chore(common): bump the common submodule to 4de5dfa and adopt the tree-ownership guard #100

Merged

David merged 1 commit from chore/GOV-45-update-common-submodule into main

2026-08-08 02:33:23 +02:00

David commented

2026-08-08 01:20:56 +02:00

Owner

Bumps the common submodule gitlink from c809345 to 4de5dfa (current psa-systems/common main) and ports the new tree-ownership guard into this repo's pre-commit override. Part of the cross-repo sync tracked in GOV-45.

What the new pin brings in: the reusable check workflow's compile_step / test_args / cache inputs and its runner-label switch to RUNS_ON_OPENSUSE_DEV_LATEST, the dev_extra_volumes variable on dev-clean, the virtual-workspace release layout, the nu line-continuation fix in build-docker-export, and the check-tree-ownership recipe.

vervain-apps overrides pre-commit (it builds Tailwind first, checks the wasm target, and feature-gates clippy and the tests), so guards added inside common's own variants do not reach this repo through the gitlink alone. just check-tree-ownership is ported into the override and runs after the tests: it fails the commit if any path in the working tree is not owned by the host user. That is the same failure the build-css recipe already guards against from the other side by running the bun container as the host uid/gid, so the two now cover both directions.

Not applicable here: default is already the first recipe, the root Cargo.toml is a single-package manifest so the generic release layout still holds, there is no compose.dev.yml so dev_extra_volumes has nothing to add, and vervain-apps ships its own check.yml rather than calling the shared workflow.

Verification: just pre-commit passes on the new pin (Tailwind build, fmt, clippy with --features server, cargo check --features server, cargo check --target wasm32-unknown-unknown, 102 tests, and check-tree-ownership reports the working tree fully owned by the host user).

#GOV-45

Bumps the `common` submodule gitlink from `c809345` to `4de5dfa` (current `psa-systems/common` `main`) and ports the new tree-ownership guard into this repo's `pre-commit` override. Part of the cross-repo sync tracked in GOV-45. What the new pin brings in: the reusable check workflow's `compile_step` / `test_args` / `cache` inputs and its runner-label switch to `RUNS_ON_OPENSUSE_DEV_LATEST`, the `dev_extra_volumes` variable on `dev-clean`, the `virtual-workspace` release layout, the nu line-continuation fix in `build-docker-export`, and the `check-tree-ownership` recipe. vervain-apps overrides `pre-commit` (it builds Tailwind first, checks the wasm target, and feature-gates clippy and the tests), so guards added inside common's own variants do not reach this repo through the gitlink alone. `just check-tree-ownership` is ported into the override and runs after the tests: it fails the commit if any path in the working tree is not owned by the host user. That is the same failure the `build-css` recipe already guards against from the other side by running the bun container as the host uid/gid, so the two now cover both directions. Not applicable here: `default` is already the first recipe, the root `Cargo.toml` is a single-package manifest so the `generic` release layout still holds, there is no `compose.dev.yml` so `dev_extra_volumes` has nothing to add, and vervain-apps ships its own `check.yml` rather than calling the shared workflow. Verification: `just pre-commit` passes on the new pin (Tailwind build, fmt, clippy with `--features server`, `cargo check --features server`, `cargo check --target wasm32-unknown-unknown`, 102 tests, and `check-tree-ownership` reports the working tree fully owned by the host user). #GOV-45

David added 1 commit

2026-08-08 01:20:56 +02:00

chore(common): bump the common submodule to 4de5dfa and adopt the tree-ownership guard

Check / fmt + clippy + build + tests (pull_request) Successful in 1m33s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

64333f2e96

Moves the `common` gitlink from c809345 to 4de5dfa, picking up the `compile_step` / `test_args` / `cache` inputs and the runner-label switch in the reusable check workflow, the `dev_extra_volumes` variable on `dev-clean`, the `virtual-workspace` release layout, the nu line-continuation fix in `build-docker-export`, and the `check-tree-ownership` guard.

vervain-apps overrides `pre-commit` (it builds Tailwind first, checks the wasm target, and feature-gates clippy and the tests), so the guard common added to its own variants does not reach this repo by the gitlink alone; it is ported into the override here. It fails the commit if any path in the working tree is not owned by the host user, which is exactly the failure the `build-css` recipe already guards against from the other side by running the bun container as the host uid/gid.

`default` is already the first recipe, the root Cargo.toml is a single-package manifest so the generic release layout still applies, and there is no compose.dev.yml, so `dev_extra_volumes` has nothing to add. `just pre-commit` passes on the new pin (fmt, clippy, server check, wasm check, 102 tests, ownership guard clean).

#GOV-45