From 7458bf8b6ffffbd807b02206e199fedf6626d557 Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Fri, 7 Aug 2026 09:21:56 -0700 Subject: [PATCH] Bump base-bash-libs CI pin to v1.4.0 --- .github/workflows/tests.yml | 4 ++-- CHANGELOG.md | 1 + docs/contracts.md | 2 +- tests/validate.sh | 4 ++-- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 72c7eb8..9dece08 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -48,7 +48,7 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: repository: basefoundry/base-bash-libs - ref: 5e52e79a8d6f61f82e5e95a07c75da256642f92e + ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff path: .dependencies/base-bash-libs - name: Set up Base @@ -156,7 +156,7 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: repository: basefoundry/base-bash-libs - ref: 5e52e79a8d6f61f82e5e95a07c75da256642f92e + ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff path: .dependencies/base-bash-libs - name: Set up Base on Ubuntu diff --git a/CHANGELOG.md b/CHANGELOG.md index 947fc63..394ee04 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -74,6 +74,7 @@ and versions are tracked in the repo-root `VERSION` file. ### CI +- Updated the pinned base-bash-libs checkout to the v1.4.0 release commit. - Updated Base-backed CI to exercise the explicit `project.languages` manifest contract from the Base v1.7.0 release with a compatible base-bash-libs pin. - Added read-only `basectl devcontainer` and `basectl devenv-report` JSON diff --git a/docs/contracts.md b/docs/contracts.md index 2ff36e7..0e7e7ed 100644 --- a/docs/contracts.md +++ b/docs/contracts.md @@ -26,7 +26,7 @@ depend on. | `runtime-platform-env` | The `env` command prints `BASE_OS`, `BASE_PLATFORM`, `BASE_HOST_ENV`, and `BASE_HOST` with the other Base runtime values. | `src/env.sh` | `tests/validate.sh`, `tests/demo_test.bats`, `demo/demo.sh` | Learners cannot discover the current Base runtime platform and host-environment contract from base-demo. | Runtime | | `installer-checksum` | Downloaded Base installers are verified when `BASE_INSTALL_SHA256` is set and warn when it is empty. | `install.sh` | `tests/install_test.bats` | Pinned installer URLs can execute without checksum verification or a visible warning. | Security | | `service-log-permissions` | Process-backed service log files are created or corrected to mode `0600` before writes. | `bin/base-demo-services` | `tests/services_test.bats` | Service logs can expose local process output through permissive file modes. | Security | -| `ci-pinned-dependencies` | CI uses a pinned Base v1.7.0 release checkout, a compatible SHA-pinned base-bash-libs checkout, and full SHA-pinned GitHub Actions. | `.github/workflows/tests.yml` | `tests/validate.sh` | CI can drift with Base `main` or mutable action tags instead of validating the intended capability contract. | CI | +| `ci-pinned-dependencies` | CI uses a pinned Base v1.7.0 release checkout, the SHA-pinned base-bash-libs v1.4.0 release commit, and full SHA-pinned GitHub Actions. | `.github/workflows/tests.yml` | `tests/validate.sh` | CI can drift with Base `main`, an older base-bash-libs release, or mutable action tags instead of validating the intended capability contract. | CI | | `ubuntu-ci` | The repository has an Ubuntu job that runs `basectl setup base --yes --no-notify`, validates `basectl setup base --profile dev --yes --no-notify`, verifies `bats`/`gh`/`shellcheck`, and runs `basectl check --ci base-demo --format json` against the pinned Base checkout. | `.github/workflows/tests.yml` | `tests/validate.sh`, GitHub Actions `validate-ubuntu` | Ubuntu support can drift from the documented Base setup, dev-profile, and read-only project health boundary. | CI | | `platform-boundary` | README and CONTRIBUTING document macOS full-demo support plus Ubuntu/Debian and WSL2 support for Base setup, dev-profile prerequisites, read-only project health checks, repo-location guidance, and the native-Windows non-goal. | `README.md`, `CONTRIBUTING.md` | `tests/validate.sh` | Developers on Linux or WSL2 follow macOS-only project setup or demo steps without a documented boundary. | Docs | | `ci-json-check` | The demo shows `basectl check --ci base-demo --format json` and asserts JSON status output. | `demo/demo.sh`, `README.md` | `tests/validate.sh`, `tests/demo_test.bats`, `.github/workflows/tests.yml` | The reference project stops demonstrating Base's CI-safe machine-readable check path. | CI | diff --git a/tests/validate.sh b/tests/validate.sh index e46cc6f..0e87a26 100755 --- a/tests/validate.sh +++ b/tests/validate.sh @@ -216,10 +216,10 @@ if grep -Fq '591e34a8fed6ce9cbe27f483f852bec81153f3eb' .github/workflows/tests.y fi base_bash_libs_pin_count="$( - grep -Fc 'ref: 5e52e79a8d6f61f82e5e95a07c75da256642f92e' .github/workflows/tests.yml || true + grep -Fc 'ref: 2c5ef2c3a9edfbe2cf68d0645be65b920255abff' .github/workflows/tests.yml || true )" if [[ "$base_bash_libs_pin_count" -ne 2 ]]; then - printf '.github/workflows/tests.yml must pin both base-bash-libs checkouts to the Base v1.7.0-compatible SHA.\n' >&2 + printf '.github/workflows/tests.yml must pin both base-bash-libs checkouts to the v1.4.0 release commit.\n' >&2 exit 1 fi