chore: update demos, CI workflows, and build tooling - #29
Closed
nodeselector wants to merge 2 commits into
Closed
Conversation
There was a problem hiding this comment.
⚠️ Not ready to approve
The new Makefile install/uninstall logic hardcodes the extensions directory and uses an unguarded recursive delete, which can install to the wrong location or delete unintended paths.
Pull request overview
This PR updates local build/install tooling and transitions repository workflows to use a detached GitHub Actions lockfile (.github/workflows/actions.lock), while removing previously committed demo workflows and VHS demo assets as part of the pre-release hardening stack.
Changes:
- Update
Makefileinstall/reinstall/uninstall to install the built extension binary directly into the GitHub CLI extensions directory. - Migrate workflow dependency pin metadata from embedded
dependencies:blocks to.github/workflows/actions.lock. - Remove
demo/workflows and VHS recording scripts/tapes.
File summaries
| File | Description |
|---|---|
| Makefile | Updates build/test/install targets; adds direct-copy install and uninstall logic for the extension. |
| demo/workflows/release.yml | Removes demo release workflow. |
| demo/workflows/deploy.yml | Removes demo deploy workflow. |
| demo/workflows/dependabot-auto-merge.yml | Removes demo Dependabot auto-merge workflow. |
| demo/workflows/codeql.yml | Removes demo CodeQL workflow. |
| demo/workflows/ci.yml | Removes demo CI workflow fixture. |
| demo/workflows-upgrade/ci.yml | Removes demo “upgrade” workflow fixture. |
| demo/workflows-pwned/6-lockfile-forgery.yml | Removes pwned-scenario fixture. |
| demo/workflows-pwned/5-pinned-before-update.yml | Removes pwned-scenario fixture. |
| demo/workflows-pwned/4-never-pinned-pwned.yml | Removes pwned-scenario fixture. |
| demo/workflows-pwned/3-repinned-bypass.yml | Removes pwned-scenario fixture. |
| demo/workflows-pwned/2-pinned-before-lineage-rewrite.yml | Removes pwned-scenario fixture. |
| demo/workflows-pwned/1-pinned-before-hijack.yml | Removes pwned-scenario fixture. |
| demo/workflows-interactive/unreleased-commit.yml | Removes interactive demo workflow fixture. |
| demo/workflows-interactive/sha-as-ref.yml | Removes interactive demo workflow fixture. |
| demo/workflows-check/ci.yml | Removes “check” demo workflow fixture. |
| demo/vhs/upgrade.tape | Removes VHS tape used for upgrade demo recording. |
| demo/vhs/upgrade-version.tape | Removes VHS tape used for versioned upgrade demo recording. |
| demo/vhs/unreleased-commit.tape | Removes VHS tape used for unreleased commit demo recording. |
| demo/vhs/tamper-warning.tape | Removes VHS tape used for tamper warning demo recording. |
| demo/vhs/sha-as-ref.tape | Removes VHS tape used for SHA-as-ref demo recording. |
| demo/vhs/reset-fixtures.sh | Removes fixture reset script for VHS recordings. |
| demo/vhs/ref-moved.tape | Removes VHS tape used for ref-moved demo recording. |
| demo/vhs/record-all.sh | Removes batch recording script for VHS demos. |
| demo/vhs/lockfile-forgery.tape | Removes VHS tape used for lockfile forgery demo recording. |
| demo/vhs/imposter-commit.tape | Removes VHS tape used for imposter commit demo recording. |
| demo/vhs/edit-repin.tape | Removes VHS tape used for edit/repin demo recording. |
| demo/vhs/ci-failure.tape | Removes VHS tape used for CI-failure demo recording. |
| demo/vhs/check-autofix.tape | Removes VHS tape used for check-autofix demo recording. |
| demo/try-it.sh | Removes interactive “try-it” demo runner script. |
| .gitignore | Ignores VHS output directory under demo/vhs/out/. |
| .github/workflows/test.yml | Pins action versions and removes embedded dependencies: in favor of lockfile. |
| .github/workflows/sync-early-access-release.yml | Pins checkout patch version and removes embedded dependencies: in favor of lockfile. |
| .github/workflows/release.yml | Pins checkout/precompile patch versions and removes embedded dependencies: in favor of lockfile. |
| .github/workflows/actions.lock | Adds detached, machine-generated lockfile mapping workflows to pinned action SHAs and transitive deps. |
Copilot's findings
- Files reviewed: 33/35 changed files
- Comments generated: 2
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
nodeselector
force-pushed
the
ns/release/chore
branch
from
June 8, 2026 03:13
deefb80 to
fd0bdd8
Compare
nodeselector
force-pushed
the
ns/release/docs
branch
2 times, most recently
from
June 8, 2026 03:32
e77f007 to
5e7d45c
Compare
nodeselector
force-pushed
the
ns/release/chore
branch
from
June 8, 2026 03:32
fd0bdd8 to
3cb4208
Compare
nodeselector
force-pushed
the
ns/release/docs
branch
from
June 8, 2026 05:39
5e7d45c to
ec83a54
Compare
nodeselector
force-pushed
the
ns/release/chore
branch
2 times, most recently
from
June 8, 2026 05:57
632836e to
351afe0
Compare
nodeselector
force-pushed
the
ns/release/docs
branch
2 times, most recently
from
June 8, 2026 06:12
106b6ba to
c5296ed
Compare
nodeselector
force-pushed
the
ns/release/chore
branch
2 times, most recently
from
June 8, 2026 06:16
ed4933a to
0539912
Compare
nodeselector
force-pushed
the
ns/release/docs
branch
from
June 8, 2026 06:16
c5296ed to
90145ac
Compare
nodeselector
force-pushed
the
ns/release/chore
branch
from
June 8, 2026 13:01
b769af0 to
a8e9b92
Compare
nodeselector
force-pushed
the
ns/release/docs
branch
2 times, most recently
from
June 8, 2026 13:10
6911a8f to
fbd2569
Compare
nodeselector
force-pushed
the
ns/release/chore
branch
from
June 8, 2026 13:10
a8e9b92 to
2557fa2
Compare
Refresh VHS demo tapes and fixture workflows, adjust release/test CI workflows, and update Makefile and .gitignore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
gh resolves its data dir from XDG_DATA_HOME (falling back to ~/.local/share/gh), so the hardcoded path put 'make install' in the wrong place for anyone who sets XDG_DATA_HOME. Honor it, keeping the documented default when unset. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
nodeselector
force-pushed
the
ns/release/docs
branch
from
June 8, 2026 13:46
fbd2569 to
c8f1ff8
Compare
nodeselector
force-pushed
the
ns/release/chore
branch
from
June 8, 2026 13:46
2557fa2 to
33d2cb9
Compare
Collaborator
Author
|
Consolidated into #30. Closing this stacked PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Layer 7/7 — top. Base:
ns/release/docs.Refresh VHS demo tapes and fixture workflows, adjust release/test CI workflows, and update Makefile and
.gitignore.Part of a stacked series for the pre-release hardening of
gh actions-pin. Review bottom-up; each PR is based on the one below it so the diff shows only that layer.