fix(fix-dependabot-alerts): clean-rebuild for final verification#2422
Merged
Conversation
The `Final build verification` step ran `pnpm run build` which uses fluid-build incrementally. fluid-build's per-package fingerprint (and tsc's .tsbuildinfo) is keyed off the package's own sources plus the declared dep specs in package.json — it does not invalidate when a transitive dep is bumped within its existing semver range. As a result, a breaking .d.ts change in an upgraded dep can pass the script's verification while still failing CI's clean `build_ts` job, producing PRs that break main on merge. Example: PR #2421 bumped exifreader 4.30.1 → 4.40.3 (in-range under `^4.30.1`). The new `exifreader` `TypedTag` generic gained a second nullable-tuple type parameter, which broke `typechat-utils/src/image.ts`. The script's incremental build skipped re-checking typechat-utils and reported ✅; CI's fresh checkout caught it. Switch the final verification to `pnpm run rebuild` (= `fluid-build . -t build --rebuild`) so it matches CI's clean build. The per-package mid-loop incremental build is left as-is — the final rebuild is the backstop, and any package that does fail the rebuild gets recorded in the rollback-cooldown state for the next run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
TalZaccai
had a problem deploying
to
development-fork
GitHub Actions
Error
TalZaccai
had a problem deploying
to
development-fork
GitHub Actions
Error
TalZaccai
temporarily deployed
to
development-fork
GitHub Actions
Inactive
TalZaccai
temporarily deployed
to
development-fork
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Final build verificationstep in.github/workflows/fix-dependabot-alerts.ymlranpnpm run build, which uses fluid-build incrementally. fluid-build's per-package fingerprint (and tsc's.tsbuildinfo) is keyed off the package's own sources plus the declared dep specs inpackage.json— it does not invalidate when a transitive dep is bumped within its existing semver range. As a result, a breaking.d.tschange in an upgraded dep can pass the script's verification while still failing CI's cleanbuild_tsjob, producing PRs that breakmainon merge.Concrete case: PR #2421
exifreaderbumped4.30.1 → 4.40.3(in-range under^4.30.1)exifreaderTypedTaggeneric gained a 2nd nullable-tuple type parametertypechat-utils/src/image.ts:161—GPSLatitude/GPSLongitudeno longer assignable to the helper that consumes themtypechat-utils(no source change, no package.json change) → reported ✅build_tsmatrix legsFix
Switch the final verification to
pnpm run rebuild(=fluid-build . -t build --rebuild), matching the workload CI's fresh checkout does. The per-package mid-loop incremental build (line 352) is left as-is for speed — the final rebuild is the backstop. Any package that does fail the rebuild gets recorded in the existing rollback-cooldown state so the same broken bump isn't re-proposed for 7 days.Follow-up
Next scheduled run should clean-rebuild, fail on the exifreader change, and auto-roll-back, putting
exifreaderon the 7-day cooldown. PR #2421 should be closed.Repro run: 26750395888 (workflow ✅) vs PR #2421's
build_tsfailures (CI ❌).