From 4bd9090e5036fe52b57f93994fca56119edba4d4 Mon Sep 17 00:00:00 2001 From: Sahilb315 Date: Tue, 30 Jun 2026 15:00:08 +0530 Subject: [PATCH 1/2] ci: migrate PMG to v1 server-mode proxy Bump safedep/pmg to v0.21.2 (SHA-pinned) and switch both the ci.yml release-preflight job and the goreleaser.yml release job to server-mode. In server mode the proxy daemon owns event delivery, so the job-end `pmg cloud sync` is replaced with `pmg proxy stop --fail-on-violation`, which flushes events and fails the job on any blocked package. Drop continue-on-error from the goreleaser stop step so a blocked package fails the job instead of passing silently. Note the limitation: the step runs after publish, so it alerts but cannot stop a release. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 7 ++++--- .github/workflows/goreleaser.yml | 12 ++++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0a16a48..c1b9969 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,8 +61,9 @@ jobs: cache: "pnpm" - name: Install and configure PMG - uses: safedep/pmg@46cc70db535107183c9e752bb55d1d5c5f1a9290 # v0.14.0 + uses: safedep/pmg@7b13b6bfb3cdb8cde1212e7a0e8788b22bf2081e # v0.21.2 with: + server-mode: true api-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }} tenant-id: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN }} endpoint-id: CICD_GHA_SAFEDEP_CLI @@ -79,6 +80,6 @@ jobs: - name: Release preflight run: pnpm nx run safedep-cli:release-preflight - - name: Sync PMG events + - name: Stop PMG proxy if: always() - run: pmg cloud sync + run: pmg proxy stop --fail-on-violation diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml index 06ba809..c2d1f51 100644 --- a/.github/workflows/goreleaser.yml +++ b/.github/workflows/goreleaser.yml @@ -42,8 +42,9 @@ jobs: cache: "pnpm" - name: Install and configure PMG - uses: safedep/pmg@46cc70db535107183c9e752bb55d1d5c5f1a9290 # v0.14.0 + uses: safedep/pmg@7b13b6bfb3cdb8cde1212e7a0e8788b22bf2081e # v0.21.2 with: + server-mode: true api-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }} tenant-id: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN }} endpoint-id: CICD_GHA_SAFEDEP_CLI @@ -78,10 +79,13 @@ jobs: VERSION: ${{ steps.version.outputs.version }} NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - name: Sync PMG events + # Limitation: runs after publish, so it alerts but cannot stop a + # release. A required dep block already fails the earlier install step. The + # gap is an optional dep: pnpm skips the block and exits 0, reaching + # publish. + - name: Stop PMG proxy if: always() - continue-on-error: true - run: pmg cloud sync + run: pmg proxy stop --fail-on-violation test-installation: needs: release From fd07ab03560664bfd4d5a7edd73ea737fd1e41cd Mon Sep 17 00:00:00 2001 From: Sahilb315 Date: Tue, 30 Jun 2026 15:09:01 +0530 Subject: [PATCH 2/2] ci: migrate PMG to v1 server-mode proxy Bump safedep/pmg to the v1 action tag (SHA-pinned) and switch both the ci.yml release-preflight job and the goreleaser.yml release job to server-mode. v1 is the action's major-version tag (the CLI ships its own v0.x releases), so we pin the action line to v1 rather than a CLI tag. In server mode the proxy daemon owns event delivery, so the job-end `pmg cloud sync` is replaced with `pmg proxy stop --fail-on-violation`, which flushes events and fails the job on any blocked package. Drop continue-on-error from the goreleaser stop step so a blocked package fails the job instead of passing silently. Note the limitation: the step runs after publish, so it alerts but cannot stop a release. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 2 +- .github/workflows/goreleaser.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1b9969..e090327 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,7 +61,7 @@ jobs: cache: "pnpm" - name: Install and configure PMG - uses: safedep/pmg@7b13b6bfb3cdb8cde1212e7a0e8788b22bf2081e # v0.21.2 + uses: safedep/pmg@5ac0f275b83d9d5a9342c6aae977ec32fa330daa # v1 with: server-mode: true api-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }} diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml index c2d1f51..28a75dd 100644 --- a/.github/workflows/goreleaser.yml +++ b/.github/workflows/goreleaser.yml @@ -42,7 +42,7 @@ jobs: cache: "pnpm" - name: Install and configure PMG - uses: safedep/pmg@7b13b6bfb3cdb8cde1212e7a0e8788b22bf2081e # v0.21.2 + uses: safedep/pmg@5ac0f275b83d9d5a9342c6aae977ec32fa330daa # v1 with: server-mode: true api-key: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}