Repository navigation
refactor: Use vendored dependencies instead of subactions - #48
Merged
Merged
Conversation
Add scripts/Bundle-Vendors.ps1, which re-copies the whole submodules/msaccess-vcs-build tree (DecimalTurn fork @685b323) into the committed vendors/msaccess-vcs-build directory and writes a timestamp-free SOURCE.txt for provenance. Vendored files are forced to LF via .gitattributes so regeneration is byte-idempotent across OSes.
Fold the Access build flow into Main.ps1 using the committed vendors/msaccess-vcs-build tree: digest-verify the add-in release (PowerShell, auth via GH_TOKEN), install the add-in once into %APPDATA%, then run the vendored Build.ps1 per Access folder in a fresh child pwsh with an empty vcsUrl. Reproduces the subaction per-folder compile flag (name-based unless access-vcs-compile is set) and keeps app-config and Prepare-Application support. New access-vcs-* params are plumbed from action.yml in a later commit.
…ubaction Pass the access-vcs-url/sha/config/compile inputs to Main.ps1 and delete the 'Build Access Database' composite step plus the subactions/msaccess-vcs-build-all directory (its parse + verify-vcs-digest logic now lives in Main.ps1). Also remove the dead first-access-folder output, which referenced a non-existent extract_access_folder step.
The regex manager only matched subactions/**/action.yml, which no longer exist after the msaccess-vcs-build-all fold-in. The pinned upstream dependency now lives in the submodule pointer refreshed by scripts/Bundle-Vendors.ps1.
New lightweight workflow that checks out with submodules, re-runs scripts/Bundle-Vendors.ps1, and fails if it produces any diff under vendors/. Keeps the committed vendored tree in sync with the submodule pointer.
The old customManager watched the removed subaction's uses: pin. The native git-submodules manager (beta, opt-in) now tracks the submodule instead: with .gitmodules branch=rate-limiting, Renovate opens a PR when the fork's branch advances. Note: such PRs only bump the submodule gitlink, so vendors/ must be regenerated via scripts/Bundle-Vendors.ps1 (the sync-vendors CI guard flags it).
When Renovate's git-submodules manager opens a PR that bumps the submodule gitlink, this workflow checks out the PR branch (with submodules), re-runs scripts/Bundle-Vendors.ps1 against the new submodule commit, and pushes the regenerated vendors/ back to the Renovate branch - so the sync-vendors guard passes without a manual step. Gated to Renovate-authored, same-repo PRs; commits with GITHUB_TOKEN (no workflow re-trigger, so no loop); no-ops when vendors/ is already in sync or the submodule didn't move.
- Drop the startsWith(head.ref, 'renovate/') fallback; require the exact renovate[bot] login (a collaborator could otherwise spoof a renovate/* branch name to trigger the job). - Add a diff-scope gate: the PR must change ONLY the submodule gitlink (plus already-regenerated vendors/). If it touches .gitmodules, scripts/, .github/ or anything else the job is skipped, so the executed Bundle-Vendors.ps1 is always the trusted base version and PR-head code is never run.
Bundle-Vendors.ps1 recorded 'git remote get-url origin', which differs between environments (a developer's clone may carry a user@ prefix while CI uses the clean .gitmodules URL). This made SOURCE.txt non-reproducible and failed the sync-vendors guard. Read the URL from .gitmodules instead, falling back to the origin remote with embedded credentials stripped.
There was a problem hiding this comment.
🟡 Changes recommended
There are correctness/robustness issues in the newly vendored scripts and the new Access orchestration (e.g., a broken/dead variable assignment in Run-AccUnit-Tests, missing release-asset validation in Install-msaccess-vcs, and temp directory cleanup in Main.ps1).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Refactors the Access build integration to run against a committed, vendored copy of msaccess-vcs-build (pinned via a submodule + bundling script) instead of invoking it via a nested composite “subaction”, removing the previous “Call action 0..4” cap and making the runtime independent of submodules.
Changes:
- Vendor
msaccess-vcs-buildintovendors/msaccess-vcs-build/and addscripts/Bundle-Vendors.ps1+ provenance (SOURCE.txt). - Update
Main.ps1and the rootaction.ymlto build detected Access exports via the vendored scripts (with optional SHA256 digest verification and one-time add-in install). - Add CI automation to keep
vendors/synchronized with the submodule pointer and auto-refresh vendors on Renovate submodule PRs; switch Renovate togit-submodules.
File summaries
| File | Description |
|---|---|
| vendors/msaccess-vcs-build/SOURCE.txt | Records vendored upstream URL/commit and regeneration command. |
| vendors/msaccess-vcs-build/scripts/Set-TrustedLocation.ps1 | Vendored helper to register trusted locations for Access automation. |
| vendors/msaccess-vcs-build/scripts/Run-AccUnit-Tests.ps1 | Vendored runner for AccUnit tests against a built database. |
| vendors/msaccess-vcs-build/scripts/Remove-TrustedLocation.ps1 | Vendored helper to remove trusted location registry entry. |
| vendors/msaccess-vcs-build/scripts/Prepare-Application.ps1 | Vendored “prepare” script (remove modules/references, run procedures, set DB properties). |
| vendors/msaccess-vcs-build/scripts/Install-msaccess-vcs.ps1 | Vendored installer that downloads and expands the msaccess-vcs add-in from GitHub releases. |
| vendors/msaccess-vcs-build/scripts/Install-AccUnit.ps1 | Vendored installer that downloads/builds the AccUnit loader add-in. |
| vendors/msaccess-vcs-build/scripts/Get-GitHubHeaders.ps1 | Vendored helper to add auth headers when GH/GITHUB token env vars are present. |
| vendors/msaccess-vcs-build/scripts/Export-Accdb.ps1 | Vendored export script for msaccess-vcs exports. |
| vendors/msaccess-vcs-build/scripts/Compile-Accdb.ps1 | Vendored compilation script to produce .accde. |
| vendors/msaccess-vcs-build/scripts/Build-Accdb.ps1 | Vendored build script to assemble an .accdb from msaccess-vcs exports. |
| vendors/msaccess-vcs-build/README.md | Vendored upstream documentation/reference for the dependency. |
| vendors/msaccess-vcs-build/LICENSE | Vendored upstream license. |
| vendors/msaccess-vcs-build/examples/Prepare-Application-Config.json | Vendored example config for prepare step. |
| vendors/msaccess-vcs-build/examples/Build-self-hosted_Office64and32bit.yml | Vendored example workflow demonstrating multi-arch self-hosted builds. |
| vendors/msaccess-vcs-build/examples/Build-self-hosted_Office.yml | Vendored example workflow demonstrating self-hosted builds. |
| vendors/msaccess-vcs-build/Build.ps1 | Vendored entry script invoked per Access folder by the updated flow. |
| vendors/msaccess-vcs-build/action.yml | Vendored reference-only action metadata (documented as not executed). |
| subactions/msaccess-vcs-build-all/action.yml | Removes prior subaction wrapper that unrolled a fixed number of “Call action N” steps. |
| scripts/Bundle-Vendors.ps1 | New bundler to refresh vendors/msaccess-vcs-build deterministically from the submodule. |
| renovate.json | Switch Renovate config to manage submodule updates via git-submodules. |
| PLAN-Vendor-Approach.md | Updates the design plan to reflect the finalized vendoring + build orchestration approach. |
| Main.ps1 | Adds the new Access build orchestration using vendored scripts, digest verification, and one-time install. |
| action.yml | Plumbs new Access inputs into Main.ps1 and removes the separate Access subaction step/output. |
| .github/workflows/sync-vendors.yml | Adds a CI guard to ensure vendored files match the submodule state. |
| .github/workflows/refresh-vendors-renovate.yml | Adds automation to regenerate and commit vendors/ on Renovate submodule PRs. |
| .gitattributes | Forces LF line endings for vendored files to keep bundling idempotent across OSes. |
Review details
Suppressed comments (1)
vendors/msaccess-vcs-build/scripts/Install-msaccess-vcs.ps1:31
- Typo in comment: “extrat” → “extract”.
# extrat to local folder (don't use original MSAccessVCS folder)
- Files reviewed: 27/27 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Remove the vba-build-<pid> temp directory created for the add-in download in the finally block, so self-hosted runners don't accumulate leftover folders.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.