v3.2.6: patch upstream push-to-pantheon unshallow + fix verify dev→master mapping - #103
Merged
Merged
Conversation
reusable-pantheon-deploy-{dev,rc-multidev,epic-multidev,pr-multidev} all
checked out with fetch-depth: 1. upstream pantheon-systems/push-to-pantheon
@0.9.0's prepare_site_root then trips "fatal: shallow file has changed
since we read it" exit-128 after our pre-commit step writes a new commit
on top of the shallow HEAD.
bumping fetch-depth to 0 removes .git/shallow entirely so the race can't
fire. small checkout cost vs an unrecoverable mid-step failure that aborts
the deploy before the verify-after-push step can run.
scoped to the four reusable workflows that call our pantheon-push composite
(the four with the pre-commit step). reusable-deploy-pantheon.yml and
reusable-deploy-multidev.yml don't call pantheon-push so left alone.
repro: Yale Health rc-2026-21 first-run, 2026-05-22 run id 70394172925.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Upstream pantheon-systems/push-to-pantheon@0.9.0 has an unguarded `git fetch --unshallow origin` at scripts/main.sh:352 inside prepare_site_root. Same bug exists 0.8.0 (action.yml:363) through 0.9.2, never fixed upstream. The bug fires two ways: - fetch-depth: 1 → races with "shallow file has changed since we read it" (intermittent, exit 128) - fetch-depth: 0 → "--unshallow on a complete repository does not make sense" (deterministic, exit 128) Both abort the deploy in prepare_site_root before our verify-after-push step can run. Upstream's bobheadxi/deployments@v1 then marks the GitHub deployment "success" despite the failure. Fix: sed-patch upstream's main.sh on the runner before invoking the action, appending `|| true` to the unshallow call. Safe because upstream itself does the proper guarded unshallow later in push_to_pantheon (line 382: is-shallow-repository check + `||` fallback) — the line we patch is redundant defense, not the only deepen. Patch step is idempotent and fails loudly if upstream changes shape (missing file, sed pattern miss). UPSTREAM_VERSION env var is the canary for upstream bumps. Also reverts the fetch-depth: 0 misadventure on the 4 pantheon-push- consuming reusables back to fetch-depth: 1 — that was an attempt to sidestep the race that just traded it for the deterministic error. Repro: Yale Health rc-2026-21 first-run 2026-05-22 run id 70394172925 (shallow race), follow-up run id 70396096336 (complete-repo error). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…internal refs Two fixes stacked together because the dev deploy on v3.2.5 / v3.2.6-branch exposed both at once on Yale Health rc/dev pushes 2026-05-22. 1. verify-after-push: map TARGET_ENV → Pantheon branch name before ls-remote. Pantheon's `dev` env lives on `master`; multidevs use a branch with their own name. Mirrors upstream push-to-pantheon's push-target logic (scripts/main.sh:369-378). Without this, dev deploys false-fail here even though the push lands cleanly — ls-remote for refs/heads/dev returns empty because the ref doesn't exist. Repro: Yale Health dev deploy run 70400355314. Upstream logged `pushing to 'master' branch on Pantheon` and the force-push succeeded (HEAD -> master). Our verify step then aborted on refs/heads/dev. 2. Branch-pin internal self-refs across the 4 pantheon-push-consuming reusables. Files on the branch were still calling pantheon-push@v3.2.5, terminus-install@v3.2.5, pantheon-post-deploy-drush@v3.2.5, and the security-scan / vrt / semantic-release reusables at @v3.2.5. That meant the upstream-patch step (commit 318c115) was never invoked — Yale Health was running tagged v3.2.5 code, not the branch. Earlier RC/dev runs only worked because the upstream shallow race didn't fire. This is the documented [[release-pin-drift-trap]] / [[branch-pin- during-pre-merge-test]] pattern — flipped @v3.2.5 → @fix/v3.2.6- shallow-clone-race so the branch's code actually runs end-to-end. To revert pre-merge. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…lided with |) The patch step shipped in commit 318c115 used `|` as the sed delimiter, but the replacement string contains `||` (the bash short-circuit) which sed parsed as the end-of-replacement separator. Result: `sed: -e expression #1, char 82: unknown option to 's'`, step exit 1, deploy aborted before upstream push-to-pantheon was invoked. Switch delimiter to `#` — not present in pattern or replacement. Validated locally against the actual upstream main.sh@0.9.0: line 352 correctly gets `|| true` appended, line 384 (already-guarded variant) is correctly skipped by `^...$` anchoring. Repro: Yale Health dev deploy run 70400355314 attempt 2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Flip the four pantheon-push-consuming reusables from the temporary branch-pin @fix/v3.2.6-shallow-clone-race back to @v3.2.6 ahead of the v3.2.6 tag. 18 refs across pantheon-push, terminus-install, pantheon-post-deploy-drush, reusable-semantic-release, reusable-pantheon- security-scan, and reusable-pantheon-vrt — all now consistent at v3.2.6. This is the [[release-pin-drift-trap]] discipline: tag a release with internal refs already pointing at the version being released, so the release is internally consistent the moment the tag exists. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the shared Pantheon deployment automation to (1) runtime-patch an upstream pantheon-systems/push-to-pantheon@0.9.0 bug around git fetch --unshallow, and (2) fix verify-after-push behavior for dev deploys by mapping dev → master when checking Pantheon-side refs. It also bumps internal reusable workflow references to v3.2.6.
