PR snapshot factory dispatches an npm_tag input it does not declare

Open Beginner friendly
#1,091 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
github-actions, typescript
Domain
ci-cd, release

Research direction

Read genie/ci-workflow/pr-snapshot.ts around the scheduled-recovery dispatch near line 301 and dispatchInputs near line 806. Confirm how dispatchModeOption and the validator's npm-tag output are used, then verify the recovery command no longer sends an undeclared npm_tag input and that the existing consumer workaround is no longer needed.

Written by the indexing model from the issue text.

Description

Problem

genie/ci-workflow/pr-snapshot.ts has an internal inconsistency between what its scheduled-recovery step sends and what its dispatchInputs declares.

The recovery dispatch (line ~301) passes five inputs:

gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref main \
  -f mode=promote-pr-snapshot \
  -f npm_tag=latest \
  -f pr_number="$pr_number" \
  -f head_sha="$head_sha" \
  -f ci_run_id="$selected_run_id"

dispatchInputs (line ~806) declares only three: pr_number, head_sha, ci_run_id. (mode is contributed separately by each consumer, via dispatchModeOption.) npm_tag is declared nowhere in the factory.

GitHub rejects a workflow run that carries an undeclared input, so in a consumer that does not independently declare npm_tag, the scheduled retry — the path that re-dispatches an authorized but incomplete cohort — fails instead of recovering. That is precisely the path that exists to repair a partial or failed publication.

Why it has not been seen

livestorejs/livestore already declares npm_tag for its own release jobs (read as inputs.npm_tag by its publish steps), so the factory's dispatch happens to be accepted there. livestorejs/livestore-contrib has no such input, which is where this surfaced — via automated review on livestorejs/livestore-contrib#40.

Note the factory never reads npm_tag either: the publish tag comes from the validator's npm-tag output.

Suggested fix

Drop -f npm_tag=latest from the dispatch. It is unused by the factory's own jobs, and the tag is already carried by the validator output.

If some consumer genuinely needs it forwarded, the alternative is to add npm_tag to dispatchInputs so the declaration travels with the code that sends it — but the unused-argument reading seems more likely.

Workaround in place

livestore-contrib currently declares a npm_tag input purely to satisfy the dispatch contract, with a comment pointing at this issue so it can be removed once the factory is fixed.

Dominant language
TypeScript
Stars
82
Forks
2
Avg merge
1d 8h
Merged PRs (30d)
121

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from overengineeringstudio/effect-utils

All issues in overengineeringstudio/effect-utils

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.