project-auto-wizard 0.16.1 → 0.17.0

package/payload/workflows/python/PROJECT-PYTHON-PR-PREVIEW.yaml

@@ -123,10 +123,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
 
       - name: Add 👀 reaction to comment
         if: contains(github.event.comment.body, '/wizard') && contains(github.event.comment.body, 'server')
@@ -231,10 +229,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -279,7 +275,7 @@ jobs:
         uses: actions/github-script@v9
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const prNumber = context.issue.number;
@@ -318,6 +314,7 @@ jobs:
 
       # If a required secret or the Dockerfile is missing, report the missing items and stop instead of surfacing a third-party error such as a docker login failure
       - name: Deploy pre-check (Secrets and Dockerfile)
+        id: precheck
         working-directory: ${{ env.PROJECT_PATH }}
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -341,15 +338,21 @@ jobs:
             [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
           fi
           FAILED=false
+          ITEMS=""
           if [ -n "$MISSING" ]; then
             echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+            ITEMS="${MISSING# }"
+            ITEMS="${ITEMS// /, }"
             FAILED=true
           fi
           if [ ! -f "$DOCKERFILE" ]; then
             echo "::error title=$(m wf_preview.precheck_dockerfile_title)::$(m wf_preview.precheck_dockerfile_body path="${PROJECT_PATH}/${DOCKERFILE#./}")"
+            ITEMS="${ITEMS:+$ITEMS, }Dockerfile"
             FAILED=true
           fi
           if [ "$FAILED" = "true" ]; then
+            # The failure comment names what blocked the later steps instead of showing them as waiting
+            echo "missing=$ITEMS" >> "$GITHUB_OUTPUT"
             exit 1
           fi
           m wf_preview.precheck_ok
@@ -389,7 +392,7 @@ jobs:
           PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START: ${{ steps.progress.outputs.docker_start }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -578,7 +581,7 @@ jobs:
           PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START: ${{ steps.docker_progress.outputs.deploy_start }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -658,9 +661,11 @@ jobs:
         env:
           PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
           PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_PRECHECK_OUTCOME: ${{ steps.precheck.outcome }}
+          PAW_IN_STEPS_PRECHECK_OUTPUTS_MISSING: ${{ steps.precheck.outputs.missing }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -679,10 +684,13 @@ jobs:
               // Failed before the progress comment was created (initialization stage)
               dockerStatus = m('wf_preview.status_init_failed');
               deployStatus = '-';
+            } else if (process.env.PAW_IN_STEPS_PRECHECK_OUTCOME === 'failure') {
+              // The pre-check stopped the run before any build step: say why nothing ran
+              dockerStatus = deployStatus = m('wf_preview.status_precheck_blocked', { missing: process.env.PAW_IN_STEPS_PRECHECK_OUTPUTS_MISSING || '-' });
             } else if (!dockerDuration || dockerDuration === '') {
-              // Failed at the Docker build stage
+              // Failed at the Docker build stage; the deploy step never ran
               dockerStatus = m('wf_preview.status_failed');
-              deployStatus = m('wf_preview.status_waiting');
+              deployStatus = m('wf_preview.status_not_run');
             } else {
               // Failed at the deploy stage
               dockerStatus = m('wf_preview.status_done');
@@ -769,17 +777,15 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
 
       - name: Extract branch name from issue comment
         id: extract
         uses: actions/github-script@v9
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = context.issue.number;
@@ -824,7 +830,7 @@ jobs:
         uses: actions/github-script@v9
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = context.issue.number;
@@ -890,10 +896,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -926,7 +930,7 @@ jobs:
           PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const branchName = process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME;
@@ -1004,7 +1008,7 @@ jobs:
           PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = parseInt(process.env.PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER, 10) || 0;
@@ -1047,6 +1051,7 @@ jobs:
 
