ci(create-objectstack): scaffold-E2E gate + registry canary + release-time template dep sync - #2912
Merged
Merged
Conversation
…-time template dep sync Close the remaining template-staleness gaps behind #2907 (fixes #2908): - .github/workflows/scaffold-e2e.yml - scaffold-local (PRs touching the scaffolder / examples/docker): scaffold with the repo-built dist, install from the registry (with a latest fallback for the unpublished-version window right after a bump), validate + build the generated project, boot it from the artifact and probe /api/v1/health + /ready, then docker build/run the examples/docker packaging against the same probes — the docker files finally get CI coverage. - registry-canary (nightly + manual): npx create-objectstack@latest across every template in the registry (blank + 5 remote), gate each generated project, full boot probe for blank — catches registry/publish breakage the way a real first-run user would. - scripts/sync-template-versions.mjs, chained into the root `version` script after sync-protocol-version.mjs: rewrites the blank template's @objectstack/* ranges to the scaffolder's own version at release time, so a bump can never ship a stale template. Release PRs from changesets/action skip CI (default-token anti-recursion), so version time is the one spot that cannot be bypassed — same rationale as sync-protocol-version.mjs. Every step of both jobs that can run outside Actions was executed locally: scaffold → npm install → validate → build → boot + health/ready probes, the validate-script detection, the latest-fallback rewrite, and both sync-script paths (idempotent + rewrite). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Em3ky9uu6zw2cYzVhqCij2
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
ci/cd
dependencies
os-zhuang
marked this pull request as ready for review
July 14, 2026 11:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2908
背景
#2907 修掉了模板落后 8 个大版本的事故并加了两层防线（生成时依赖同步、提交时一致性棘轮）。本 PR 补齐剩余三层，让这类腐化在每个环节都有机器拦截：
变更
1.
.github/workflows/scaffold-e2e.yml（新 workflow，双 job）scaffold-local（PR 触发，paths 限定脚手架/examples/docker/workflow 自身）：latest回退）→validate+build→ 从产物os start起服务并探测/api/v1/health、/api/v1/ready→ 复制examples/docker文件docker build+docker run再探测。examples/docker从此有 CI 覆盖（fix(create-objectstack,cli,docs): make the third-party onboarding path actually work on the current release #2907 里因会话无 docker daemon 未能验证的部分）。registry-canary（nightly cron23 3 * * *+ 手动触发）：npx create-objectstack@latest对已发布包跑同样流程，matrix 覆盖注册表全部 6 个模板（blank + 5 个远程模板）；远程模板跑到build门禁（它们没有 validate 脚本），blank 额外做启动探测。2.
scripts/sync-template-versions.mjs+ version 链发版时（changesets/action 调
pnpm run version）自动把 blank 模板的@objectstack/*区间改写为脚手架自身的 major —— 与既有sync-protocol-version.mjs完全同构，理由也相同：changesets 开的 release PR 用默认 token 不触发 CI，棘轮测试拦不住它，version 时刻是唯一绕不过去的位置。防线全景（本 PR 后）
scaffold-localE2E（本 PR）sync-template-versions.mjs（本 PR）registry-canary（本 PR）验证
npm install（3 分钟，442 包）→validate ✓→build ✓→os start+ health/ready 探测 ✓、validate-script 检测单行 ✓、latest 回退改写 ✓。^14.0.0时不写文件）与改写（伪造^13.0.0→ 正确改回并逐行打印）。check-role-word/ ESLint 通过。pull_request触发（paths 含 workflow 自身，本 PR 会触发scaffold-local），nightly job 则在合并后次日凌晨首跑。🤖 Generated with Claude Code
https://claude.ai/code/session_01Em3ky9uu6zw2cYzVhqCij2
Generated by Claude Code