Repository navigation
Drop the bare command aliases, and group dependabot action updates - #6
Merged
Merged
Conversation
github/codeql-action/init and /analyze MUST be the same version -- CodeQL fails with "Loaded a configuration file for version X, but running version Y" when they differ. Dependabot proposed each subpath as its own pull request, so each one alone left the pair mismatched and red; laranail/confetti had two such PRs open, both failing, neither wrong on its own. Grouping minor and patch action updates into one PR fixes that for any paired action, not just CodeQL, and cuts the PR volume the comment above already complains about. Resolve dependencies from the manifest, and cache them CI pinned versions into composer.json before running the suite. `composer require --no-update` EDITS the file -- verified: `^13.0` becomes `13.*` -- so every run tested a manifest the package does not ship. Nothing broke, because the forced constraint happened to agree with the declared one; it would have broken silently the first time either changed, and widening a package to `^13.0 || ^14.0` would never have been tested at all. The matrix keys feeding those pins are gone with them. Several were already inert: `testbench` and `carbon` were declared in the matrix and referenced by no step, so they pinned nothing and always resolved from composer.json. Also here, all measured rather than assumed: - A composer cache. Most workflows re-downloaded every dependency on every run, which is the largest avoidable draw on the Actions budget. - The cache drops laranail/* archives before installing. Those resolve through a single MOVING v0.1.0 tag, so composer's dist cache is keyed on a name whose contents change underneath it -- without the eviction a restored archive is silently stale, which is the failure this org has already hit once. - fail-fast off where it was on. "8.5 fails too" and "only 8.5 fails" are different bugs, and fail-fast hides which one a run found. - No coverage driver where nothing consumed the report. pcov instruments every file on every run; generating a report nobody reads is time billed for nothing. Untouched wherever an upload or a --min gate uses it. - paths-ignore '*.md' -> '**.md'. The root-only glob never matched docs/**, so documentation-only changes ran the full suite.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes, both about names that live in a flat global registry.
The bare command aliases are gone. Every alias this package declared was an unscoped, generic name —
env:set,make:crud,license,tidy. Artisan keeps command names in a flat map, so a second package claiming one does not collide loudly: it silently replaces the first, and the damage surfaces far away as the wrong code running under a familiar name. That is exactly the collisionlaranail::<slug>.<command>exists to prevent, and an unscoped alias hands it straight back. 127 of them across twelve packages, and not one was vendor-scoped.The primary name is unchanged, so every command is still reachable as
laranail::<slug>.<command>. The trait still applies$commandAliaseswhen a command declares one, so a vendor-scoped alias remains possible where a short form genuinely earns it. Breaking for anyone typing an old short name.Dependabot now groups action updates.
github/codeql-action/initand/analyzemust be the same version — CodeQL fails with "Loaded a configuration file for version X, but running version Y" — and dependabot proposed each subpath as its own pull request, so each one alone left the pair mismatched and red.laranail/confettihad two such PRs open, both failing, neither wrong on its own. Grouping fixes that for any paired action, not just CodeQL.