fix(ci): harden dependency watch contract#210
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3931da038
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (readback.data.title !== title || readback.data.body !== body) { | ||
| throw new Error(`Dependency alert issue readback mismatch for #${issueNumber}`); | ||
| } | ||
| core.setOutput('issue_action', issueAction); |
There was a problem hiding this comment.
When the create/update call succeeds but issues.get fails or returns mismatched content, this throws before issue_action and issue_number are written. The always-run completion step then sees an attempted issue step with empty action/number and reports mutation_count:0 and destination_id:null, losing the partial mutation accounting the new terminal state is meant to provide. Set those outputs as soon as mutation.data.number is known, before the readback failure path.
Useful? React with 👍 / 👎.
1 participant
What
Why
The scheduled workflow could overlap, mutate an issue without destination readback, and finish without a machine-readable terminal state. That made successful execution distinguishable from neither partial writes nor broken output contracts.
How
The issue-writing step exposes its action and destination ID, fetches the resulting issue, and fails on title/body mismatch. The final always-run step records success, failure, skip, mutation count, and readback state.
Testing
node scripts/ci/check-dependency-watch-contract.mjsnode scripts/ci/check-workflow-command-drift.mjspnpm health:repo:checkspnpm perf:bundlepnpm perf:buildpnpm perf:lighthousepnpm perf:assetspnpm perf:apiblocked because BASE_URL is not configuredpnpm perf:dbblocked because DATABASE_URL is not configuredRisks
Low. The issue mutation condition and issue content are unchanged. A readback mismatch now fails visibly instead of silently succeeding. Concurrent runs queue rather than cancel.
Performance impact
No product-runtime impact. The workflow adds one GitHub issue GET only when an alert issue is created or updated. Bundle, build, Lighthouse, and asset gates passed.
Lockfile rationale
No lockfile changes.
Screenshots
Not applicable; no UI changes.