The test/live/delivery.test.mjs suite drives hookdeck listen, and its behaviour depends on the CLI version in ways nothing in the repo records.
What happened
The delivery suite failed all five subtests. The cause was not the node: hookdeck listen forwards from whichever project the CLI is logged into, and the local CLI was pointed at an unrelated Outpost project. The harness gave up at its 60 second timeout with hookdeck listen did not report a source URL.
That is exactly the failure describeCliSetup() in the trigger warns about:
hookdeck ci comes first deliberately: hookdeck listen otherwise uses whichever project the CLI was last logged into, and picking the wrong one fails in a way that looks like the node is broken rather than the CLI being pointed elsewhere.
The fix is to pin the CLI per checkout with hookdeck ci --local, which writes .hookdeck/config.toml in the working directory. But on CLI versions before 2.5.0, --local also rewrites the global config (hookdeck-cli#332), so the flag intended to avoid touching your global state silently switches the active project for every other hookdeck command on the machine. It was introduced in 2.0.0 and stayed broken until 2.5.0.
After upgrading to 2.5.0 and pinning, all five subtests passed.
What to add
- A version floor in
CONTRIBUTING.md, next to the live-test instructions: the delivery suite needs the Hookdeck CLI pinned to the project under test, hookdeck ci --local is how, and that requires CLI >= 2.5.0.
- A check in the harness.
hasCommand('hookdeck') currently gates the suite on the CLI existing. It could also read hookdeck version and skip with a reason naming the version, rather than failing five subtests on a 60 second timeout each.
- Consider having the harness pass
HOOKDECK_API_KEY in the hookdeck listen spawn environment. 2.5.0 honours it, which would remove the dependency on either config file and make the "wrong project" failure impossible rather than merely documented.
Point 3 is the real fix; 1 and 2 are what stops the next person losing an hour before they get there.
Note
.hookdeck/ was added to .gitignore in #15, because --local writes a project API key into the working tree and nothing was ignoring it.
Found while preparing the verification demo.
The
test/live/delivery.test.mjssuite driveshookdeck listen, and its behaviour depends on the CLI version in ways nothing in the repo records.What happened
The delivery suite failed all five subtests. The cause was not the node:
hookdeck listenforwards from whichever project the CLI is logged into, and the local CLI was pointed at an unrelated Outpost project. The harness gave up at its 60 second timeout withhookdeck listen did not report a source URL.That is exactly the failure
describeCliSetup()in the trigger warns about:The fix is to pin the CLI per checkout with
hookdeck ci --local, which writes.hookdeck/config.tomlin the working directory. But on CLI versions before 2.5.0,--localalso rewrites the global config (hookdeck-cli#332), so the flag intended to avoid touching your global state silently switches the active project for every otherhookdeckcommand on the machine. It was introduced in 2.0.0 and stayed broken until 2.5.0.After upgrading to 2.5.0 and pinning, all five subtests passed.
What to add
CONTRIBUTING.md, next to the live-test instructions: the delivery suite needs the Hookdeck CLI pinned to the project under test,hookdeck ci --localis how, and that requires CLI >= 2.5.0.hasCommand('hookdeck')currently gates the suite on the CLI existing. It could also readhookdeck versionand skip with a reason naming the version, rather than failing five subtests on a 60 second timeout each.HOOKDECK_API_KEYin thehookdeck listenspawn environment. 2.5.0 honours it, which would remove the dependency on either config file and make the "wrong project" failure impossible rather than merely documented.Point 3 is the real fix; 1 and 2 are what stops the next person losing an hour before they get there.
Note
.hookdeck/was added to.gitignorein #15, because--localwrites a project API key into the working tree and nothing was ignoring it.Found while preparing the verification demo.