Skip to content

Tidy SaaS agent module metadata - #7

Closed
AntoineToussaint wants to merge 10 commits into
mainfrom
codex/add-core-module-checksums-20260725
Closed

Tidy SaaS agent module metadata#7
AntoineToussaint wants to merge 10 commits into
mainfrom
codex/add-core-module-checksums-20260725

Conversation

@AntoineToussaint

@AntoineToussaint AntoineToussaint commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add checksums for the pinned core v0.2.24 module so standalone packaging and SBOM generation work
  • mark yaml.v3 as a direct dependency
  • remove stale v0.2.19 core checksums

Validation

  • GOWORK=off go mod tidy
  • GOWORK=off go mod verify
  • GOWORK=off go test -count=1 -timeout=3m ./...
  • local native and Linux agent build with audit skipped

@AntoineToussaint

Copy link
Copy Markdown
Contributor Author

The Codefly-owned gate is blocked by an unrelated service-go-grpc sync-drift permissions failure:

builder sync failed: open /tmp/codefly-go-grpc-sync-3351942147/.cache: permission denied

Tracked in codefly-dev/service-go-grpc#24. The separate SDK-boundary check and the PR's local module/test/build validation pass.

@AntoineToussaint

Copy link
Copy Markdown
Contributor Author

CI status: blocked by two agent-level issues (not by this PR)

This PR only tidies go.mod/go.sum, but it's the first change to mark the Go/TS services (accounts, frontend) as affected, so CI runs proto sync-drift on them for the first time and hits two pre-existing, agent-level breakages (main never exercised these — its last green run had only 1 trivial service affected):

  1. accounts sync-drift → open /tmp/…/.cache: permission denied (Linux-CI-only; fails first under fail-fast). The proto companion / go-grpc builder sync leaves an unreadable .cache in the staging root and a traversal there aborts. → Sync aborts with 'open .../.cache: permission denied' on Linux CI — incomplete .cache guard in builder sync path service-go-grpc#26
  2. frontend sync-drift → 35 _pb.ts drift. Committed _pb.ts are protoc-gen-es v2.11.0; proto companion 0.0.11 ships v2.12.0. → proto companion 0.0.11 pins protoc-gen-es 2.12.0 but ecosystem runtime is 2.11.0 → sync-drift on every consumer core#83

Both center on codeflydev/proto:0.0.11. This PR is correct as-is and stays scoped to the metadata tidy; it should go green once the two issues land (companion es pinned to match the 2.11.0 runtime + the .cache guard/host-user fix). No module-repo change makes CI green on its own here.

@AntoineToussaint

Copy link
Copy Markdown
Contributor Author

Update — fixes are now in flight (agent-level; nothing to change in this repo)

Both blockers traced and addressed upstream:

  1. .cache permission (accounts) → the .cache SkipDir guard is already on service-go-grpc main (b8f6dcfb), but the module pins v0.1.13, and both v0.1.13 and v0.1.14 predate the guard. So this needs a go-grpc release (v0.1.15) cut from main + a re-pin here — no code change. (Sync aborts with 'open .../.cache: permission denied' on Linux CI — incomplete .cache guard in builder sync path service-go-grpc#26, corrected.)
  2. 35 _pb.ts drift (frontend)proto companion: pin protoc-gen-es to 2.11.0 (0.0.11 → 0.0.12) core#85 pins the proto companion's protoc-gen-es to 2.11.0 and bumps it to proto:0.0.12. Needs merge + publish of proto:0.0.12, then go-grpc/nextjs rebuilt against the new core.

Path to green for this PR (all upstream; this PR stays scoped to the go.mod tidy):

  1. Merge core#85 and publish codeflydev/proto:0.0.12.
  2. Cut service-go-grpc v0.1.15 (includes b8f6dcfb) and a matching nextjs release, both rebuilt against the new core.
  3. Re-pin go-grpc/nextjs to those releases here → CI goes green.

@AntoineToussaint

Copy link
Copy Markdown
Contributor Author

Correction — the frontend blocker is NOT the proto companion es version

I verified end-to-end (built proto:0.0.12 with es 2.11.0, ran this repo's sync-drift against it): core#85 does not fix the 35-file frontend drift. My earlier root-cause was wrong. Accurate picture:

  • The 35 drifted files are frontend/code/src/gen/saas/accounts/v1/*_pb.tses 2.11.0, target=ts,import_extension=none, cross-written into frontend/src/gen by the accounts service's buf.gen.
  • The frontend sync-drift regenerates via the nextjs proto.GenerateGRPC(TYPESCRIPT) path, whose TS template pins the remote plugin buf.build/bufbuild/es:v2.2.3 (target=ts) and emits a single flat saas-starter_accounts_grpc_pb.ts (es 2.2.3, which is committed and matches). It never regenerates the 35 accounts-written files, so the dry-run comparison flags them as drift.

So the frontend blocker is a generator-ownership / comparison-scope problem (two generators write frontend/src/gen; the frontend's own sync-drift only produces its flat file and flags the accounts-written files) — in service-nextjs / the core TS template, not the proto companion's bundled es. core#85 is still valid es-runtime hygiene, but it does not unblock this PR's frontend failure.

Revised blocker list for this PR:

  1. accounts .cache perm → release service-go-grpc v0.1.15 (guard already on main) + re-pin. Unchanged.
  2. frontend 35-file drift → needs a service-nextjs/TS-template fix so the frontend generator reproduces (or stops flagging) the accounts-written saas/accounts/v1/*_pb.ts. New/separate issue; core#85 does NOT cover it.