       # If a required secret or the Dockerfile is missing, report the missing items and stop instead of surfacing a third-party error such as a docker login failure
       - name: Deploy pre-check (Secrets and Dockerfile)
+        id: precheck
         if: steps.check_branch.outputs.exists == 'true'
         working-directory: ${{ env.PROJECT_PATH }}
         env:
@@ -1071,15 +1076,21 @@ jobs:
             [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
           fi
           FAILED=false
+          ITEMS=""
           if [ -n "$MISSING" ]; then
             echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+            ITEMS="${MISSING# }"
+            ITEMS="${ITEMS// /, }"
             FAILED=true
           fi
           if [ ! -f "$DOCKERFILE" ]; then
             echo "::error title=$(m wf_preview.precheck_dockerfile_title)::$(m wf_preview.precheck_dockerfile_body path="${PROJECT_PATH}/${DOCKERFILE#./}")"
+            ITEMS="${ITEMS:+$ITEMS, }Dockerfile"
             FAILED=true
           fi
           if [ "$FAILED" = "true" ]; then
+            # The failure comment names what blocked the later steps instead of showing them as waiting
+            echo "missing=$ITEMS" >> "$GITHUB_OUTPUT"
             exit 1
           fi
           m wf_preview.precheck_ok
@@ -1125,7 +1136,7 @@ jobs:
           PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START: ${{ steps.progress.outputs.docker_start }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -1320,7 +1331,7 @@ jobs:
           PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -1403,10 +1414,12 @@ jobs:
           PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_BRANCH_NAME: ${{ needs.get-branch-from-issue.outputs.branch_name }}
           PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
           PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_PRECHECK_OUTCOME: ${{ steps.precheck.outcome }}
+          PAW_IN_STEPS_PRECHECK_OUTPUTS_MISSING: ${{ steps.precheck.outputs.missing }}
           PAW_IN_NEEDS_GET_BRANCH_FROM_ISSUE_OUTPUTS_ISSUE_NUMBER: ${{ needs.get-branch-from-issue.outputs.issue_number }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -1423,9 +1436,13 @@ jobs:
             if (!commentId) {
               dockerStatus = m('wf_preview.status_init_failed');
               deployStatus = '-';
+            } else if (process.env.PAW_IN_STEPS_PRECHECK_OUTCOME === 'failure') {
+              // The pre-check stopped the run before any build step: say why nothing ran
+              dockerStatus = deployStatus = m('wf_preview.status_precheck_blocked', { missing: process.env.PAW_IN_STEPS_PRECHECK_OUTPUTS_MISSING || '-' });
             } else if (!dockerDuration || dockerDuration === '') {
+              // Failed at the Docker build stage; the deploy step never ran
               dockerStatus = m('wf_preview.status_failed');
-              deployStatus = m('wf_preview.status_waiting');
+              deployStatus = m('wf_preview.status_not_run');
             } else {
               dockerStatus = m('wf_preview.status_done');
               deployStatus = m('wf_preview.status_failed');
@@ -1508,10 +1525,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -1643,7 +1658,7 @@ jobs:
           PAW_IN_STEPS_PR_NUMBER_OUTPUTS_NUMBER: ${{ steps.pr_number.outputs.number }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const number = parseInt(process.env.PAW_IN_STEPS_PR_NUMBER_OUTPUTS_NUMBER, 10) || 0;
@@ -1700,10 +1715,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -1810,7 +1823,7 @@ jobs:
           PAW_IN_STEPS_CHECK_RUNNING_OUTCOME: ${{ steps.check_running.outcome }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const number = context.issue.number;
@@ -1900,10 +1913,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -1935,7 +1946,7 @@ jobs:
           PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
@@ -2027,7 +2038,7 @@ jobs:
           PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const issueNumber = context.issue.number;
@@ -2070,6 +2081,7 @@ jobs:
 
