fix(ci): load preview publisher without Git checkout - #532
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
vouch:trusted
This was referenced Sep 12, 2026
Contributor
Thread transfer impact✅ Thread transfer remains within every enforced ceiling.
Baseline: Scenario and decoded snapshot size10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The preview publisher added in #528 fails before its helper runs: checkout credential cleanup traverses vendored Git links that have no root submodule metadata, even in a sparse checkout (observed failure). This prevents both publication preparation and cleanup.
Both trusted jobs now load only the Node core-only publisher helper through the Contents API at the full
github.workflow_sha. They verify its path, file type, encoding, byte length and Git blob digest before writing it to a private temporary file and executing it. Existing opt-in, current-head, permissions and release reconciliation checks remain intact.Validation: 84 focused release/preview tests pass, including 22 new tests that execute the actual workflow loaders and reject altered content, mutable refs and API failures before executing code. Actionlint 1.7.12, scoped Vite+ 0.3 formatting/lint and commit hooks pass. Both loaders also verified and loaded the actual GitHub response at immutable commit
032cfce27518162322f7a18ee6e3bae63a057a43(12,523 bytes; blob9110dd07f44f5092faedaefda2dea37334843f96), stopping before any publication or cleanup operation. No preview label, artifact build or release publication was triggered. Independent review completed; final CI remains the landing gate.Follow-up for #528; tracked by #526.
Implemented and reviewed by GPT-6 agents in the Codex harness.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.