ci: remove the update-lolhtml workflow

.github/workflows/source-lints.yml

@@ -33,6 +33,7 @@ on:
       - "test/internal/source-lints/**"
       - ".github/workflows/source-lints.yml"
       - ".github/workflows/comment-cop.yml"
+      - ".github/workflows/update-*.yml"
       - ".github/actions/setup-bun/**"
   pull_request:
     paths:
@@ -57,6 +58,7 @@ on:
       - "test/internal/source-lints/**"
       - ".github/workflows/source-lints.yml"
       - ".github/workflows/comment-cop.yml"
+      - ".github/workflows/update-*.yml"
       - ".github/actions/setup-bun/**"
   merge_group:
 

scripts/build/deps/README.md

@@ -41,6 +41,16 @@ The `.github/workflows/update-<name>.yml` jobs do this automatically by
 sed'ing the `const <NAME>_COMMIT = "..."` line. If you rename that
 constant, update the workflow too.
 
+A dep that is fetched from an oven-sh fork (boringssl, libuv, lolhtml,
+mimalloc, tinycc) has no such workflow, and must not get one: its pin is
+a commit of the fork, so a job that follows upstream releases proposes a
+commit that cannot build. Bump those by hand, after the rebase in the
+fork.
+
+`test/internal/source-lints/update-workflows.test.ts` checks both rules:
+each job's sed patterns match the pin line of its dep file, and the job
+asks the repository that the dep is fetched from.
+
 **For `direct` deps:** the source list is hardcoded, so a bump that adds
 or removes a `.c`/`.cpp` upstream needs a matching list edit here. CI
 catches a missed addition (link error on the unresolved symbol); a

scripts/build/deps/lolhtml.ts

@@ -17,6 +17,10 @@
  * This dep entry exists only to FETCH the source into `vendor/lolhtml/` —
  * `emitRust` in `rust.ts` waits on its `.ref` stamp so cargo never sees a
  * missing path dependency.
+ *
+ * The source is a fork (see LOLHTML_COMMIT below), so lolhtml has no
+ * `.github/workflows/update-lolhtml.yml`: the pin is a commit of the fork,
+ * never of upstream, and a bump starts with a rebase in the fork.
  */
 
 import type { Dependency } from "../source.ts";

test/internal/source-lints/update-workflows.test.ts

@@ -0,0 +1,55 @@
+/**
+ * Each .github/workflows/update-<name>.yml asks GitHub for the latest release
+ * of a repository. It reads the `<NAME>_COMMIT` pin in
+ * scripts/build/deps/<name>.ts with sed, and opens a pull request that rewrites
+ * the pin, also with sed, to the commit of that release. That only works when:
+ *
+ * - The repository it asks is the one the dep is fetched from. update-lolhtml.yml
+ *   broke this way. The dep moved to the oven-sh/lol-html fork, the workflow
+ *   still asked cloudflare/lol-html, and each weekly run proposed an upstream
+ *   commit that bun cannot build. A dep that is fetched from a fork has no
+ *   update workflow.
+ * - Its sed patterns match the pin line. A renamed constant, or a comment at the
+ *   end of the line, makes each weekly run fail, and nobody watches those runs.
+ */
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const repoRoot = join(import.meta.dir, "..", "..", "..");
+const workflowsDir = join(repoRoot, ".github", "workflows");
+
+test("each update workflow agrees with its dep file", () => {
+  const checked: string[] = [];
+  for (const workflow of new Bun.Glob("update-*.yml").scanSync(workflowsDir)) {
+    const text = readFileSync(join(workflowsDir, workflow), "utf8");
+    const depFile = text.match(/^\s*DEP_FILE=(scripts\/build\/deps\/[\w-]+\.ts)$/m)?.[1];
+    if (!depFile) {
+      // update-sqlite3.yml and update-vendor.yml do not bump a pin in scripts/build/deps/.
+      expect({ workflow, readsADepFile: text.includes("scripts/build/deps/") }).toEqual({
+        workflow,
+        readsADepFile: false,
+      });
+      continue;
+    }
+    const dep = readFileSync(join(repoRoot, depFile), "utf8");
+
+    const asks = new Set(Array.from(text.matchAll(/api\.github\.com\/repos\/([\w.-]+\/[\w.-]+)\//g), m => m[1]));
+    // The `s/<pattern>/` of each sed call: one reads the pin, one rewrites it.
+    const sedPatterns = Array.from(text.matchAll(/\bsed [^'\n]*'s\/([^/\n]+)\//g), m => m[1]);
+
+    expect({
+      workflow,
+      asks: [...asks],
+      sedCalls: sedPatterns.length,
+      sedPatternsThatMissThePin: sedPatterns.filter(pattern => !new RegExp(pattern, "m").test(dep)),
+    }).toEqual({
+      workflow,
+      asks: [dep.match(/^\s*repo: "([^"]+)",$/m)?.[1]],
+      sedCalls: 2,
+      sedPatternsThatMissThePin: [],
+    });
+    checked.push(workflow);
+  }
+  expect(checked.length).toBeGreaterThan(0);
+});