Repository navigation
Conversation
Package version diff: none (aarch64-linux, x86_64-linux) |
mmlb
force-pushed
the
push-wvulrqwlxoml
branch
from
October 16, 2026 19:48
bc7905e to
013108e
Compare
PostgreSQL Extension Dependency Analysis: PR #2569
SummaryNo extensions had dependencies with MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Extension DependenciesPostgreSQL 17 Extension DependenciesOrioleDB 17 Extension Dependencies |
PostgreSQL Package Dependency Analysis: PR #2569
SummaryNo packages had MAJOR version updates. Full Analysis ResultsPostgreSQL 15 Dependency ChangesExtracting PostgreSQL 15 dependencies...
Runtime Closure Size
Raw Dependency ClosurePostgreSQL 17 Dependency ChangesExtracting PostgreSQL 17 dependencies...
Runtime Closure Size
Raw Dependency Closure |
mmlb
force-pushed
the
push-wvulrqwlxoml
branch
from
October 16, 2026 20:17
013108e to
3fab61a
Compare
brainrake
approved these changes
Oct 16, 2026
Collaborator
|
TIL gha lock LGTM |
Latest and greatest!!! Also to drop deprecated nodejs20 warnings.
Use the standard actions/checkout in every workflow, and delete our wrapper around it. We added the wrapper so CI could run on fork PRs after a maintainer approves them (#1643, #1644). We did not need it for that, because a standard checkout already works for fork PRs. The real problem was nix-build.yml, which passed a branch name as `ref` without `repository`. GitHub could not find a fork's branch in our repo. The wrapper also fetched full history and tags. No PR says why. Two jobs still need them: the `prepare` jobs in publish-nix-pgupgrade-scripts.yml and publish-nix-pgupgrade-bin-flake-version.yml check a release tag. They keep `fetch-depth: 0` and `fetch-tags: true`. All other checkouts are now shallow. We chose those two by searching the workflows for git commands. That search can miss a Nix build or script that reads git history. If a job breaks, add `fetch-depth: 0` to its checkout. PR runs now test the PR merged into the base branch, not the PR's own commit. This has not run on a fork PR yet. Assisted-by: Claude Sonnet 5.5 <noreply@anthropic.com>
mmlb
force-pushed
the
push-wvulrqwlxoml
branch
2 times, most recently
from
October 19, 2026 15:10
3559bef to
fe4351b
Compare
Switch from commit shas to proper lockfiles now that GHA has it in preview mode. This is better than commit ids because it also locks down transitive dependencies. Pinning to commits was best we could do but meant any actions we depended on that had its own dependencies at non-commit pins could use a different version w/o notice.
mmlb
force-pushed
the
push-wvulrqwlxoml
branch
from
October 19, 2026 15:11
fe4351b to
d5202ad
Compare
mmlb
added this pull request to the merge queue
Oct 19, 2026
Any commits made after this event will not be merged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Gardening
What is the current behavior?
We pin 3rd party actions at the commit, but transitive dependencies are out of reach.
What is the new behavior?
We switch to GHA lockfiles that look nice in the workflows and pin down the transitive dependencies.
Additional context
Will switch on the require lockfile policy once this is in.