feat(build): versions-up pins what it built and PRs the bump - #539
Conversation
- build cloak in versions-up; resolve cloakbrowser wrapper from npm - write versions.env from the exact versions built, not a re-fetch — a version published mid-build can no longer land in pins untested - new scripts/versions-pr.sh: commit in a temp worktree detached at origin/main, force-push chore/version-pins-refresh, gh pr create; user checkout stays untouched; PR=0 opts out - PR-stage failure warns and exits 0; pins stay written locally - write_version_pins moved to shared version-pins.sh - tests: cloak build args, pin write, outage no-write, PR soft-fail; hermetic versions-pr suite (real git against bare origin, fake gh) Close #538 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 231f67f21e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| local _wrapper_stale=0 | ||
| [[ "$(normalize_version "$cloak_wrapper_ver")" != "$(normalize_version "$_pin_cloak_wrapper")" ]] && _wrapper_stale=1 |
There was a problem hiding this comment.
When the configured pin already equals the upstream wrapper but $CLOAK_IMAGE is missing or still contains an older wrapper—for example, after running make versions-pin without rebuilding—this comparison sets _wrapper_stale to zero because it compares upstream against the pin rather than the built cloak image. If the other images are current, the subsequent early exit skips the cloak build, so make versions-up does not fulfill its new promise to bring all images up to date; determine the current wrapper from the cloak image label and compare that with the resolved version.
Useful? React with 👍 / 👎.
| REMOTE=${REMOTE:-origin} | ||
| BASE_BRANCH=${BASE_BRANCH:-main} | ||
| PR_BRANCH=${PR_BRANCH:-chore/version-pins-refresh} | ||
| PINS_NAME=versions.env |
There was a problem hiding this comment.
When the documented VERSION_PINS_FILE override points to another tracked pin file, version-upgrade.sh writes the built versions there but this script still compares and copies versions.env. A normal clean versions.env therefore makes the PR stage report that nothing changed, leaving the newly written pin file uncommitted; derive the repository-relative pin path from VERSION_PINS_FILE or reject unsupported paths explicitly.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR makes make versions-up the single end-to-end flow for upgrading agent/tool pins: it resolves versions once, builds all relevant images (including cloak), writes versions.env from the exact versions that were built, and optionally auto-commits + opens/updates a pin PR on a throwaway branch.
Changes:
- Extend
scripts/version-upgrade.shto build the cloak image, pin from built/resolved versions, and (optionally) run a newscripts/versions-pr.shPR stage. - Centralize
write_version_pinsinscripts/version-pins.shand adjust tests to validate pin-writing and PR behavior (including soft-fail on PR stage). - Update Makefile help/docs + changelog/dev-log to reflect the new one-command workflow.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/versions-pr.sh | New hermetic test covering the PR/branch workflow and “checkout untouched” contract. |
| tests/version-upgrade.sh | Updates fixtures/assertions for cloak build + pin-write-from-built behavior + PR soft-fail. |
| scripts/versions-pr.sh | New script to commit/push the pin bump from a detached worktree and open/update a PR. |
| scripts/version-upgrade.sh | Builds cloak, writes pins from built versions, and runs PR stage (opt-out via PR=0). |
| scripts/version-pins.sh | Adds shared write_version_pins implementation and includes cloak wrapper pin in var list. |
| scripts/update-version-pins.sh | Removes duplicated pin-writer and uses the shared write_version_pins. |
| Makefile | Passes cloak image/dockerfile vars, threads PR env, and updates help text. |
| DEV-LOGS.md | Adds a dev log entry for the new versions-up flow. |
| CHANGELOG.md | Documents the new versions-up behavior in Unreleased. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| REPO_ROOT=${REPO_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)} | ||
| REMOTE=${REMOTE:-origin} | ||
| BASE_BRANCH=${BASE_BRANCH:-main} | ||
| PR_BRANCH=${PR_BRANCH:-chore/version-pins-refresh} | ||
| PINS_NAME=versions.env |
| for var in "${VERSION_PIN_VARS[@]}"; do | ||
| old=$(sed -n "s/^$var=//p" <<< "$old_pins") | ||
| new=$(sed -n "s/^$var=//p" < "$PINS_NAME") | ||
| if [[ -n $new && $old != "$new" ]]; then | ||
| bumps+=("- $(pin_label "$var") $(short_val "${old:-none}") -> $(short_val "$new")") | ||
| fi | ||
| done |
Closes #538.
make versions-up && make versions-pin && make build-cloakplus ahand-written PR was the team flow. Three problems:
drift to a version never build-tested (claude-code ships several
times a day)
Now
make versions-upis the whole flow:and --only)
origin/main, push HEAD:chore/version-pins-refresh (force; bump
branch is throwaway by contract), gh pr create unless one is open.
User checkout, branch, and staged files stay untouched.
PR=0 keeps the bump local. A failed PR stage warns and exits 0 — a
dead push must not sink a finished build. versions-pin and build-cloak
stay as standalone targets.
write_version_pins moved to shared version-pins.sh; the byte-for-byte
round-trip guard still covers it.
Tests: cloak build args, pin write from built versions, outage
no-write, PR soft-fail (tests/version-upgrade.sh); hermetic
versions-pr suite with real git against a bare origin and fake gh
(tests/versions-pr.sh). test-version-targets and test_release_utils
pass; shellcheck clean on touched scripts.
🤖 Generated with Claude Code