feat(deploy-vercel): restore submodule + Deno-repo support behind no-op defaults, add backcompat gate - #8
Merged
Conversation
…nt, behind no-op defaults Ports four inputs that deploy-vercel.yml lost when main diverged from development, so Deno-based repos with private submodules (e.g. protocol-doc-ui) can call this workflow @main: - submodules / op-submodules-token-path: checkout submodules, optionally with a dedicated 1Password-resolved PAT scoped to the submodule repo only (steps/setup gains the matching submodules/submodules-token inputs and the dedicated-token fetch step, copied from development). - setup-install / setup-node-cache: let a repo without pnpm-lock.yaml skip pnpm install --frozen-lockfile and actions/setup-node's pnpm cache, both of which hard-fail when no lockfile exists. All defaults (submodules=false, token empty, install=true, cache=pnpm) reproduce the current behavior exactly — existing callers are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Guards the public interface consumer repos depend on @main: removing an input/secret/output, flipping optional->required, adding a required input, or changing a default/type now fails CI (the existing node --test globs pick these up on every PR and push to main — no pipeline changes). - lib/workflowInterfaces.js: vendored strict-subset YAML extractor for workflow_call and composite-action interfaces (flatYaml.js policy: no deps, hard error on unrecognized shapes). - lib/contractDiff.js: classifies interface diffs as breaking vs backward-compatible additions, from the caller's point of view. - lib/backcompat.test.js + contracts/interfaces.json: snapshot ratchet. Additions just need 'npm run contracts:update'; breaking changes require ALLOW_BREAKING=1, making the break explicit in the PR diff. - contracts/consumers.json: known consumer call shapes (protocol-doc-ui staging/preview deploys) revalidated against the current interfaces. - _selftest.yml: disable setup-node's pnpm cache in the setup smoke — it hard-fails with no pnpm-lock.yaml to hash (latent break), and doing so runtime-exercises the lockfile-less consumer shape. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The runner template-evaluates action.yml at load time, descriptions
included: the literal ${{ inputs.* }} / ${{ steps.* }} examples in the
secret-refs and outputs descriptions made EVERY use of this action fail
at 'Set up job' with 'Unrecognized named-value'. Rewrite the examples
without the dollar sign and say so.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ace) Resolves the js/file-system-race alert on updateContracts.js and the same latent pattern in collectInterfaces: reading directly and handling ENOENT leaves no window between check and use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tyhonchik
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
When
maindiverged fromdevelopment,deploy-vercel.ymllost four inputs that Deno-based repos with private submodules depend on:submodules,op-submodules-token-path,setup-installandsetup-node-cache. Any consumer passing them (e.g.aragon/protocol-doc-ui) fails caller validation outright against@main, and even without them the forcedpnpm install --frozen-lockfile/ pnpm cache and the missing submodule checkout make the deploy impossible.What
e57cf38— ports the four inputs and their wiring fromdevelopment, all behind defaults that reproduce currentmainbehavior exactly (submodules=false, empty token,install=true,cache=pnpm).steps/setupgainssubmodules/submodules-tokenand the dedicated-token submodule fetch step. Existing callers are unaffected.7121d6d— backward-compatibility gate so this can't happen silently again:lib/backcompat.test.js(runs in the existing CI test globs on every PR/push to main) compares the extracted interface of every reusable workflow and composite action against the committed snapshotcontracts/interfaces.json, plus known consumer call shapes incontracts/consumers.json. Removing an input/secret/output, flipping optional→required, adding a required input, or changing a default/type fails CI;npm run contracts:updateregisters benign additions and refuses breaking changes withoutALLOW_BREAKING=1. Also fixes a latent_selftest.ymlfailure (setup-node pnpm cache with no lockfile).e10f11a— fixes a pre-existingmainbug that broke every use ofsteps/credential-retrieval: literal expression syntax in its doc-example descriptions made the runner's manifest load fail with "Unrecognized named-value" at Set up job.Tested
End-to-end from
aragon/protocol-doc-uivia a (now deleted) throwaway self-referencing branch:submodulesinput / changing a default makes CI fail naming the affected consumer.Follow-up after merge
Flip
protocol-doc-ui's twouses:lines from@developmentto@main.🤖 Generated with Claude Code