       # If a required secret or the Dockerfile is missing, report the missing items and stop instead of surfacing a third-party error such as a docker login failure
       - name: Deploy pre-check (Secrets and Dockerfile)
+        id: precheck
         if: steps.branch_info.outputs.branch_exists == 'true'
         working-directory: ${{ env.PROJECT_PATH }}
         env:
@@ -2094,15 +2106,21 @@ jobs:
             [ -n "$SERVER_PASSWORD" ] || MISSING="$MISSING SERVER_PASSWORD"
           fi
           FAILED=false
+          ITEMS=""
           if [ -n "$MISSING" ]; then
             echo "::error title=$(m wf_preview.precheck_secret_title)::$(m wf_preview.precheck_secret_body missing="$MISSING")"
+            ITEMS="${MISSING# }"
+            ITEMS="${ITEMS// /, }"
             FAILED=true
           fi
           if [ ! -f "$DOCKERFILE" ]; then
             echo "::error title=$(m wf_preview.precheck_dockerfile_title)::$(m wf_preview.precheck_dockerfile_body path="${PROJECT_PATH}/${DOCKERFILE#./}")"
+            ITEMS="${ITEMS:+$ITEMS, }Dockerfile"
             FAILED=true
           fi
           if [ "$FAILED" = "true" ]; then
+            # The failure comment names what blocked the later steps instead of showing them as waiting
+            echo "missing=$ITEMS" >> "$GITHUB_OUTPUT"
             exit 1
           fi
           m wf_preview.precheck_ok
@@ -2159,7 +2177,7 @@ jobs:
           PAW_IN_STEPS_PROGRESS_OUTPUTS_DOCKER_START: ${{ steps.progress.outputs.docker_start }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -2347,7 +2365,7 @@ jobs:
           PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DEPLOY_START: ${{ steps.docker_progress.outputs.deploy_start }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -2430,9 +2448,11 @@ jobs:
           PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
           PAW_IN_STEPS_DOCKER_PROGRESS_OUTPUTS_DOCKER_DURATION: ${{ steps.docker_progress.outputs.docker_duration }}
           PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID: ${{ steps.progress.outputs.comment_id }}
+          PAW_IN_STEPS_PRECHECK_OUTCOME: ${{ steps.precheck.outcome }}
+          PAW_IN_STEPS_PRECHECK_OUTPUTS_MISSING: ${{ steps.precheck.outputs.missing }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const commentId = parseInt(process.env.PAW_IN_STEPS_PROGRESS_OUTPUTS_COMMENT_ID, 10) || 0;
@@ -2447,9 +2467,13 @@ jobs:
             if (!commentId) {
               dockerStatus = m('wf_preview.status_init_failed');
               deployStatus = '-';
+            } else if (process.env.PAW_IN_STEPS_PRECHECK_OUTCOME === 'failure') {
+              // The pre-check stopped the run before any build step: say why nothing ran
+              dockerStatus = deployStatus = m('wf_preview.status_precheck_blocked', { missing: process.env.PAW_IN_STEPS_PRECHECK_OUTPUTS_MISSING || '-' });
             } else if (!dockerDuration || dockerDuration === '') {
+              // Failed at the Docker build stage; the deploy step never ran
               dockerStatus = m('wf_preview.status_failed');
-              deployStatus = m('wf_preview.status_waiting');
+              deployStatus = m('wf_preview.status_not_run');
             } else {
               dockerStatus = m('wf_preview.status_done');
               deployStatus = m('wf_preview.status_failed');
@@ -2532,10 +2556,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -2594,7 +2616,7 @@ jobs:
           PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH: ${{ needs.check-command.outputs.custom_branch }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
@@ -2678,7 +2700,7 @@ jobs:
           PAW_IN_STEPS_CONTAINER_INFO_OUTPUTS_CONTAINER_NAME: ${{ steps.container_info.outputs.container_name }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;
@@ -2739,10 +2761,8 @@ jobs:
           rm -rf .paw-msg
           # The workspace root has no version.yml; pass the language resolved above to every later messages.py call
           export PROJECT_AUTO_WIZARD_LANG="$LANG_CODE"
-          {
-            echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE"
-            echo "PAW_MSG=$(python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview.)"
-          } >> "$GITHUB_ENV"
+          python3 "$RUNNER_TEMP/paw/messages.py" dump wf_preview. > "$RUNNER_TEMP/paw-msg.json"
+          echo "PROJECT_AUTO_WIZARD_LANG=$LANG_CODE" >> "$GITHUB_ENV"
           # The deploy script runs on the remote server, where messages.py does not exist:
           # ship the messages it needs as a small shell function (m KEY name=value ...)
           python3 - >> "$GITHUB_ENV" <<'PY'
@@ -2863,7 +2883,7 @@ jobs:
           PAW_IN_STEPS_CONTAINER_INFO_OUTPUTS_CONTAINER_NAME: ${{ steps.container_info.outputs.container_name }}
         with:
           script: |
-            const M = JSON.parse(process.env.PAW_MSG);
+            const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
             const m = (k, p = {}) => M[k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
 
