fix(scaffold): bump page-money pins to published (app-sdk 0.30.0, blocks-react 0.38.0) - #194
Merged
Merged
Conversation
…cks-react 0.38.0) npm published past both `@civitai/*` pins in the page-money template, and the pre-1.0 caret LOCKS THE MINOR — `^0.28.0` never installs `0.30.0` — so, in the pins-vs-published guard's own words, "every app created from this template is born stale". The guard is a required check, so it is currently red on `main` and on every open PR regardless of that PR's content (it blocked cli#193, a docs-only change). Produced mechanically by `go run ./internal/scaffold/cmd/bump-pins`, which rewrites all three literal pin sites in lockstep (package.json.tmpl, README.md.tmpl prose, and the scaffold_test.go mustContain assertions). @civitai/app-sdk ^0.28.0 -> ^0.30.0 @civitai/blocks-react ^0.37.0 -> ^0.38.0 Verified — a minor bump can break the template, so the rot-guard was run for real rather than assumed: - pins-vs-published: RED at 6bdab0e (`main`) with both stale-pin messages, GREEN here. Live npm query both times. - `bump-pins --check` is a clean no-op afterwards (idempotent, exit 0). - `make ci` green; `gofmt -s -l .` prints nothing. - All five `template-page-money` CI steps reproduced locally against the ACTUAL published packages (node resolved app-sdk 0.30.0 / blocks-react 0.38.0): scaffold -> npm install (142 pkgs) -> typecheck (clean) -> npm test (11 files, 137 passed) -> npm run build -> `civitai app validate` (valid). Caveat: run on node v26 locally; CI pins node 22. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017vvMdxcMKJP9ripQLEiPm9
ZacxDev
added a commit
that referenced
this pull request
Aug 5, 2026
…im that was measured wrong (#204) The canonical handoff doc on `main` had gone stale in the way that costs the next session real time: it still listed shipped work as pending, and carried one confident claim that measurement disproved. 🔴 THE DEDUP ADVICE WAS WRONG AND WOULD HAVE SHIPPED A BROKEN METRIC. The doc said \"per-mount, so unique views need query-side dedup\". `blockInstanceId` is NOT per-mount — it is `page_apb_<ULID>`, roughly one per PLACEMENT. Measured on prod: 124 rows carried 28 distinct `blockInstanceId` across 27 distinct `appBlockId`, ~1:1 with the app, so deduping on it reports ~1 unique viewer per app. Corrected in place, with the measurement, because the wrong version was specific and plausible enough to be followed. Brought current: - Follow-ups #6 and #5 marked DONE (civitai#3613 + cli#195, civitai#3626), plus cli#193/#194 and civitai#3627. The DONE table goes 8 -> 15 PRs. - `preview / component-tests` is no longer an open question: it reported success on #3606 and every subsequent PR (1259/1259), verified by reading the locator at each PR's head SHA rather than inferring from timing. - Deploy/verify status now records that the feature was verified IN PRODUCTION, not merely deployed — with the caveat that 20ms against ~125 rows in one partition proves the query is correct today, not that partition pruning holds at scale. - Records how to actually READ the preview component log (it lives in the Tekton taskrun, not behind the GitHub status URL), and that the taskrun reports Succeeded even when the suite fails because the step is report-only. - The pins rot recurred within a day exactly as predicted — cli#203 re-bumped both pins on 2026-08-05 — so that is now documented as a standing property of the repo, not an incident to diagnose a third time. - Adds the marketplace search-debounce flake (338ms measured against its own 300ms budget) as a latent issue for whoever owns that test. A security finding from this stream was reported privately per SECURITY.md. The mechanism is deliberately NOT in this doc — only the operational consequence, and a pointer to ask security before changing the ingest path. Docs-only; `make ci` green and `gofmt -s -l .` prints nothing. Claude-Session: https://claude.ai/code/session_017vvMdxcMKJP9ripQLEiPm9 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
ZacxDev
added a commit
that referenced
this pull request
Aug 5, 2026