@AntoineToussaint

Copy link
Copy Markdown
Contributor Author

Tracking issue for the full path to green: #10 (blockers: service-go-grpc#26 → v0.1.15 release; service-nextjs#22 → fix+release; then re-pin here).

AntoineToussaint and others added 4 commits July 26, 2026 14:59
Bump pinned agents to the releases that fix the two proto sync-drift blockers:
- go-grpc 0.1.13 -> 0.1.15: builder skips the unreadable `.cache` in the
  staging root (Linux-CI `open /tmp/.../.cache: permission denied`).
- nextjs 0.0.115 -> 0.0.116: frontend sync-drift no longer flags the
  dependency-cross-written *_pb.ts.
Regenerate derived service.codefly.yaml manifests + base-manifest.

Also refresh accounts + auth-sidecar go.sum for service-postgres@v0.0.104
(stale checksum after the module was re-released) to the canonical
proxy/sumdb-verified hash, fixing a go mod download checksum-mismatch error.

verify + sync-drift pass locally. A pre-existing agent bug still blocks
lint/compile (platform_admin.pb.gw.go uses jobsv1 without importing it) —
codefly-dev/service-go-grpc#30.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The companion buf.gen's protoc-gen-es wrote to ../../frontend/code/src/gen,
which escapes the go-grpc builder's per-service /workspace mount to the
container root /frontend. Under go-grpc 0.1.15 the companion runs as the
non-root host user, so `mkdir /frontend` fails ("permission denied") and
accounts sync-drift dies in `buf generate`. (Under 0.1.13's root it silently
wrote to a throwaway /frontend, then failed later on the .cache walk.)

accounts' checked output is only code/pkg/gen; generating the frontend's TS
into another service's tree during accounts' isolated sync is both incorrect
and unnecessary. Drop the plugin from the companion path. buf.gen.local.yaml
keeps it for full-workspace local dev (where ../frontend resolves), and the
committed frontend types are unchanged. Determinism + SDK-boundary guards and
verify+sync-drift pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…0.105

v0.0.104's module content is unstable in CI: sum.golang.org records the
canonical hash but the GOPRIVATE-direct fetch the go runner uses returns
different bytes (the tag was touched by service-postgres' "Restore releases /
sync go.sum" workflow migration), so `go mod download` fails with a
checksum-mismatch SECURITY ERROR during runtime-init. v0.0.105 is the stable
release cut via the shared workflow; bump to it and refresh go.sum.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…e TS

go-grpc 0.1.13->0.1.17: 0.1.17 ships #30/#32 "Insert cross-package imports
missing from generated gateway code", so regenerated platform_admin.pb.gw.go
now imports `jobsv1 "accounts/pkg/gen/saas/jobs/v1"` and compiles. Clears the
lint/compile `undefined: jobsv1` wall (verify+sync-drift+lint pass; accounts
builds).

Then the compile phase surfaced two pre-existing strict-mode TS errors in the
frontend (never reached before, CI failed earlier):
- themePreferenceToProto: add a default return so the fn returns on all paths
  (TS2366).
- theme-preference-provider: coerce the restored value to a string in the
  catch (`previous ?? "system"`) — inside the useCallback the guard doesn't
  persist narrowing, so it widened to string|undefined (TS2345).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
AntoineToussaint and others added 2 commits July 26, 2026 18:19
… .cache)

TestRESTSurfaceArtifactsAreDeterministicAndCurrent and the go:generate
rest-surface step both consume the merged raw OpenAPI as an input, alongside
committed siblings (generated/service-catalog.json, gateway-routes.json). But
protoc-gen-openapiv2 wrote it to the gitignored .cache/openapi/ scratch dir,
which the go-grpc builder produces only in its throwaway sync stage and never
materializes in the real tree — so a clean checkout / CI never has it and the
test failed: `open ../../../.cache/openapi/api.swagger.json: no such file`.

Root cause: a required, reproducible determinism-test input was treated as an
ignored intermediate. Fix the shape, not the call site: relocate the
openapiv2 output to the tracked generated/openapi-raw/ and commit it as a
checked fixture like its siblings. Updates both buf.gen configs, the
go:generate directive, and the two test read sites; regenerates the fixture.

Verified: pkg/cataloggen tests (incl. the previously-failing determinism test),
TestMergedProtocolGeneratorsUseOneInvocation, SDK-boundary, and
verify+sync-drift all pass. The determinism test is the covering test — it
failed on the missing file and now passes, guarding the fixture's presence
(readFixture) and currency (re-derives the public doc; 115 operations).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The codefly nextjs agent runs the suite as
`npm run test -- --reporter=json --outputFile=<file>` and parses vitest's JSON
report. The `test` script was `vitest run && node --test scripts/...`, so npm
appended `--reporter=json --outputFile=…` to the LAST command (node --test),
not vitest — vitest emitted no JSON and the agent read "0 passed", failing the
test phase even though every test passed.

Root cause: the default suite mixed two runners, breaking the agent's
single-runner (vitest) result contract. Run the build-tooling unit test under
vitest too (add scripts/**/*.test.mjs to the vitest include; import `test`
from vitest) and set `test` to `vitest run`. Behavior-preserving.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@AntoineToussaint

Copy link
Copy Markdown
Contributor Author

Closing as superseded by merged #15. Current main contains the converged metadata work and a stronger billing-test repair: package-level Postgres serialization plus one transaction that holds all related table locks through plan reset. Rebasing this older branch would discard that newer architecture and reintroduce hundreds of stale tree differences.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant