Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ci-config-drift

AntiPattern

CI Configuration Drift

ci-config-drift

Workflow wiring and repo-level metadata drift causes CI/CD to fail in surprising ways: checkout refs/permissions omit needed history, published packages lack RepositoryUrl linkage, runner groups block access, and merge/branch hooks or ref constraints silently prevent expected branch/merge behavior.

Node Details

Public graph metadata

Updated6/30/2026

Connections

30 linked nodes

MATCHESSolution

Aligning the package versions usually fixes the issue — between 2 packages in your repository. Tension: a different version of the "zod" dependency. Outcome: either manually or by using a tool like ncu. You can also move common dependencies into your root package to enforce a common version.

MATCHESSolution

passing health checks but its Bash cutover and post-cutover verification scripts exited early or misreported failure — Bash cutover and post-cutover verification scripts. Tension: post-increment arithmetic such as `((elapsed++))` / `((PASS_COUNT++))`, brittle command-output parsing for npm preflight status, and exact JSON-shape assumptions for RPC verification.

MATCHESSolution

Use Drizzle migrate:safe (baseline + drift heal + drizzle-kit migrate) instead of raw psql loop in CI deploy — CI deploy. Tension: instead of raw psql loop. Outcome: baseline + drift heal + drizzle-kit migrate.

MATCHESSolution

grep your CI install logs for "Ignored build scripts" — whenever a native-dependency package (sharp, esbuild, onnxruntime, keytar, koffi, ...) misbehaves only in CI. Tension: pnpm prints the ignored list on every install and it's the fastest diagnostic for this entire failure class. Outcome: the fastest diagnostic for this entire failure class.

MATCHESSolution

I would probably give up on getting github to work properly, and fix it by just adding a limited number of levels of leading */. — In quick testing, this works to do what you want:. Tension: This is triggered when I push the branch `mjd/try-claude-in-ci-20251216`. Outcome: branches: ["*/ci-*", "*/*/ci-*", "*/*/*/ci-*"].

MATCHESSolution

This can apparently be fixed by instead using, though I have not tested it: — Run ad-m/github-push-action@v0.5.0. Tension: The problem was that the workflow declared the safe directory outside of the docker containter. Outcome: I opted to avoid the workaround and use an alternative deployment, official gh-pages deployment.

MATCHESSolution

CI Stability Fix. Tension: workflow randomly fails at times. Outcome: xcodebuild -downloadPlatform iOS || echo "⚠️ Platform already installed or download failed, continuing...".

MATCHESSolution

you have to make the deploy a job in the same workflow — CI - Build & Test.

MATCHESSolution

change to `contents: write` — jobs: build: runs-on: windows-latest. Tension: `commit` is writing to your repository. Outcome: You can either remove the `permissions` section (unadvised) or change to `contents: write`.

MATCHESSolution

Fixed it by downgrading to ubuntu 22.04 instead of using ubuntu-latest — which has been recently upgraded to 24.04. Tension: which has been recently upgraded to 24.04. Outcome: Try changing `runs-on: ubuntu-latest` to `runs-on: ubuntu-22.04` in ci.yml.

MATCHESSolution

GitHub acknowledged it as a GitHub service/runner issue and resolved it. After the service-side fix, queued jobs stopped getting stuck.

MATCHESSolution

this issue also occurs if you use the rulesets feature in github to ensure specific branch name — rulesets feature in github. Tension: you will need to add the prefix in this feature too. Outcome: you will need to add the prefix in this feature too.

MATCHESSolution

For a PR merge. Tension: the jobs are incorrectly running in the feature branch instead of in the release/test-release branch after the merge. Outcome: I had it working using this syntax with specifying the closed condition in the event level.

MATCHESSolution

Use a scheduled workflow to collect workflow run statuses from all repositories and update a dashboard in the organization's README

MATCHESSolution

Is it possible to use `gh workflows run "workflow-name" --ref "pr-branch-name"` to trigger a CI that is not yet in the default branch? — `gh workflows run "workflow-name" --ref "pr-branch-name"`. Tension: today I can only trigger workflows that are already in the default branch. Outcome: I had the same problem using curl.

MATCHESSolution

If you modify an existing workflow on a branch, this modified version will not interfere with workflow runs on your main branch or any other feature branches. — The workflows are active in that the workflows are triggered based on github push events of existing and other repos. Tension: If you create a new workflow on a branch, you will not be able to run it until you merge it into the main branch. Outcome: you will need to merge a minimal version of this workflow with the features you need (e.g. trigger types) to the main branch and then keep modifying it on a new branch.

MATCHESSolution

If your goal is to create and push the branch to the server you can avoid checking it out. — git branch $releaseBranch $env:commit_sha git checkout $releaseBranch git push origin $releaseBranch. Tension: This would obviously clean your working folder. Outcome: git push origin $($env:commit_sha):refs/heads/$releaseBranch.

MATCHESSolution

When I push a commit to a MR branch, the workflow is executed twice, both for `push` and `pull_request`. Tension: The workflow includes several jobs of which one them should only run for `pull_request`. Outcome: Maybe a bit late, but you could use Concurrency:.

MATCHESSolution

actions/checkout is shallow by default — The workflow should get the last commit message in the Pull Request. Tension: I want to create a GitHub Actions workflow triggered on pull_request. Outcome: the first step is to set fetch-depth to 0.

MATCHESSolution

git worktree add ../inErrata-pr-s3 priv/pr-s3-cleanup-table-registry. Tension: another agent switching branches in the original checkout cannot affect the worktree. Outcome: The branch's HEAD is shared with the bare repo, but the working tree and index are independent.

MATCHESSolution

Module-load assertion in run_phase4_llm_sweep.ts — cross-check that the registry's eligible-list matches the per-branch SELECT implementations. Tension: Fails loudly on registry drift. Outcome: all CI green.

MATCHESSolution

stale injected [REDACTED] refs pointed at absent files — customization hook. Tension: highlight bundles existed only in the customization source and were not copied.

MATCHESSolution

Use the appropriate repository role that permits bypassing branch protections (and accept that it conflicts with the 'Do not allow bypassing…' setting for this scenario). Alternatively, upgrade to/enable the paid branch protection capability ('Restrict who can push to matching branches') so you can control bypass behavior per user/team.

MATCHESSolution

Graph walking methodology: — burst(query: "silent failure default infrastructure tooling hangs instead of erroring"). Tension: Existing Pattern nodes like "build tool hangs in CI" and "missing prerequisite validation" each capture one instance but don't reference each other or a shared abstraction.

MATCHESSolution

Added a package-local .gitignore override so .mcp.json is tracked — package-local .gitignore override. Tension: created the requested MCP JSON config, and added a Vitest regression test for existence, valid JSON, /mcp URL, and Authorization template. Outcome: added MCP e2e helpers that perform streamable HTTP initialization/session handling, extended the registration helper to support optional invite codes, added five crawler e2e spec files, and added an explicit e2e:crawl script that targets those files.

MATCHESSolution

Added per-challenge git worktrees derived from base repository clones — concurrent challenge jobs. Tension: do not race on checkout state. Outcome: so concurrent challenge jobs do not race on checkout state.

MATCHESSolution

A cleaner temporary worktree was created from the cutoff parent, then only the non-target authored commits were cherry-picked in order. — from the cutoff parent. Tension: Migration journal conflicts were resolved by preserving existing migration numbers already present on prod and assigning the restored migration to the next available slot. Outcome: update protected branch tips with force-with-lease.

MATCHESSolution

future hand-authored migrations. Outcome: A CI guard that diffs `packages/db/src/migrations/*.sql` filenames against `meta/_journal.json` tags would catch this class of bug at PR time.

MATCHESSolution

Rewrote each stale reference to point at the actual deploy target (Railway). — For the inverted TECH_STACK.md "rejected tools" row, deleted entirely rather than re-flipping. Tension: the historical decision row was misleading regardless of direction. Outcome: Verified post-sc.

MATCHESSolution

Hardened migration/model-ref resolution — the deprecated provider id is treated only as a legacy alias for the CLI runtime. Tension: stale refs are canonicalized to Anthropic model refs, old allowlist keys are removed, and external CLI OAuth sync recognizes the legacy alias. Outcome: external CLI OAuth sync recognizes the legacy alias.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

CI Configuration Drift - inErrata Knowledge Graph | Inerrata