From 65edd96d55199fbd28880fad978d9a1a62e3b196 Mon Sep 17 00:00:00 2001 From: Jahvon Dockery Date: Thu, 27 Aug 2026 00:41:37 -0400 Subject: [PATCH 1/2] ci: run tasks with the flow binary under review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every job installed flow via flowexec/action with `flow-version: main`, which clones flow from GitHub and builds main — discarding the branch. CI therefore validated each change with a flow that predated it. That is a silent gap in general, and a hard block when a .execs target depends on a flow capability that has not shipped: no change to the PR can make such a job pass, because the capability must already be on main. Adding Python support hit exactly this — the released flow parsed a .py target as shell and failed on every platform. Each job now builds flow first and passes it via the action's flow-binary input (flowexec/action#2), so tasks run against the code as it would land on main. flow-version: main is kept alongside it as a transitional fallback: action releases predating flow-binary ignore the new input, and without it they would quietly fall back to `latest` rather than today's behavior. It can be dropped once v1 carries the input. Two deliberate exclusions: - windows-ci's build-binary job keeps `flow-version: latest`; its purpose is to exercise the install script. - release, container, and release-docs are untouched. The same reasoning applies to them, but they publish artifacts and cannot be verified from a pull request, so they belong in a separate change. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01R328pa3FUUfga4gYah1iQi --- .github/workflows/ci.yaml | 42 ++++++++++++++++++++++++++++++++ .github/workflows/windows-ci.yml | 28 +++++++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 393b77a1..bafe24eb 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -22,11 +22,17 @@ jobs: uses: actions/setup-go@v7 with: go-version: "1.25.x" + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + run: go build -o ./bin/flow . - uses: flowexec/action@v1 with: executable: 'lint go' params: 'CI=true' timeout: '5m' + flow-binary: ./bin/flow + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' - name: Upload SARIF file uses: github/codeql-action/upload-sarif@v4.37.3 @@ -42,11 +48,17 @@ jobs: uses: actions/setup-go@v7 with: go-version: "1.25.x" + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + run: go build -o ./bin/flow . - uses: flowexec/action@v1 with: executable: 'test unit' params: 'CI=true' timeout: '5m' + flow-binary: ./bin/flow + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' id: unit-tests - name: Upload unit test coverage @@ -63,11 +75,17 @@ jobs: uses: actions/setup-go@v7 with: go-version: "1.25.x" + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + run: go build -o ./bin/flow . - uses: flowexec/action@v1 with: executable: 'test e2e' params: 'CI=true' timeout: '10m' + flow-binary: ./bin/flow + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' secrets: | test-secret=test-value-from-action @@ -111,16 +129,24 @@ jobs: go-version: "1.25.x" - name: Install mockgen run: go install go.uber.org/mock/mockgen@v0.4.0 + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + run: go build -o ./bin/flow . - uses: flowexec/action@v1 with: executable: 'generate' timeout: '10m' + flow-binary: ./bin/flow + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' - name: Check for uncommitted changes uses: flowexec/action@v1 with: executable: 'validate generated' timeout: '2m' + flow-binary: ./bin/flow + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' build-matrix: @@ -134,14 +160,24 @@ jobs: uses: actions/setup-go@v7 with: go-version: "1.25.x" + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. The + # bootstrap binary lives in ./bin; `build binary` writes its own to .bin. + - name: Build flow + shell: bash + run: go build -o ./bin/${{ runner.os == 'Windows' && 'flow.exe' || 'flow' }} . - uses: flowexec/action@v1 with: executable: 'build binary' + flow-binary: ./bin/${{ runner.os == 'Windows' && 'flow.exe' || 'flow' }} + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' timeout: '10m' - uses: flowexec/action@v1 with: executable: 'test binary' + flow-binary: ./bin/${{ runner.os == 'Windows' && 'flow.exe' || 'flow' }} + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' timeout: '5m' @@ -153,10 +189,16 @@ jobs: uses: actions/setup-go@v7 with: go-version: "1.25.x" + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + run: go build -o ./bin/flow . - uses: flowexec/action@v1 with: executable: 'scan security' timeout: '10m' + flow-binary: ./bin/flow + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: 'main' - name: Upload govuln SARIF file uses: github/codeql-action/upload-sarif@v4.37.3 diff --git a/.github/workflows/windows-ci.yml b/.github/workflows/windows-ci.yml index 533dd590..888efd70 100644 --- a/.github/workflows/windows-ci.yml +++ b/.github/workflows/windows-ci.yml @@ -26,12 +26,19 @@ jobs: with: go-version: "1.25.x" cache: true + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + shell: bash + run: go build -o ./bin/flow.exe . - name: Run unit tests uses: flowexec/action@v1 with: executable: "test unit" params: "CI=true" timeout: "5m" + flow-binary: ./bin/flow.exe + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: "main" - name: Upload unit test coverage if: always() @@ -53,12 +60,19 @@ jobs: with: go-version: "1.25.x" cache: true + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + shell: bash + run: go build -o ./bin/flow.exe . - name: Run E2E tests uses: flowexec/action@v1 with: executable: "test e2e" params: "CI=true" timeout: "10m" + flow-binary: ./bin/flow.exe + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: "main" secrets: | test-secret=test-value-from-action @@ -112,11 +126,18 @@ jobs: with: name: windows-flow-binary path: .bin + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + shell: bash + run: go build -o ./bin/flow.exe . - name: Run binary smoke test uses: flowexec/action@v1 with: executable: "test binary" timeout: "5m" + flow-binary: ./bin/flow.exe + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: "main" native-scripts: @@ -132,11 +153,18 @@ jobs: with: go-version: "1.25.x" cache: true + # Build the flow under review and run every task with it, so CI exercises + # the code as it would land on main rather than the released CLI. + - name: Build flow + shell: bash + run: go build -o ./bin/flow.exe . - name: Run .bat and .ps1 file execution tests uses: flowexec/action@v1 with: executable: "test windows-scripts" timeout: "5m" + flow-binary: ./bin/flow.exe + # Fallback for action releases predating flow-binary; drop once v1 includes it. flow-version: "main" windows-validation-complete: From 3493362321d2c505554c0ca711ca8ab3c731a6d3 Mon Sep 17 00:00:00 2001 From: Jahvon Dockery Date: Thu, 27 Aug 2026 01:16:03 -0400 Subject: [PATCH 2/2] ci: retrigger after action v1 moved to v1.3.0 Empty commit. The previous run resolved flowexec/action@v1 to a commit predating the flow-binary input, so the jobs silently fell back to flow-version: main. Re-running now that v1 carries the input, to confirm the built binary is what actually runs. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01R328pa3FUUfga4gYah1iQi