From ade23bfe7d90afa49a32a25e6501117e32e29da6 Mon Sep 17 00:00:00 2001 From: Benjamin Poile Date: Sat, 18 Jul 2026 14:54:29 -0700 Subject: [PATCH 1/3] ci: bump docfacts impact pin to ca881c2 + pass docfacts_ref The old pin (42413cf) predates the docfacts packages/ restructure and its github.workflow_sha checkout tried to fetch the caller's SHA from docfacts, failing every PR's impact check. ca881c2 adds a docfacts_ref input (pins the engine to the same commit) and job-level continue-on-error. --- .github/workflows/docfacts-impact.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docfacts-impact.yml b/.github/workflows/docfacts-impact.yml index 73d967ef..70d5fd3e 100644 --- a/.github/workflows/docfacts-impact.yml +++ b/.github/workflows/docfacts-impact.yml @@ -9,8 +9,9 @@ permissions: contents: read jobs: impact: - uses: primitivedotdev/docfacts/.github/workflows/impact.yml@42413cfcb2d9ff116f60ba34d48b5843cc9e83a8 # pin: docfacts main; bump deliberately + uses: primitivedotdev/docfacts/.github/workflows/impact.yml@ca881c2f19e84c9f977478b6f405b342d3171de4 # pin: docfacts main; bump deliberately with: repo_key: sdks + docfacts_ref: ca881c2f19e84c9f977478b6f405b342d3171de4 secrets: docfacts_read_token: ${{ secrets.DOCFACTS_READ_TOKEN }} From 97918fa2ffa65d05e0d9f3e7c5f23c132199afa8 Mon Sep 17 00:00:00 2001 From: Benjamin Poile Date: Sat, 18 Jul 2026 15:04:23 -0700 Subject: [PATCH 2/3] ci: re-trigger docfacts impact after org access grant Co-Authored-By: Claude Opus 4.8 (1M context) From 3c80394cc2d00f4dbfaf550b02d3362a395b7a46 Mon Sep 17 00:00:00 2001 From: Benjamin Poile Date: Sat, 18 Jul 2026 15:07:15 -0700 Subject: [PATCH 3/3] ci: inline docfacts impact job (public repo can't call private reusable workflow) GitHub forbids a public repo from resolving a reusable workflow stored in a private repo; the call failed at startup on every run. Clone docfacts with the read PAT and run the same steps inline instead. Report-only, unchanged behavior. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/docfacts-impact.yml | 92 +++++++++++++++++++++++++-- 1 file changed, 86 insertions(+), 6 deletions(-) diff --git a/.github/workflows/docfacts-impact.yml b/.github/workflows/docfacts-impact.yml index 70d5fd3e..681b6d67 100644 --- a/.github/workflows/docfacts-impact.yml +++ b/.github/workflows/docfacts-impact.yml @@ -1,5 +1,13 @@ # Report-only: comments on PRs that touch code cited as evidence by documented # claims. Never blocks a merge. Requires the DOCFACTS_READ_TOKEN secret. +# +# NOTE: this job is INLINED rather than calling docfacts's reusable workflow +# (primitivedotdev/docfacts/.github/workflows/impact.yml). GitHub forbids a +# PUBLIC repo (this one) from resolving a reusable workflow stored in a PRIVATE +# repo (docfacts) — it fails at startup with "workflow file issue" and never +# creates a job. Cloning the private repo with a PAT is allowed, so we run the +# same steps here directly. Keep this in sync with docfacts's impact.yml; bump +# DOCFACTS_REF deliberately (it pins the engine to a known-good commit). name: docfacts-impact on: pull_request: @@ -7,11 +15,83 @@ on: permissions: pull-requests: write contents: read +env: + DOCFACTS_REF: ca881c2f19e84c9f977478b6f405b342d3171de4 # pin: docfacts main jobs: impact: - uses: primitivedotdev/docfacts/.github/workflows/impact.yml@ca881c2f19e84c9f977478b6f405b342d3171de4 # pin: docfacts main; bump deliberately - with: - repo_key: sdks - docfacts_ref: ca881c2f19e84c9f977478b6f405b342d3171de4 - secrets: - docfacts_read_token: ${{ secrets.DOCFACTS_READ_TOKEN }} + runs-on: ubuntu-latest + timeout-minutes: 10 + # Report-only: no failure in ANY step (checkout, install, engine crash) may + # put a red X on the PR. + continue-on-error: true + steps: + - name: Check credentials present + id: gate + env: + TOKEN: ${{ secrets.DOCFACTS_READ_TOKEN }} + run: | + if [ -z "$TOKEN" ]; then + echo "DOCFACTS_READ_TOKEN not configured - skipping (report-only)." + echo "enabled=false" >> "$GITHUB_OUTPUT" + else + echo "enabled=true" >> "$GITHUB_OUTPUT" + fi + + - name: Checkout PR (full history for merge-base) + if: steps.gate.outputs.enabled == 'true' + uses: actions/checkout@v4 + with: + fetch-depth: 0 + path: caller + + - name: Checkout docfacts + if: steps.gate.outputs.enabled == 'true' + uses: actions/checkout@v4 + with: + repository: primitivedotdev/docfacts + token: ${{ secrets.DOCFACTS_READ_TOKEN }} + path: docfacts + ref: ${{ env.DOCFACTS_REF }} + + - uses: actions/setup-node@v4 + if: steps.gate.outputs.enabled == 'true' + with: + node-version: 24 + + - name: Compute impact + if: steps.gate.outputs.enabled == 'true' + id: impact + continue-on-error: true + working-directory: docfacts + env: + DOCFACTS_REPO_SDKS: ${{ github.workspace }}/caller + run: | + npm ci + BASE=$(git -C ../caller merge-base origin/${{ github.base_ref }} HEAD) + npx tsx packages/cli/src/index.ts impact --repo sdks --base "$BASE" --head HEAD > impact.md + cat impact.md + { + echo "body<> "$GITHUB_OUTPUT" + + - name: Upsert PR comment + if: steps.gate.outputs.enabled == 'true' && steps.impact.outcome == 'success' + uses: actions/github-script@v7 + env: + IMPACT_BODY: ${{ steps.impact.outputs.body }} + with: + script: | + const body = process.env.IMPACT_BODY; + const marker = ""; + const full = marker + "\n" + body; + const { data: comments } = await github.rest.issues.listComments({ + ...context.repo, issue_number: context.issue.number, per_page: 100, + }); + const mine = comments.find((c) => c.body?.startsWith(marker)); + if (mine) { + await github.rest.issues.updateComment({ ...context.repo, comment_id: mine.id, body: full }); + } else { + await github.rest.issues.createComment({ ...context.repo, issue_number: context.issue.number, body: full }); + }