feat(web): open the preview when an action with previewUrl runs

.github/scripts/check-source-stack.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# Verify that a manually supplied nightly source contains every fork patch
+# present on main. This catches accidentally stale stacks; it is not a
+# security boundary or a net-tree comparison (a later revert can still retain
+# an earlier commit's patch-id). The refs must already exist locally, and the
+# fork's squash-merged patch stack is expected to have linear history.
+set -euo pipefail
+
+main_ref="${1:?main ref is required}"
+candidate_ref="${2:?candidate ref is required}"
+upstream_ref="${3:?upstream ref is required}"
+waived_input="${4:-}"
+
+for ref in "$main_ref" "$candidate_ref" "$upstream_ref"; do
+  git rev-parse --verify "${ref}^{commit}" >/dev/null
+done
+
+# Waivers are the reviewed commits themselves, not a blanket override: a
+# patch that merges to main after the review is not on the list and still
+# fails the dispatch. The former allow_missing_main_patches boolean waived
+# every missing patch at once, so it could not make that distinction.
+if [[ "$waived_input" == "true" ]]; then
+  echo "The allow_missing_main_patches boolean was replaced by waived_main_patches; list each reviewed commit instead." >&2
+  exit 1
+fi
+if [[ "$waived_input" == "false" ]]; then
+  waived_input=""
+fi
+
+waived_entries=()
+normalized_waivers="${waived_input//[$'\n',]/ }"
+read -r -a waived_entries <<< "$normalized_waivers" || true
+
+waived_commits=()
+if (( ${#waived_entries[@]} > 0 )); then
+  for entry in "${waived_entries[@]}"; do
+    if ! commit=$(git rev-parse --verify --quiet "${entry}^{commit}"); then
+      echo "waived_main_patches entry '${entry}' does not resolve to a commit." >&2
+      exit 1
+    fi
+    waived_commits+=("$commit")
+  done
+fi
+
+is_waived() {
+  local wanted="$1" waived
+  (( ${#waived_commits[@]} > 0 )) || return 1
+  for waived in "${waived_commits[@]}"; do
+    if [[ "$waived" == "$wanted" ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+describe_commit() {
+  printf '  %s %s\n' \
+    "$(git rev-parse --short=12 "$1")" \
+    "$(git show -s --format=%s "$1")"
+}
+
+cherry_output=$(git cherry "$candidate_ref" "$main_ref" "$upstream_ref")
+
+missing_commits=()
+while read -r status commit; do
+  if [[ "$status" == "+" ]]; then
+    missing_commits+=("$commit")
+  fi
+done <<< "$cherry_output"
+
+if (( ${#missing_commits[@]} == 0 )); then
+  echo "source_ref contains every patch currently carried by main."
+  if (( ${#waived_commits[@]} > 0 )); then
+    echo "Every waived_main_patches entry is present after all; the waivers were not needed." >&2
+  fi
+  exit 0
+fi
+
+waived_missing=()
+unwaived_commits=()
+for commit in "${missing_commits[@]}"; do
+  if is_waived "$commit"; then
+    waived_missing+=("$commit")
+  else
+    unwaived_commits+=("$commit")
+  fi
+done
+
+if (( ${#waived_missing[@]} > 0 )); then
+  {
+    echo "Waived main patches missing from source_ref (reviewed as intentionally reshaped):"
+    echo
+    for commit in "${waived_missing[@]}"; do
+      describe_commit "$commit"
+    done
+    echo
+  } >&2
+  echo "::warning title=Waived missing main patches::Continuing past ${#waived_missing[@]} reviewed patch-id difference(s) listed in the log." >&2
+fi
+
+if (( ${#unwaived_commits[@]} == 0 )); then
+  exit 0
+fi
+
+{
+  echo "source_ref is missing patch-id-equivalent commits currently carried by main:"
+  echo
+  for commit in "${unwaived_commits[@]}"; do
+    describe_commit "$commit"
+  done
+  echo
+} >&2
+
+echo "Refresh the resolution from current main before dispatching it." >&2
+echo "If conflict resolution intentionally reshaped these patches, re-dispatch" >&2
+echo "listing each reviewed commit in waived_main_patches." >&2
+echo "::error title=source_ref is missing patches from main::Refresh the stack or waive each reviewed patch-id difference explicitly." >&2
+exit 1

.github/scripts/rebase-onto-upstream.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Rebase the checked-out patch stack onto the tip of upstream main. Sourced by
+# Fork CI's upstream-rebase job and Fork Nightly's prepare step so both use
+# the same upstream remote and rebase mechanics.
+set -euo pipefail
+
+git config user.name "github-actions[bot]"
+git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+git remote add upstream https://github.com/pingdotgg/t3code.git
+git fetch --no-tags upstream main
+# shellcheck disable=SC2034 # Consumed by scripts that source this file.
+UPSTREAM_REF=$(git rev-parse FETCH_HEAD)
+git rebase "$UPSTREAM_REF"
+
+# The patch stack must never touch upstream's migration manifest or migration
+# files. A fork commit in upstream's numbered sequence collides silently on a
+# later rebase: the SQL migrator treats the highest recorded ID as a watermark,
+# so existing installs skip the upstream migration that lands on the same slot.
+offending_migration_files=$(git diff --name-only "$UPSTREAM_REF" HEAD -- \
+  'apps/server/src/persistence/Migrations.ts' \
+  'apps/server/src/persistence/Migrations/')
+if [[ -n "$offending_migration_files" ]]; then
+  {
+    echo "Error: the fork patch stack modifies upstream migration files:"
+    echo
+    echo "$offending_migration_files"
+    echo
+    echo "Fork migrations belong in apps/server/src/persistence/ForkMigrations/"
+    echo "with their own append-only history. See docs/internals/fork-migrations.md."
+  } >&2
+  exit 1
+fi

.github/scripts/release-changelog.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+list_fork_release_commits() {
+  local previous_release_ref="$1"
+  local fork_source_ref="$2"
+  local upstream_ref="$3"
+
+  if [[ -n "$previous_release_ref" ]]; then
+    git rev-list --reverse --cherry-pick --right-only \
+      "${previous_release_ref}...${fork_source_ref}" \
+      --not "$upstream_ref"
+    return
+  fi
+
+  local fork_base
+  fork_base=$(git merge-base "$fork_source_ref" "$upstream_ref")
+  git rev-list --reverse "${fork_base}..${fork_source_ref}" --not "$upstream_ref"
+}