You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The platform ships as one version-locked train and the frontend enters the changesets pipeline exactly once: when .objectui-sha moves and bump-objectui.sh writes the @objectstack/console changeset for the range it crossed. Everything objectui merged after the pin is, by construction, in no changeset, no CHANGELOG and no release page. That is the failure scripts/check-objectui-pin-fresh.mjs exists for (#3340) — cutting v16 that way lost four frontend changes, two of them minor features.
That gate is enforcing on the Version Packages / release PR. So this is not cosmetic staleness: at the next GA cut it is red, and 149 commits of frontend are missing from the record.
Procedure — use the script, do not hand-edit the pin
scripts/bump-objectui.sh # bumps .objectui-sha to ../objectui HEAD + writes the changeset
pnpm sdui:manifest # the other half (ADR-0082 D4 parity ratchet)
scripts/bump-objectui.sh --help prints the full contract. Two things it does that a manual edit does not: it derives the @objectstack/console changeset from objectui's own declared changesets over the range (package names decide inclusion, declared level decides the bump — nothing inferred from commit subjects, #4731), and it refuses to pretend a truncated walk is a complete one.
The trap that is live right now
The local objectui checkout is shallow — git -C ../objectui rev-parse --is-shallow-repository returns true. This is exactly the shape of objectstack#9408: a walk that stops inside the range still answers, and the oldest visible commit (shown as parentless, diffed against the empty tree) absorbs a whole batch. On the bump that produced the current pin's changeset, that credited 36 of 119 entries to a single commit that adds exactly one.
So:
Do NOT set OBJECTUI_NO_DEEPEN=1. Let the script deepen (git fetch --unshallow, measured ~6 s / ~4 MB on objectui).
After the bump, verify the changeset is not the degraded one. The degraded path labels itself — ⚠️ Degraded list — and names only the tip subject. A degraded entry becomes permanent published CHANGELOG text. If you get one, deepen and re-run rather than editing the table by hand.
The range is long enough that CONSOLE_CHANGES_MAX (default 100) may fire. If it caps, the script says so with the real count — carry that number into the PR body rather than letting it read as a complete list.
A free correctness check on the digest
The range contains objectui's @changesets/cli v3 migration (objectui e7c3b3e91, PR objectui#5307). That PR ships a changeset with empty frontmatter — changesets' own "releases nothing". So it must not appear in the @objectstack/console list. If it does, the digest is reading commit subjects instead of declarations and the whole list is suspect.
Acceptance
.objectui-sha equals objectui's main tip at bump time; record which SHA and its date in the PR body.
Exactly one @objectstack/console changeset, derived (no ⚠️ Degraded list banner), with the resolved bump level and why it resolved that way.
pnpm sdui:manifest actually run — Playwright chromium is pre-installed in this environment at /opt/pw-browsers and PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 is set, so do not run playwright install. If it produces parity changes, include them; if it cannot run, say so explicitly rather than skipping in silence (the gate exits 1 on a missing manifest since check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690, so "it passed" without running it is not a thing).
CI's Console Pin Gate green (does the pinned SHA still build) — note this is a different question from freshness; both must be green.
Non-goals
No release. No publish, no version tag, no release-workflow dispatch, no merging of a Version Packages PR.
Do not touch .github/workflows/cut-rc.yml — it has its own pin handling and its own gate.
Do not edit content/docs/releases/**. The changeset is this PR's input to the release notes; release notes are written centrally at release time.
objectui's own version PR (objectui#4655, would cut 17.6.0) is open and unmerged and is none of this card's business — the pin is a SHA, not an npm version.
Measured on
origin/main, not recalled:.objectui-sha(objectstack)82a94170c4058d45— objectui, 2026-08-17 21:51origin/main0fd11444a89e5711— 2026-08-20 04:51Why this matters beyond "it's old"
The platform ships as one version-locked train and the frontend enters the changesets pipeline exactly once: when
.objectui-shamoves andbump-objectui.shwrites the@objectstack/consolechangeset for the range it crossed. Everything objectui merged after the pin is, by construction, in no changeset, no CHANGELOG and no release page. That is the failurescripts/check-objectui-pin-fresh.mjsexists for (#3340) — cutting v16 that way lost four frontend changes, two of themminorfeatures.That gate is enforcing on the Version Packages / release PR. So this is not cosmetic staleness: at the next GA cut it is red, and 149 commits of frontend are missing from the record.
Procedure — use the script, do not hand-edit the pin
scripts/bump-objectui.sh --helpprints the full contract. Two things it does that a manual edit does not: it derives the@objectstack/consolechangeset from objectui's own declared changesets over the range (package names decide inclusion, declared level decides the bump — nothing inferred from commit subjects, #4731), and it refuses to pretend a truncated walk is a complete one.The trap that is live right now
The local objectui checkout is shallow —
git -C ../objectui rev-parse --is-shallow-repositoryreturnstrue. This is exactly the shape of objectstack#9408: a walk that stops inside the range still answers, and the oldest visible commit (shown as parentless, diffed against the empty tree) absorbs a whole batch. On the bump that produced the current pin's changeset, that credited 36 of 119 entries to a single commit that adds exactly one.So:
OBJECTUI_NO_DEEPEN=1. Let the script deepen (git fetch --unshallow, measured ~6 s / ~4 MB on objectui).⚠️ Degraded list— and names only the tip subject. A degraded entry becomes permanent published CHANGELOG text. If you get one, deepen and re-run rather than editing the table by hand.CONSOLE_CHANGES_MAX(default 100) may fire. If it caps, the script says so with the real count — carry that number into the PR body rather than letting it read as a complete list.A free correctness check on the digest
The range contains objectui's
@changesets/cliv3 migration (objectuie7c3b3e91, PR objectui#5307). That PR ships a changeset with empty frontmatter — changesets' own "releases nothing". So it must not appear in the@objectstack/consolelist. If it does, the digest is reading commit subjects instead of declarations and the whole list is suspect.Acceptance
.objectui-shaequals objectui'smaintip at bump time; record which SHA and its date in the PR body.@objectstack/consolechangeset, derived (no⚠️ Degraded listbanner), with the resolved bump level and why it resolved that way.pnpm sdui:manifestactually run — Playwright chromium is pre-installed in this environment at/opt/pw-browsersandPLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1is set, so do not runplaywright install. If it produces parity changes, include them; if it cannot run, say so explicitly rather than skipping in silence (the gate exits 1 on a missing manifest since check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690, so "it passed" without running it is not a thing).Non-goals
.github/workflows/cut-rc.yml— it has its own pin handling and its own gate.content/docs/releases/**. The changeset is this PR's input to the release notes; release notes are written centrally at release time.