Skip to content

ci(vendored-updates): watch the adapted copies' upstream code - #123

Merged
Nawid3333 merged 1 commit into
mainfrom
claude/vendored-sources
Oct 1, 2026
Merged

Nawid3333 merged 1 commit into
mainfrom
claude/vendored-sources

Conversation

@Nawid3333

Copy link
Copy Markdown
Owner

Found while checking what still doesn't update itself. Four files are copies of other projects' code, changed here, so no package manager and no other workflow watches them:

Copy Upstream Behind today
knob.mjs jherrm/knobs, Knob.js 16 commits after the 2012 pin
vad/vad.mjs ricky0123/vad, packages/web/src 37 commits since March 2023 (v6 model support, audio-context fixes, cleanup fixes)
StreamSaver.mjs jimmywarting/StreamSaver.js current
crosstalk/fft.mjs indutny/fft.js current

What's new: a sources job in vendored-updates.yml, daily, plus tools/vendored-sources.json. The JSON gives each copy's upstream path and the upstream commit it was taken from. That is the last upstream commit to the path before the copy entered the repository, and for knob the pin that verify:knob proves.

  • When upstream's newest commit to the path isn't in that ref, one issue is opened: "Vendored source changed upstream: ( )". It lists the commits after the ref that changed the file, with a compare link.
  • Porting is by hand, because the copies are changed here. Setting the ref closes the issue, a newer change replaces it, and closing one skips that change. It's never raised twice.
  • No PR and no merge: nothing here can be updated blindly.

Checked against the real GitHub API (issues only logged, nothing created): it found knob and vad-web behind, StreamSaver and fft.js current, with exact commit lists. That run also found a real bug in my first version. gh.exe under WSL swallowed standard input, which ended the loop after the first source. The two lists are now read on their own file descriptors. The unit test's stub reads stdin the same way, so the bug can't return.

Tests: tests/workflows/vendored-sources.test.sh, 8 scenarios and 33 checks, covering the behind, diverged and up-to-date cases, raised-before, replacement by a newer change, and failure on an empty list or missing upstream. I undid each of the 10 rules one at a time, and each made its scenario fail. actionlint, zizmor and all workflow tests pass.

On first run, the two behind copies each get an issue. That's the starting to-do list for them, not a failure.

Ships nothing.

🤖 Generated with Claude Code

Four files are copies of other projects' code, changed here, that no package
manager updates: knob.mjs (jherrm/knobs), StreamSaver.mjs, crosstalk/fft.mjs
(indutny/fft.js) and vad/vad.mjs (ricky0123/vad). tools/vendored-sources.json
names each with its upstream path and the commit it came from (the last one
to that path before the copy entered the repository; knob's is the pin
verify:knob proves).

vendored-updates.yml's new job sources checks them daily: when upstream's
newest commit to the path is not in the ref, an issue "Vendored source
changed upstream: <name> (<repo> <sha8>)" lists the commits after the ref
that changed it (the compare, filtered by the path's history), assigned and
@mentioning the owner. Porting is by hand; moving the ref closes it, a newer
change replaces it, and closing one skips that change.

Run against the real API (issues only logged): knob 16 commits after its
2012 pin, vad-web 37 since 2023-03-30, StreamSaver and fft.js current. That
run also found the loop ending after the first source, because a command
inside read standard input; the lists are read on their own descriptors.

tests/workflows/vendored-sources.test.sh: 8 scenarios, with a stub that
reads standard input as gh.exe did; each of 10 rules, undone, fails it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Nawid3333
Nawid3333 merged commit cc4a770 into main Oct 1, 2026
10 checks passed
@Nawid3333
Nawid3333 deleted the claude/vendored-sources branch October 1, 2026 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant