build: Add gh-aw-version single source of truth + justfile wrapper - #49
Open
cgwalters wants to merge 1 commit into
Open
build: Add gh-aw-version single source of truth + justfile wrapper#49cgwalters wants to merge 1 commit into
cgwalters wants to merge 1 commit into
Conversation
Compiling a .md workflow source with a gh-aw CLI version other than the one ci.yml's check-drift job is pinned to can silently produce a different .lock.yml (compiler behavior, embedded action SHAs, etc. all vary by version), which then either falls out of sync with the .md source or looks fine locally but diffs against what CI recompiles. Previously the pinned version (v0.81.6) was a literal hardcoded in ci.yml, with no way for a human or an agent (drafter.md/fix.md, which both recompile lockfiles as part of their own workflow) to discover or match it short of reading that file. .github/aw/gh-aw-version is now the single place that version lives. ci.yml reads it instead of hardcoding the pin, and a new justfile wraps the two commands anyone touching a workflow .md file needs: `just setup` (installs/re-pins the extension to match the file) and `just compile` (runs the actual gh-aw compile). README.md, drafter.md, and fix.md are updated to point at `just setup && just compile` instead of telling readers to invoke gh-aw directly with no version guidance. review.md is untouched: it never edits workflow .md files or compiles, so it has no need for this instruction. Verified `gh aw compile drafter review fix --approve` (v0.81.6, matching the pin) against the new drafter.md/fix.md: only each file's embedded body_hash metadata comment changes in its .lock.yml, since gh-aw runtime-imports the prompt body rather than inlining it at compile time — no frontmatter or generated-workflow behavior changed. Assisted-by: AI Signed-off-by: Colin Walters <walters@verbum.org>
cgwalters
force-pushed
the
infra/pin-gh-aw-version-justfile
branch
from
August 5, 2026 20:05
3bf5394 to
766a7df
Compare
cgwalters
enabled auto-merge (squash)
August 6, 2026 12:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #47 hit CI's
check-driftjob because the drafter agent's sandbox hadno
gh-awextension pre-installed. Probing withgh aw --helptriggeredgh's own auto-install-latest behavior, silently pulling in an unpinned,newer
gh-awthan the versionci.yml'scheck-driftjob is pinned to(
v0.81.6). The agent then compiled with that newer version, producing a.lock.ymlfull of version-churn diffs that failed drift-checking in CI.This introduces a single source of truth for the pinned version plus a
justfilewrapper so neither humans nor agents have to remember/guess it:.github/aw/gh-aw-version— the pinned version, read by bothci.ymland the new
justfile.justfile—just setup(installs/re-pinsgh-awto match the file)and
just compile(runsgh aw compile drafter review fix --approve).ci.ymlnow reads the pin from the file instead of a hardcoded literal.README.md,drafter.md, andfix.mdnow point atjust setup && just compileinstead of raw, version-unaware commands.drafter.md/fix.mdspecifically: since these agents may themselvesedit workflow
.mdfiles, they're now told to recompile viajustbefore opening/pushing their change.
review.mdneeds no change — it never edits workflow files or compiles.Validation
just --listandjust setupverified idempotent (no-ops when alreadyat the pinned version, only reinstalls when it isn't).
just compile(gh aw compile drafter review fix --approve) runagainst the edited
drafter.md/fix.mdproduces the expected.lock.ymldiff (metadata hash only) and then a second run is clean —confirmed via
git status.Assisted-by: AI
I am knowledgeable in this problem domain (drove the design, reviewed the
generated diff and commit message in full) and reviewed it carefully.