From 160c326064f135c0f6ec4a07bfd5dd2057f10aad Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 29 Jul 2026 14:42:27 +0000 Subject: [PATCH 1/3] docs: record history-growth policy for the committed core mirror update_cap commits the refreshed run/input/core mirror nightly. Point to the policy recorded in builder-abap2UI5-js AGENTS.md: the mirror stays committed, bot-commit history is disposable (squashable to a baseline), and UPSTREAM_HEAD / UPSTREAM_COMMIT stay change-detection tokens that are never resolved against this repo's history. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_013NA4sHtsK85U1f6YKxP7YW --- AGENTS.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 49f6f27..a772a07 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -74,6 +74,18 @@ npm run build_cap # assemble + publish (secret `ACTION_KEY_APP`; skipped with a warning when unset). - `test`: PR gate — assemble from the committed mirror + `npm ci` + jest. +## History growth of the committed mirror — recorded policy + +`update_cap` commits the refreshed `run/input/core` mirror on every run, +so bot commits accumulate nightly. Same trade-off and same policy as +documented in builder-abap2UI5-js AGENTS.md ("History growth of the +committed build trees"): the committed mirror stays (diff-reviewable, +reproducible, no artifact storage), bot-commit history is disposable and +may be squashed to a baseline by a maintainer when clone size becomes a +nuisance, and nothing may ever resolve old commits of this repo — +`UPSTREAM_HEAD` and `run/input/UPSTREAM_COMMIT` are change-detection +tokens / upstream shas, not references into this repo's history. + ## Rules - Never edit the cap2UI5 app repo directly — change `src/` here and From b6a01f44af00c5fea42d9ee1ec52f5c60392f72d Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 29 Jul 2026 15:21:36 +0000 Subject: [PATCH 2/3] ci: open an issue when the scheduled update_cap run fails Same alerting the abap2UI5 org already has (report-scheduled-failure): a red nightly means the CAP app stops following the core - surface it instead of failing silently. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_013NA4sHtsK85U1f6YKxP7YW --- .github/workflows/update_cap.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/update_cap.yml b/.github/workflows/update_cap.yml index 45c1793..6620f00 100644 --- a/.github/workflows/update_cap.yml +++ b/.github/workflows/update_cap.yml @@ -26,6 +26,7 @@ on: permissions: contents: write + issues: write # report-scheduled-failure opens an issue on a red nightly concurrency: group: update-cap @@ -112,3 +113,6 @@ jobs: git push origin HEAD:main echo "published to cap2UI5/cap2UI5@main: $(git rev-parse --short HEAD)" >> "$GITHUB_STEP_SUMMARY" fi + - name: report scheduled failure as issue + if: failure() && github.event_name == 'schedule' + uses: abap2UI5/abap2UI5/.github/actions/report-scheduled-failure@main From ac91a354942ed0746aa157998e0da3dc09c1783f Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 29 Jul 2026 15:25:12 +0000 Subject: [PATCH 3/3] ci: pin third-party actions to commit SHAs Tag references (@v4/@v5/...) are mutable - a hijacked tag ships straight into CI. Pin every third-party action to the commit sha the tag currently resolves to (version noted in a comment), matching the convention the abap2UI5 org repos already follow. The ecosystem's own report-scheduled-failure composite stays on @main by convention. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_013NA4sHtsK85U1f6YKxP7YW --- .github/workflows/test.yml | 4 ++-- .github/workflows/update_cap.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a14c7ec..d738ec8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,8 +20,8 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 22 # the builder's own dev deps (jest for the script tests, eslint) diff --git a/.github/workflows/update_cap.yml b/.github/workflows/update_cap.yml index 6620f00..ab5733f 100644 --- a/.github/workflows/update_cap.yml +++ b/.github/workflows/update_cap.yml @@ -36,10 +36,10 @@ jobs: run: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: ref: main - - uses: actions/setup-node@v5 + - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: 22 # the builder's own dev deps (jest for the script tests, run by `npm test`)