_OUT="$(flutter pub get 2>&1)" | |
| echo "$PUB_OUT" | |
| if git diff --quiet -- pubspec.lock; then | |
| echo "\`pubspec.lock\` already matches the SDK pinned in \`.fvmrc\`." \ | |
| >> "$GITHUB_STEP_SUMMARY" | |
| exit 0 | |
| fi | |
| { | |
| echo "### Lockfile re-resolved on the pinned SDK" | |
| echo | |
| echo "Dependabot resolved these on a different Dart SDK:" | |
| echo | |
| echo '```' | |
| # A sha256-only change moves no version, so fall back to the diff. | |
| echo "$PUB_OUT" | grep -E '^[<>] ' || git diff --stat -- pubspec.lock | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| git config user.name 'github-actions[bot]' | |
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | |
| git add pubspec.lock | |
| git commit -m 'build(deps): re-resolve pubspec.lock on the pinned Flutter SDK' \ | |
| -m "Dependabot resolves on its own Dart SDK, which drifts from the version pinned in .fvmrc. Regenerated by .github/workflows/pr-checks.yml." | |
| git push origin "HEAD:${{ github.head_ref }}" | |
| # Belt and braces: after the sync above (or without it, for everyone | |
| # else), the committed lock must resolve exactly on the pinned SDK. | |
| - name: Install dependencies | |
| run: flutter pub get --enforce-lockfile | |
| - name: Verify formatting | |
| run: dart format --output=none --set-exit-if-changed . | |
| - name: Analyze project | |
| run: flutter analyze | |
| - name: Run tests | |
| run: flutter test |