Changes:
- Add a pre-step in
pantheon-pushto patch upstreamscripts/main.shsogit fetch --unshallow originis tolerant of failure modes. - Fix verify-after-push to check
refs/heads/masterfordevdeploys instead ofrefs/heads/dev. - Bump internal self-references in reusable workflows from
v3.2.5tov3.2.6.
Reviewed changes
Copilot reviewed 1 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/reusable-pantheon-deploy-rc-multidev.yml | Bumps composite/workflow self-refs to v3.2.6 for RC multidev pipeline. |
| .github/workflows/reusable-pantheon-deploy-pr-multidev.yml | Bumps composite/workflow self-refs to v3.2.6 for PR multidev pipeline. |
| .github/workflows/reusable-pantheon-deploy-epic-multidev.yml | Bumps composite/workflow self-refs to v3.2.6 for epic multidev pipeline. |
| .github/workflows/reusable-pantheon-deploy-dev.yml | Bumps composite/workflow self-refs to v3.2.6 for DEV deploy pipeline. |
| .github/actions/pantheon-push/action.yml | Adds upstream runtime patching step and corrects dev-branch verification mapping. |
| UPSTREAM_VERSION: "0.9.0" | ||
| run: | | ||
| set -euo pipefail | ||
| UPSTREAM_SCRIPT="/home/runner/work/_actions/pantheon-systems/push-to-pantheon/${UPSTREAM_VERSION}/scripts/main.sh" |
Comment on lines
+172
to
+180
| # Pinned to upstream 0.9.0 — if we ever bump that, this step needs to be | ||
| # re-validated against the new source (sed pattern may not match). | ||
| - name: Patch upstream push-to-pantheon to tolerate unshallow errors | ||
| shell: bash | ||
| env: | ||
| UPSTREAM_VERSION: "0.9.0" | ||
| run: | | ||
| set -euo pipefail | ||
| UPSTREAM_SCRIPT="/home/runner/work/_actions/pantheon-systems/push-to-pantheon/${UPSTREAM_VERSION}/scripts/main.sh" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two upstream/downstream bugs surfaced during Yale Health's first deploy on v3.2.5 (2026-05-22 evening):
Upstream
pantheon-systems/push-to-pantheon@0.9.xhas an unguardedgit fetch --unshallow origininprepare_site_root(scripts/main.sh:352). Fails two different ways depending on checkout depth — race on shallow, deterministic error on complete. Bug exists in every upstream version 0.8.0–0.9.2; never fixed by them. We runtime-patch their main.sh on the runner before invoking the action: append|| trueto the unguarded unshallow line. Safe because upstream's own guarded unshallow at line 382 (insidepush_to_pantheon) still runs before the actual push.Our verify-after-push step (added v3.2.4) was checking the wrong ref on
devdeploys. Pantheon'sdevenv lives on themasterbranch; multidevs use a branch with their env name. Without aTARGET_ENV → PANTHEON_BRANCHmapping, every dev deploy false-failed verify even when the push landed cleanly. Fixed by mirroring upstream's push-target logic.Changes
actions/pantheon-push/action.yml: new "Patch upstream push-to-pantheon" step before the upstream invocation. Idempotent, self-validating, pinned to upstream0.9.0via env var — bumping upstream requires re-validating the sed pattern.actions/pantheon-push/action.yml(verify step): mapdev → masterbeforegit ls-remote refs/heads/<branch>.@v3.2.6.Repro / validation
70394172925(shallow race),70396096336(complete-repo error),70400355314(verify false-fail on dev push that actually succeeded),70400355314 attempt 2(sed delimiter bug — fixed in this branch), then a clean dev deploy on the final HEAD.Test plan
@v3.2.6(no stragglers) — verified pre-merge: 18 refs, all consistent🤖 Generated with Claude Code