chore(ci): sweep scaffold pins daily — weekly left a required check red for days - #205
Merged
Conversation
…ed for days `pins-vs-published` is a REQUIRED status check on `main` and it reads npm's published latest, so from the moment a `@civitai/*` minor lands until `bump-scaffold-pins` rewrites the template's pre-1.0 carets, every open PR is blocked regardless of its content. The bot is not broken — it is too slow. Measured off the npm registry `time` field: app-sdk 0.26.0 Jul 17, 0.27.0 Jul 28, 0.28.0 Jul 29, 0.29.0 Aug 3 20:15, 0.30.0 Aug 3 22:13, 0.31.0 Aug 5 03:54 (2026). Six minors in 19 days — a ~3.6-day mean interval against a 7-day sweep, so upstream published faster than the bot swept and a large fraction of each week sat red. It had to be hand-bumped twice in two days (#194, #203); #203 existed only to unblock an unrelated PR. Daily bounds that window at ~24h instead of ~168h. Nothing else changes: the bumper, its in-job validation, and the PR it opens are untouched. A no-op sweep is cheap because `detect changes` gates every downstream step — verified live here, where the bumper printed "all @civitai/* pins are current — nothing to do" and modified no files. This is the (b) lever the app-analytics handoff doc identified and correctly left as ask-first per AGENTS.md; the decision has now been made, so the doc is updated to record it rather than re-raise it. Verification: actionlint clean on the changed workflow, with a positive control (it rejects `77 7 * * *` with "invalid CRON format", so its acceptance of `17 7 * * *` is a real green). YAML re-parsed to assert the schedule literal, with both a positive control (injecting the old weekly value is observed) and a negative control (malformed YAML raises). `make ci` green — 16 packages ok, 0 FAIL, `go mod tidy` no-op, `gofmt -s -l` silent over 206 Go files. Note the cadence narrows the window, it does not close it: a publish minutes after a sweep still blocks PRs until the next day. If that residual still bites, the next levers are a 6-hourly cron or a `repository_dispatch` fired by the SDK release — both larger changes to `.github/`, so neither is taken here. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LTYNRi1WkNWzaVMerFRFAC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
bump-scaffold-pinssweeps daily (17 7 * * *) instead of weekly (17 7 * * 1). One cron literal; the bumper, its in-job validation, and the PR it opens are untouched.Why
pins-vs-publishedis a required status check onmainand it reads npm's published latest. The page-money template pins@civitai/*with pre-1.0 carets that lock the minor, so from the moment a minor lands until this bot rewrites those pins, every open PR is blocked regardless of its content.The bot is not broken — it is too slow. Publish times off the npm registry
timefield:Six minors in 19 days — a ~3.6-day mean interval against a 7-day sweep. Upstream publishes faster than the bot swept, so a large fraction of each week sat red. It was hand-bumped twice in two days (#194, #203), and #203 existed only to unblock an unrelated PR (#198, whose diff touches no scaffold code at all).
Daily bounds the window at ~24h instead of ~168h.
scaffold-currencyis required too but is deliberately not part of this: itnpm installs@latestexplicitly, overriding the template pins, so it reds on a broken SDK export rather than on a stale caret. Onlypins-vs-publishedis affected.Provenance
This is the (b) lever identified in
claudedocs/handoff-app-analytics-followups.md, which diagnosed the same thing independently and correctly stopped:The decision has now been made by the maintainer, so this PR pulls the lever and updates that doc to record it as settled — otherwise the next agent re-raises a closed question. Point (a) of that note is preserved verbatim: a blocked PR is still fixed by
bump-pins+ a PR, orgh workflow run bump-scaffold-pins.yml.Verification
A cron change has no unit-test surface, so this leans on tool checks — each with a control, because both tools are silent-on-success and silence is otherwise indistinguishable from "checked nothing".
77 7 * * *withinvalid CRON format … end of range (77) above maximum (59), so its acceptance of17 7 * * *is a real green and not an unread file.["17 7 * * *"]. Handles the YAML 1.1 trap where a bareon:key parses as booleanTrue, not the string"on". Positive control: injecting the old weekly value is observed by the parser. Negative control: malformed YAML raises rather than passing.all @civitai/* pins are current — nothing to doand modified zero files. That is the daily run's common case, and it confirmsdetect changesgates every downstream step — so 7× the runs is not 7× the cost.make cigreen — 16 packagesok, 0FAIL,go mod tidya no-op,gofmt -s -lsilent across 206 Go files (file count asserted so "clean" isn't "found nothing to check").What is not verified: that the cron actually fires daily. GitHub only reveals that on the schedule, and scheduled workflows can be delayed or skipped under load — an argument for this change (a skipped daily run costs a day, a skipped weekly run costs two weeks) but not something provable pre-merge. Worth a glance at the run history in a few days.
Residual
Daily narrows the window, it does not close it — a publish minutes after a sweep still blocks PRs until the next day, and the auto-PR still needs a human merge. If that residual bites, the next levers are a 6-hourly cron or a
repository_dispatchfired from the SDK's release pipeline. Both are larger changes to.github/(the latter needs a cross-repo token), so neither is taken here.🤖 Generated with Claude Code
https://claude.ai/code/session_01LTYNRi1WkNWzaVMerFRFAC