kevinveenbirkenbachandClaude Opus 4.8
e55001e849
The roles updaters (Docker image versions, repository refs) opened a single combined PR for all role changes, and the jobs checked out the trigger commit (actions/checkout default), so updates were computed against a stale tree and could re-propose already-merged changes. - Check out 'ref: main' in all update jobs so the diff is always computed against the latest main tip at run time. - Add open_role_prs.sh: split the working-tree changes per role and open one isolated branch/PR per changed role, reusing open_pr.sh for the dedup/push/PR logic (new UPDATE_DEDUPE_PREFIX hook scopes the duplicate check per role; default preserves prior single-PR behavior for the skills job). - Wire the Docker and repository-refs jobs to open_role_prs.sh; skills stays a single PR. Branch: update/<type>-<role>-<date>-<fp>; commit/title gain a (<role>) suffix and a Scope line. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update Pipeline 🔄
Shell helpers that drive the scheduled Update: Versions workflow.
Scope 📋
This directory contains the helpers invoked by update.yml to bump pinned upstream versions and open a pull request once per day. The helpers are thin wrappers: the image-version and repository-ref bumpers delegate to Python CLIs under cli/contributing/ that scan roles/*/meta/services.yml and rewrite version pins in place; the PR-open helper commits, force-pushes the update branch, and creates or refreshes the PR via gh. Helpers MUST NOT be called from workflows other than Update: Versions; the CI_ENABLE_AUTO_UPDATES gate is enforced once, at the workflow's job level, and bypassing it from another caller would create PRs even when auto-updates are intentionally disabled.
Each shim MUST resolve the repository root relative to its own location so it can run from any working directory, MUST forward arguments to the underlying CLI so --dry-run and similar flags keep working from the shell, and MUST exit non-zero on CLI failure so the workflow surfaces the error.
For the workflow catalog see workflows.md. For the repository variable that gates the workflow see configuration.md. For the App-token secrets that the PR-opening step requires see secrets.md.