From e4d82cae4434bd11416de717a476f5aeaeb540ee Mon Sep 17 00:00:00 2001 From: Tim Nunamaker Date: Thu, 10 Sep 2026 15:26:16 -0500 Subject: [PATCH] chore: pin data-connect to data-connect#89's merge commit The data-connect pin named 27fe8086d on branch chore/revendor-connectors-92, an unmerged branch. data-connect's consumer-drift-signal workflow requires the pinned commit to exist in its own checkout before it can diff guarded paths against it, and a pull-request merge ref cannot reach a commit that lives only on an unrelated branch. Once that branch was rebased, 27fe8086d became reachable from no ref at all, so the lookup failed for every data-connect pull request touching a guarded path, including ones that change nothing under the vendored tree. data-connect#89 has now merged as 1577a34e5, putting the re-vendored connector sources on main. Pointing the pin at that merge commit restores a reachable, merged-main SHA and clears the failure for both repositories. Verified locally at the new pin: drift jobs (a) collector-definitions, (b) connector-sources (30 files across 6 connectors byte-identical), (d) reference-contract and (e) collector-packaging-manifest all pass. Job (c) tarball-digests could not run in this environment because npm refused a git-protocol dependency fetch; it is unverified here rather than passing. Assisted-by: AI Signed-off-by: Tim Nunamaker --- .github/cross-repo-pins.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/cross-repo-pins.json b/.github/cross-repo-pins.json index 34511bca..d2466dfe 100644 --- a/.github/cross-repo-pins.json +++ b/.github/cross-repo-pins.json @@ -5,9 +5,9 @@ "data-connect": { "owner": "PDP-Connect", "repo": "data-connect", - "sha": "27fe8086d4ac355b71887635cc97d49c0933f307", - "branch": "chore/revendor-connectors-92", - "note": "Coordinated with data-connect#89: this PR head vendors the malformed-line isolation and Claude/Codex symlink disclosure sources from data-connectors#92, including the regenerated package index. Track the unmerged branch so source drift and pin freshness compare the paired trees. After data-connect#89 merges, replace this SHA with its actual merge commit and restore branch main. Runtime/protocol packages and collector definitions are unchanged; the separate 1.0.0 release pin remains unchanged. This pin also backs drift job (e) local-collector packaging manifest: it supplies packages/local-collector/tsconfig.build.json, the compile list that job compares against this repo's connector registry." + "sha": "1577a34e5c9f5934c83ed41e0b5aa735744eb119", + "branch": "main", + "note": "Merge commit of data-connect#89 into PDP-Connect/data-connect main (merged 2026-09-10T20:23:23Z), verified via `gh api repos/PDP-Connect/data-connect/branches/main` at pin time. Supersedes the temporary 27fe8086d pin, which tracked the unmerged branch chore/revendor-connectors-92 so the paired trees could be compared before #89 landed. A pin on an unmerged branch cannot stay valid: data-connect's consumer-drift-signal workflow requires the pinned commit to exist in its own checkout, and a pull-request merge ref cannot reach a commit that lives only on an unrelated branch. When #89 was rebased, 27fe8086d stopped being reachable from any ref, so every data-connect pull request touching a guarded path failed on the pin lookup regardless of what it changed. Pinning a merged main commit removes that failure mode. data-connect#89 vendors the malformed-line isolation and Claude/Codex symlink disclosure sources from data-connectors#92, so drift jobs (a) collector-definitions and (b) connector-sources both pass at this SHA. Runtime/protocol packages and collector definitions are unchanged; the separate 1.0.0 release pin remains unchanged. This pin also backs drift job (e) local-collector packaging manifest: it supplies packages/local-collector/tsconfig.build.json, the compile list that job compares against this repo's connector registry." }, "data-connect-1-0-0": { "owner": "PDP-Connect",