From 45719b6e7d0fd7481f3c9f6c8f0175f9bc235ca6 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Thu, 5 Nov 2026 16:02:31 -0500 Subject: [PATCH 1/2] ci: publish a PR opened with `preview` from its label run only A label set when a PR is opened fires a `labeled` run of its own. On a branch other than feat/fix, both that run and the `opened` run published the commit, so the second failed as a duplicate version. The `opened` run no longer publishes for the label; synchronize and reopened runs still do while the PR has it. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018BeQzzyPntbJyPicYWDqo3 --- .github/workflows/ci.yml | 14 +++++++------- docs/development.md | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f116aa4..5241526 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -157,15 +157,15 @@ jobs: name: Publish preview runs-on: ubuntu-latest needs: test - # Opened, synchronize and reopened runs publish on a feat/fix branch or with `preview`; a label run only when it - # adds `preview` to any other branch. + # One publish per commit. A feat/fix branch publishes on opened, synchronize and reopened. Any other branch publishes + # from the label run that adds `preview` (a PR opened with it too), then on synchronize and reopened while it has it. if: >- - ${{ (github.event.action == 'labeled' - && github.event.label.name == 'preview' + ${{ (github.event.action != 'labeled' + && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix'))) + || (github.event.action == 'labeled' && github.event.label.name == 'preview' && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix')) - || (github.event.action != 'labeled' - && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') - || contains(github.event.pull_request.labels.*.name, 'preview'))) }} + || ((github.event.action == 'synchronize' || github.event.action == 'reopened') + && contains(github.event.pull_request.labels.*.name, 'preview')) }} # One publish to `pr-` at a time: label runs don't share the workflow's group. concurrency: group: ${{ github.workflow }}-preview-${{ github.ref }} diff --git a/docs/development.md b/docs/development.md index 4e62a8b..1f2cadf 100644 --- a/docs/development.md +++ b/docs/development.md @@ -51,7 +51,7 @@ In the repo, `pnpm rr` and `pnpm vland`, or `rr` and `vland` with mise, run each ## CI -- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate. +- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview, and a pull request opened on such a branch with `preview` publishes from that run only. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate. - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends the two configs that `@rrlab/cli` ships, `run-run/cli/lefthook/base.yml` and `run-run/cli/lefthook/turborepo.yml`, and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when they are missing from `node_modules`. Their jobs are listed in [the cli's README](../run-run/cli/README.md#git-hooks). `lefthook/turborepo.yml` is not dx's: it holds the hooks that other repos fetch remotely. - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit). From 43a0b19748e4d2b0149aaa711ad751435404bf96 Mon Sep 17 00:00:00 2001 From: "Ricardo Q. Bazan" Date: Thu, 5 Nov 2026 16:05:54 -0500 Subject: [PATCH 2/2] ci: keep the preview comment to what the `if` does MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop "one publish per commit" (a reopen on a published commit publishes it again), keep each condition of the label clause on its own line, and say in ยง CI which run publishes a PR opened with `preview`. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018BeQzzyPntbJyPicYWDqo3 --- .github/workflows/ci.yml | 7 ++++--- docs/development.md | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5241526..70072f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -157,12 +157,13 @@ jobs: name: Publish preview runs-on: ubuntu-latest needs: test - # One publish per commit. A feat/fix branch publishes on opened, synchronize and reopened. Any other branch publishes - # from the label run that adds `preview` (a PR opened with it too), then on synchronize and reopened while it has it. + # A feat/fix branch publishes on opened, synchronize and reopened. Any other branch publishes from the label run + # that adds `preview` (a PR opened with it gets one too), then on synchronize and reopened while it has it. if: >- ${{ (github.event.action != 'labeled' && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix'))) - || (github.event.action == 'labeled' && github.event.label.name == 'preview' + || (github.event.action == 'labeled' + && github.event.label.name == 'preview' && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix')) || ((github.event.action == 'synchronize' || github.event.action == 'reopened') && contains(github.event.pull_request.labels.*.name, 'preview')) }} diff --git a/docs/development.md b/docs/development.md index 1f2cadf..b855a5f 100644 --- a/docs/development.md +++ b/docs/development.md @@ -51,7 +51,7 @@ In the repo, `pnpm rr` and `pnpm vland`, or `rr` and `vland` with mise, run each ## CI -- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview, and a pull request opened on such a branch with `preview` publishes from that run only. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate. +- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview, and a pull request opened on such a branch with `preview` publishes from its label run, not its `opened` run. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate. - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends the two configs that `@rrlab/cli` ships, `run-run/cli/lefthook/base.yml` and `run-run/cli/lefthook/turborepo.yml`, and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when they are missing from `node_modules`. Their jobs are listed in [the cli's README](../run-run/cli/README.md#git-hooks). `lefthook/turborepo.yml` is not dx's: it holds the hooks that other repos fetch remotely. - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit).