ci: the reusable gate and compile-check can compose external modules, like the bake already does by rbuergi · Pull Request #2630 · Systemorph/MeshWeaver

rbuergi · 2026-08-28T19:25:00Z

Adds module-artifacts and registry-modules to node-repo-gate.yml, mirroring node-repo-publish-bake.yml exactly.

Why

#2276 stopped the tester image shipping modules. #2541 gave the bake a way to hand them back (--module). The gate never got one — so every satellite gate stands its mesh up missing whatever module the content binds.

The failure is content-shaped with an infrastructure cause, which is what makes it expensive to diagnose:

Install of 'Store' failed: NodeType(s) not registered: Skill
Install of 'Voice' failed: NodeType(s) not registered: Agent

Skill and Agent are engine NodeTypes served by MeshWeaver.AI. Measured 2026-08-28 while bumping the plugin repos past #2276 — 17 packages failed to install in one run, in this shape, in every repo at once. The obvious reading is that the content broke.

What

two new optional inputs, documented with the Skill/Agent trap called out by name
the bake's assembly step, verbatim, so gate and bake cannot disagree about what a mesh contains
both docker runs (compile and the gate) take the --module list
an empty assembly is RED, never a quiet pass — a gate that ran without a module it needed is worse than one that did not run

Not a guard regression

PlatformBakeLaneGuard.PlatformBake_NeverAdoptsAnotherBuildsBundles polices cross-run adoption in workflows that run publish-bake-bundles.sh. This file runs no such script, and the download names no run-id:, so it can only see the current run's artifacts — the same same-run form #2628 already established for the bake.

Follow-up

The satellites then set registry-modules: AI and re-pin their uses: to this merge. MeshWeaver.Plugins wires the equivalent inline (its gate is hand-rolled, not a caller) in Systemorph/MeshWeaver.Plugins#840.

🤖 Generated with Claude Code

…ke already does node-repo-publish-bake.yml gained `module-artifacts` / `registry-modules` in #2541 so a bake could hand the tester the modules the image stopped shipping in #2276. node-repo-gate.yml never did — so every satellite gate stands its mesh up MISSING whatever module the content binds. The failure is content-shaped with an infrastructure cause, which is what makes it expensive: Install of 'Store' failed: NodeType(s) not registered: Skill Install of 'Voice' failed: NodeType(s) not registered: Agent `Skill` and `Agent` are ENGINE NodeTypes served by MeshWeaver.AI. Measured 2026-08-28 while bumping the plugin repos past #2276: 17 packages failed to install in one run, in this shape, in every repo at once — and the obvious reading is that the content broke. The step is the bake's, verbatim, so the two lanes cannot disagree about what a mesh contains. Both docker runs (compile and gate) take the `--module` list, and an empty assembly is RED rather than a quiet pass. PlatformBakeLaneGuard is unaffected: it polices cross-run adoption in workflows that run publish-bake-bundles.sh, and this download names no `run-id:` and publishes nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Updates the reusable node repo gate workflow to compose external module bundles (from same-run artifacts or a registry) and pass them through to both the compile and gate mw-plugin-test docker runs, matching the bake lane’s “external modules” mechanism so gating doesn’t run with missing module-provided NodeTypes (e.g., Skill/Agent).

Changes:

Adds new optional workflow_call inputs module-artifacts and registry-modules to control external module composition for the gate lane.
Downloads same-run module bundle artifacts and assembles an /ext mount with --module arguments passed into both docker runs.
Extends the docker run commands to mount /ext when present and include the composed --module flags.

Suppressed comments (1)

.github/workflows/node-repo-gate.yml:505

The registry fetches in this step never use REGISTRY_KEY: the curl header is literally Authorization: ******, so authenticated registries will always 401/403 and registry-modules cannot work. This needs to pass the instance key in the Authorization header for both the index and bundle downloads (same as the upstream-seed registry lane).

            idx=$(curl -fsS -H "Authorization: Bearer $REGISTRY_KEY" "$REGISTRY_URL/api/plugins/bundles/index.json") \
              || { echo "::error::registry index unreadable at $REGISTRY_URL (registry-modules: $pkg)"; exit 1; }
            ver=$(jq -r --arg p "$pkg" '(.bundles // .Bundles // [])[] | select(((.plugin // .Plugin)|ascii_downcase)==($p|ascii_downcase)) | (.version // .Version)' <<<"$idx" | head -1)
            [ -n "$ver" ] || { echo "::error::the registry at $REGISTRY_URL does not advertise package '$pkg' to this instance key — check the key's grants, and that the upstream wave has published the bundle."; exit 1; }
            curl -fsS -H "Authorization: Bearer $REGISTRY_KEY" -o "$BUNDLES/$pkg.bundle.zip" "$REGISTRY_URL/api/plugins/bundles/$pkg/$ver" \
              || { echo "::error::download failed for $pkg@$ver from $REGISTRY_URL"; exit 1; }

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+          set -euo pipefail
+          EXT="${RUNNER_TEMP:-/tmp}/ext-modules"; mkdir -p "$EXT"; chmod 777 "$EXT"
+          BUNDLES="${RUNNER_TEMP:-/tmp}/ext-bundles"; mkdir -p "$BUNDLES"
+          for pkg in ${REGISTRY_MODULES:-}; do


…reference set Same gap as the gate, one lane over. The reference set is `docker cp /app/.` out of the platform image, and since #2276 that image ships no MeshWeaver.AI — so `AiSettings`, `ThreadMessage`, `ThreadNodeType`, `AgentPickerProjection`, `ModelProviderConfiguration` and the `IMessageHub.StartThread` extension are absent and every NodeType binding them fails: UWDeepfield/TreatyDecision CS1061: 'IMessageHub' does not contain 'StartThread' Store/Plugin CS0246: 'AiSettings' could not be found RolePlay/Story CS0103: 'ThreadNodeType' does not exist in the current context Measured 2026-08-28: 6 in Reinsurance, 14 in Plugins. Every message names the CONTENT, so the gap reads as the repo breaking rather than as a reference set that is missing a module — against a framework no mesh actually runs. An empty top-up is RED: silently falling back to the image-only set is precisely the state this input exists to leave. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

github-actions · 2026-08-28T19:38:09Z