             const branchName = process.env.PAW_IN_NEEDS_CHECK_COMMAND_OUTPUTS_CUSTOM_BRANCH;

package/payload/workflows/react/PROJECT-REACT-CI.yaml

@@ -211,7 +211,8 @@ jobs:
         env:
           BUILD_STATUS: ${{ steps.build.outputs.status }}
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
-          COMMIT_SHA: ${{ github.sha }}
+          # On a PR, github.sha is the temporary merge commit; show the PR head commit instead
+          COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           [ -f "$GITHUB_WORKSPACE/.github/scripts/messages.py" ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
           m() { (cd "$GITHUB_WORKSPACE" && python3 .github/scripts/messages.py get "$@"); }
@@ -234,7 +235,7 @@ jobs:
             m cibuild.node_result_status status="$BUILD_STATUS"
           fi
           m cibuild.node_result_branch branch="$BRANCH_NAME"
-          m cibuild.node_result_commit sha="$COMMIT_SHA"
+          m cibuild.node_result_commit sha="$(echo "$COMMIT_SHA" | cut -c1-7)"
           m cibuild.node_result_time time="$(date -u '+%Y-%m-%d %H:%M:%S UTC')"
           echo ""
           echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

package/payload/workflows/spring/PROJECT-SPRING-CI.yml

@@ -68,7 +68,7 @@ jobs:
       id: load_messages
       run: |
         [ -f "$GITHUB_WORKSPACE/.github/scripts/messages.py" ] || { echo "::error::messages.py is missing; rerun \`npx project-auto-wizard --mode full --force\`"; exit 1; }
-        echo "PAW_MSG=$(python3 "$GITHUB_WORKSPACE/.github/scripts/messages.py" dump wf_spring_ci.)" >> "$GITHUB_ENV"
+        python3 "$GITHUB_WORKSPACE/.github/scripts/messages.py" dump wf_spring_ci. > "$RUNNER_TEMP/paw-msg.json"
 
     - name: Setup JDK
       uses: actions/setup-java@v5
@@ -216,7 +216,7 @@ jobs:
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
-          const M = JSON.parse(process.env.PAW_MSG);
+          const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
           const m = (k, p = {}) => M['wf_spring_ci.' + k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
           const { data: comments } = await github.rest.issues.listComments({
             owner: context.repo.owner,
@@ -278,7 +278,7 @@ jobs:
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
-          const M = JSON.parse(process.env.PAW_MSG);
+          const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
           const m = (k, p = {}) => M['wf_spring_ci.' + k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
           const { data: comments } = await github.rest.issues.listComments({
             owner: context.repo.owner,
@@ -362,7 +362,7 @@ jobs:
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |
-          const M = JSON.parse(process.env.PAW_MSG);
+          const M = JSON.parse(require('fs').readFileSync(`${process.env.RUNNER_TEMP}/paw-msg.json`, 'utf8'));
           const m = (k, p = {}) => M['wf_spring_ci.' + k].replace(/\{(\w+)\}/g, (s, n) => (n in p ? p[n] : s));
           const conclusion = process.env.PAW_IN_STEPS_REPORT_OUTPUTS_OVERALL_OK === 'true' ? 'success' : 'failure';
           const summary = m(conclusion === 'success' ? 'check_summary_success' : 'check_summary_failure');
@@ -371,7 +371,8 @@ jobs:
             owner: context.repo.owner,
             repo: context.repo.repo,
             name: 'Build Verification',
-            head_sha: context.sha,
+            // On a PR, context.sha is the temporary merge commit; attach the check run to the PR head commit
+            head_sha: context.payload.pull_request?.head?.sha ?? context.sha,
             status: 'completed',
             conclusion: conclusion,
             output: {