…ed for days (#205) `pins-vs-published` is a REQUIRED status check on `main` and it reads npm's published latest, so from the moment a `@civitai/*` minor lands until `bump-scaffold-pins` rewrites the template's pre-1.0 carets, every open PR is blocked regardless of its content. The bot is not broken — it is too slow. Measured off the npm registry `time` field: app-sdk 0.26.0 Jul 17, 0.27.0 Jul 28, 0.28.0 Jul 29, 0.29.0 Aug 3 20:15, 0.30.0 Aug 3 22:13, 0.31.0 Aug 5 03:54 (2026). Six minors in 19 days — a ~3.6-day mean interval against a 7-day sweep, so upstream published faster than the bot swept and a large fraction of each week sat red. It had to be hand-bumped twice in two days (#194, #203); #203 existed only to unblock an unrelated PR. Daily bounds that window at ~24h instead of ~168h. Nothing else changes: the bumper, its in-job validation, and the PR it opens are untouched. A no-op sweep is cheap because `detect changes` gates every downstream step — verified live here, where the bumper printed "all @civitai/* pins are current — nothing to do" and modified no files. This is the (b) lever the app-analytics handoff doc identified and correctly left as ask-first per AGENTS.md; the decision has now been made, so the doc is updated to record it rather than re-raise it. Verification: actionlint clean on the changed workflow, with a positive control (it rejects `77 7 * * *` with "invalid CRON format", so its acceptance of `17 7 * * *` is a real green). YAML re-parsed to assert the schedule literal, with both a positive control (injecting the old weekly value is observed) and a negative control (malformed YAML raises). `make ci` green — 16 packages ok, 0 FAIL, `go mod tidy` no-op, `gofmt -s -l` silent over 206 Go files. Note the cadence narrows the window, it does not close it: a publish minutes after a sweep still blocks PRs until the next day. If that residual still bites, the next levers are a 6-hourly cron or a `repository_dispatch` fired by the SDK release — both larger changes to `.github/`, so neither is taken here. Claude-Session: https://claude.ai/code/session_01LTYNRi1WkNWzaVMerFRFAC Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
npm published past both
@civitai/*pins in thepage-moneytemplate. The pre-1.0 caret locks the minor (^0.28.0never installs0.30.0), so — in the guard's own words — "every app created from this template is born stale".latest@civitai/app-sdk^0.28.0^0.30.0@civitai/blocks-react^0.37.0^0.38.0Produced mechanically by
go run ./internal/scaffold/cmd/bump-pins, which rewrites all three literal pin sites in lockstep (package.json.tmpl, theREADME.md.tmplprose, and thescaffold_test.gomustContainassertions). No hand edits.Why now
pins-vs-publishedis a required check, and it is red onmainand therefore on every open PR regardless of that PR's content. It is currently the sole blocker on #193 (a two-file docs change). This unblocks that normally rather than via--admin.Note
main's last CI run (6bdab0e) was green — the 0.30.0/0.38.0 publishes landed after it, so the check only goes red on re-run.Verification
A minor bump can break the template, so the rot-guard was run for real rather than assumed:
pins-vs-published: RED at 6bdab0e (main) with both stale-pin messages → GREEN on this branch. Live npm query both times.bump-pins --checkis a clean no-op afterwards (idempotent, exit 0).make cigreen;gofmt -s -l .prints nothing.template-page-moneyCI steps reproduced locally against the actual published packages (node resolvedapp-sdk0.30.0 /blocks-react0.38.0 — verified fromnode_modules): scaffold →npm install(142 pkgs) →typecheck(clean) →npm test(11 files, 137 passed) →npm run build→civitai app validate(✓ . is valid).One thing worth a look
The bumper also rewrites this README prose line:
Those APIs actually arrived in the older versions, so post-bump the sentence overstates the minimum. It is over-strict rather than wrong-in-a-harmful-direction, the parenthetical ties it to the pin ("already pinned in
package.json"), and rewriting that site is the bumper's documented design — so I left the behaviour alone here rather than widen an unblocking PR. Flagging in case you'd rather the prose said "pinned at" instead of "require".🤖 Generated with Claude Code
https://claude.ai/code/session_017vvMdxcMKJP9ripQLEiPm9