Release v0.10.0 - #119
Merged
Merged
Release v0.10.0#119
Conversation
Ships the two hosted-runner fixes the action harness caught on its first run,
and the harness itself.
Minor rather than patch because the setup-environment cache path changed:
`path` is part of the actions/cache version, so every existing conda cache
under `${CONDA}/envs` becomes unreachable and the first hosted-runner build
after `v0` moves pays one full environment solve. Self-correcting and
one-time, but visible enough not to bury in a patch release. Containers are
unaffected — all three shipped templates run in container mode, which neither
fix touches.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Prepares the v0.10.0 release by promoting the previously “Unreleased” notes into a dated 0.10.0 section, aligning the changelog with the release described in #113 / the referenced harness + hosted-runner fixes.
Changes:
- Add a new
## [0.10.0] - 2026-08-05heading immediately afterUnreleasedto cut the release. - Leave
Unreleasedempty and associate the existing top-of-file entries with the 0.10.0 release.
This was referenced Aug 5, 2026
mmcky
added a commit
that referenced
this pull request
Aug 5, 2026
…116 item 5) (#124) * ci(harness): decide relevance in a gate job, not with paths: filters Prerequisite for making `Action harness: all checks` a required check on main (#116 item 5). A `paths:` filter suppresses creation of the workflow RUN, not just its jobs, so no check run is ever published for that commit and a required check sits in "Expected — waiting for status to be reported" forever. GitHub documents this directly ("Troubleshooting required status checks", Handling skipped but required checks): a workflow skipped by path filtering blocks merging, whereas a job skipped by a conditional reports Success. We saw it live — release PR #119 touched only CHANGELOG.md and GitHub reported "no checks reported on the branch"; docs PR #121 likewise ran nothing. Note #116 item 5's own suggestion — a companion workflow with negated paths — does not work: `paths-ignore` is not the complement of `paths`, so a PR touching both covered and uncovered paths fires BOTH workflows and produces two same-named check runs on one SHA. That case is the norm here, not an edge case. So: both `paths:` filters go, the workflow always runs, and a `gate` job decides relevance. Only the four root jobs take `needs: gate`; everything else already chains off them, and a job whose needs were skipped is itself skipped. The decision rule is an IGNORE list, not a cover list, and that direction is the point. For a required check the expensive mistake is a green earned by running nothing, so anything unrecognised — a new action directory, a new fixture — runs the whole harness. A cover list would invert this: forgetting to extend it would silently rubber-stamp untested action changes, where today the same omission blocks the merge. The gate also self-tests. It derives the must-always-run set from the `uses: ./<action>` lines in the workflow itself, so a typo that widened IGNORED to swallow a real action path fails the gate closed rather than skipping the suite — which harness-summary would otherwise accept as a legitimate shape. Deriving it from the workflow means future coverage (e.g. publish-gh-pages) is protected with no second edit. Permissions are job-scoped, not workflow-scoped: on a fork pull_request the other jobs run PR-authored composite-action code via `uses: ./`, and none of them needs a pull-request scope. harness-summary is rewritten to certify both shapes — all-ran and all-skipped — to reject a vacuous empty job set, and to fail when the gate and the fan-out disagree. Verified locally before pushing, by extracting both scripts from the YAML and running them against mocked inputs: the gate over the real file lists of #119 and #121 (both correctly irrelevant), an action change, a fixture change, a workflow_dispatch, push with no before-SHA, a compare 404 from a force-push (fails open), a gh API error (fails closed), and a deliberately widened IGNORED (fails closed with the self-test error). The summary was exercised across all ten reachable shapes. Refs #116 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci(harness): anchor the gate self-test to real step invocations The first CI run of this PR reported: gate self-test passed; harness invokes: build-jupyter-cache build-lectures publish-gh-pages restore-jupyter-cache setup-environment publish-gh-pages is not invoked by the harness. The unanchored grep was matching the action name out of the gate's own COMMENT, which mentioned `uses: ./publish-gh-pages` as an example of future coverage. Harmless in effect — the extra entry only enlarges the must-run set, so it fails safe — but it made the self-test assert something other than what it appears to, which is precisely the failure mode this job exists to prevent. Anchoring to the start of a line counts only real step invocations. Caught by reading the job's own output rather than by a test, which is worth noting: the self-test cannot detect this class itself. Refs #116 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(tests): correct the harness job breakdown Copilot review. The line claimed "a relevance gate plus 15 jobs exercising ... via uses: ./ local paths", which implies harness-summary exercises actions. It does not — it invokes nothing and only certifies the others. The real shape is the gate, 14 action-invoking jobs, and the summary. Verified against the workflow rather than counted by hand. Refs #116 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGELOG-only, matching #113. Ships the two hosted-runner fixes the action harness caught on its first run, plus the harness itself.
Why minor, not patch
Both changes are bug fixes and no input or output changed shape, so strict semver would say
0.9.1. Minor is the more honest signal here:setup-environment's conda cache moved from${CONDA}/envsto${CONDA}/envs/<environment-name>, andpathis part of theactions/cacheversion — so every existing cache under the old path becomes unreachable the momentv0moves, and the first hosted-runner build after that pays one full environment solve. It is self-correcting and one-time, but it is a visible behaviour change rather than a silent fix.What consumers actually get
build-lecturesno longer fails a successful buildexitbuiltin tripped~/.bash_logout, whoseclear_consolefailure overrode the passed status. Containers have no~/.bash_logout.setup-environmentconda cache can now be restoredBoth are gated to non-container mode, and all three shipped templates (
ci.yml,cache.yml,publish.yml) run in containers. So the default consumer path is unchanged by this release — which is also why neither bug surfaced in production for as long as it did.Unblocks
Moving
v0past this release is what letsbuild-jupyter-cache's pinnedbuild-lectures@v0pick up the exit fix. That retires therm -f ~/.bash_logoutworkaround in the harness'sbjc-smokejob — CONTRIBUTING step 5's tripwire, and item 1 of #116. A follow-up PR removes it once the tag has moved, and is self-testing: it touches a covered path, sobjc-smokemust go green with~/.bash_logoutpresent on the runner.Refs #116, #100
🤖 Generated with Claude Code