Maintain Threshold CI actions and vendor npm-version-bump - #1
Merged
Conversation
Set up Node and Corepack before preprocessing so consumer Yarn shims retain PATH precedence for both installation and docgen. Reject a Yarn/lockfile format mismatch before dependencies can be re-resolved. Cover shim precedence, locked install flags, missing lockfiles, and failure propagation with workflow regression tests.
piotr-roslaniec
added a commit
to threshold-network/tbtc-v2
that referenced
this pull request
Sep 11, 2026
Use the maintained actions from [threshold-network/ci #1](threshold-network/ci#1), pinned to `20b35345d276a3c7365e3829b8078387a7c9dccb`. This includes the vendored npm-version-bump action. Completion payloads and upstream-build queries use the Threshold module identifiers configured by the new release manager. Update obsolete action runtimes in the affected workflows. Artifact uploads preserve hidden deployment metadata when moving to artifact v4. The producer and all consumer migrations must merge before starting a new inter-repository release pipeline; `CI_GITHUB_TOKEN` must be configured where missing. npm/cloud/docs credentials stay in their existing consumer repositories. Validation: actionlint passes for every changed workflow; producer paths, input names, commit pins, dispatch input contracts, and module/query identifiers were checked against the producer. Its 51 tests and four standalone action-bundle checks pass in GitHub CI. Release/deployment/publishing paths were not invoked during validation. The shared docs workflow is now owned and pinned. The docs destination rename remains in #1135; the JavaScript Electrum dependency switch remains in #1140. Monitoring's Docker action upgrades preserve its prior image format by disabling provenance attestations.
- Decouple dispatch workflow-file ref from upstream_ref; consumer workflows run on their default branch, upstream_ref stays a build-branch input (notify.js pattern) - npm-version-bump: coerce is-prerelease as boolean (drop environment default so preid inheritance runs), treat npm stderr as warnings, resolve on view E404 (first-publish fallback), reject empty version output, validate storeVersionInFile; un-skip stale tests and add coverage for false/inheritance/404/warning paths - notify-workflow-completed: reject non-array upstream_builds payloads - load-env-variables: bearer-authenticated ref fetch, restrict env-import values, fix README example YAML, document full-checkout dependency, test CONFIG_REF path - upstream-builds-query: coerce result values before trim, threshold-network test fixtures, document per-query outputs - lib: inline config singleton, note bundling constraint in default-config shim, threshold-network typedef example; drop stale nodeVersion comment; make the dist CI gate untracked-aware (catches missing ncc chunks) - Tests: pin exact release chain + dropped destinations, cover fresh-release dispatch, cover docs publish/PR-create/dedup/no-change branches - Docs: MIGRATION re-pin step with merge-base verification, UPSTREAM divergence disclosure + re-vendoring procedure, action README inputs and dev flows - Regenerate action bundles
piotr-roslaniec
added a commit
to threshold-network/keep-core
that referenced
this pull request
Sep 12, 2026
Repoint Go Electrum to the Threshold fork at the same immutable upstream revision (`6038cb594daa`), preserving the imported module path and implementation. Update go.sum for the new source and remove the old source checksums. Use the maintained actions from [threshold-network/ci #1](threshold-network/ci#1), pinned to the merge commit `86506f8dcdd80179a95ee149cccf4ce9a793ad8d` of PR #1, merged to the producer's main branch. This includes the vendored npm-version-bump action. Completion payloads and upstream-build queries use the Threshold module identifiers configured by the release manager. The consumed action bundle is byte-identical between this pin and the ci main tip that followed (the next producer merge touched only the docs workflow, its README, and tests), so the pin excludes no reviewed action code. Update obsolete action runtimes in the affected workflows. Environment values for release jobs (GCR registry/project, network id) resolve from the pinned threshold-network/ci revision; changing them requires re-pinning the SHA. The consumer migrations must merge before starting a new inter-repository release pipeline; `CI_GITHUB_TOKEN` must be configured where missing. npm/cloud/docs credentials stay in their existing consumer repositories. Validation: actionlint passes for every changed workflow; producer paths, input names, commit pins, dispatch input contracts, and module/query identifiers were checked against the producer. Its 51 tests and four standalone action-bundle checks pass in GitHub CI. Release/deployment/publishing paths were not invoked during validation. The shared Docker action also uses supported action runtimes, with provenance disabled to preserve the prior image format. keep-core's local docs workflow is already owned and remains local. This change is independent of the helper/local-network/common-library PRs already open. Additional validation: `go test -mod=readonly ./pkg/bitcoin/...` passes against the fork; the fork's tests and vet pass on Go 1.24.1 and 1.26.0 in CI. GitHub CI: all 1,678 Go unit tests and the Docker/runtime/binary builds pass, as do the contracts test/lint/Slither/deployment-dry-run jobs. The separate full integration suite also passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keep-owned action references still control version bumps, documentation builds, and inter-repository release notifications in Threshold repositories. Maintain those actions here and vendor
npm-version-bumpintoactions/npm-version-bump, retaining its MIT license and upstream revision.The maintained actions run on Node 24 with one locked npm workspace and reproducible, committed bundles. Environment configuration comes from the pinned action revision by default. Dispatches and payload identifiers target Threshold; the configured chain retains Solidity contracts → Beacon → ECDSA → tBTC → client and drops obsolete coverage-pools, archived dashboard, and non-dispatchable Arbitrum destinations. Dispatch failures are awaited and propagated. npm subprocess arguments use argv/cwd, preserving prerelease formatting and handling directories with spaces.
The reusable docs workflow supports Classic/modern Yarn, artifact v4, and gh-based authenticated pushes/PR creation. Source files, not generated bundles, are the primary review surface;
UPSTREAM.mdrecords provenance andMIGRATION.mdcovers the coordinated rollout. Consumer PRs pin this producer commit and update their build payload/query identifiers together.Validation: clean
npm ci; lint; 51 tests passed (2 pre-existing skipped tests); all four standalone bundles tested without source or node_modules; actionlint; zero npm audit findings. Tests mock dispatches and registry results. No releases, deployments, documentation pushes, or real workflow dispatches were performed.Merge this producer before the consumer migrations, and configure
CI_GITHUB_TOKENin this repository and any consumers missing it before using the cross-repository release manager. Inherited v2 tags still reference Keep's implementation and must not be used for the maintained actions.Consumer PRs: keep-core #4329, tbtc-v2 #1148, and solidity-contracts #195. The docs workflow accepts a
nodeVersioninput for legacy Hardhat consumers; Node 24 is the JavaScript action runtime.Upstream Node-runtime modernization, Ropsten defaults, module-name cleanup, and the single-command bundle-build request are incorporated or superseded. The optional docs-comment upsert request is carried into #2; existing consumers keep comments disabled.