234df15a6d
chore: refresh dependencies after seven-day cooldown ( #128414 )
...
* build(deps): refresh dependencies after cooldown
Apply dependency, toolchain, action, image, and exact tool updates released by the inclusive 2026-08-16 seven-day cutoff. Adapt owner boundaries for the resulting CUA, logging, Teams, Markdown, native, and test-harness contract changes while retaining versions blocked by upstream compatibility constraints.
* fix(ui): align markdown renderer env typing
* fix(deps): align postcss and mistral peer contracts
* fix(deps): repair refreshed dependency contracts
* fix(deps): retain tslog startup budget
* fix(ci): verify Android tools with SHA-256
* fix(ci): fence Android SDK cache version
2026-08-24 03:01:54 -07:00
225aa5a178
fix(ci): isolate Actions cache writes ( #127107 )
2026-08-21 02:45:06 -07:00
782d52c8b8
perf(ci): cache the Node toolchain instead of refetching it every job
...
Blacksmith's image tracks an older runner-images snapshot. Measured on a leased
box 2026-08-16, its toolcache holds Node 20.20.0, 22.22.0 and 24.13.0 while this
repo's engines floor is >=22.22.3 and >=24.15.0 -- short by three and two
patches. Every candidate is rejected, so all 306 of 306 sampled jobs fell
through to a nodejs.org download. GitHub-hosted runners carry 24.19.0 and
resolve from the toolcache in about a second, which is why only Blacksmith pays.
Normally that download is 2.6s (p99 3.3s), but ~46 jobs fetch the same 50 MB
simultaneously and the mirror throttles: three of 53 sampled runs had setup-node
medians of 44-93s with maxes to 139s, and because every job pays at once it
lands whole on the wall -- those runs went ~210s to 325s.
Keep the payload in the Actions cache, which Blacksmith serves from its
colocated backend. Measured on Blacksmith: cold 1605ms, warm 77ms.
Restores are prefix-keyed and the save carries the resolved patch. An exact key
would be worse than nothing: cache entries are immutable and an exact hit
suppresses the post-job save, so a floating `24.x` key would pin the first Node
it ever saw and, once the floor advanced past it, every job would restore the
rejected payload and re-download forever. Keying the save on the installed
version lets a newer resolve publish a new entry that later prefix restores
pick up.
A rejected payload is pruned before the replacement installs, because the entry
is saved wholesale and a leftover would ride along in every future save.
Windows keeps its existing path. Proven on Blacksmith across cold, warm, stale
and truncated-binary cases; both guards are mutation-checked.
This stays useful even if Blacksmith refreshes their image: the floor moves
independently of the snapshot, so the gap recurs. The image refresh is still
the better fix and is worth asking them for.
2026-08-16 20:18:41 -07:00
e60ebbc63b
fix(ci): bound fallback Node downloads ( #108166 )
2026-07-15 22:40:39 -07:00
f33ab243cf
fix(sqlite): reject runtimes vulnerable to WAL corruption ( #106065 )
...
* fix(sqlite): require WAL-reset-safe Node runtime
* docs(sqlite): document safe Node runtime floor
* fix(sqlite): defer runtime library validation until use
* fix(ci): align startup memory with Node 24.15
2026-07-13 13:59:00 +08:00
49941fab6d
fix(ci): keep hydrate-github pnpm shims writable ( #103971 )
2026-07-10 23:36:10 +01:00
abb6f04e0c
ci(release): harden release controls
...
One-time maintainer-authorized bootstrap merge for the release-gate verifier policy. Exact hosted CI and all supporting workflow gates passed on 66133de419
2026-06-18 03:11:20 +08:00
ea682182d0
fix: isolate npm plugin installs per package ( #87647 )
...
* fix: isolate npm plugin installs per package
* test: assert isolated npm plugin projects in upgrade survivor
* test: assert plugin lifecycle npm project roots
* test: resolve npm project deps in live assertions
* fix: resolve codex bins from isolated npm projects
* docs: document isolated npm plugin projects
* ci: configure testbox workflow for crabbox
* fix: stabilize npm project fingerprint
* fix: keep fetch runtime import side-effect free
* test: keep dynamic live model unit hermetic
* ci: handle empty node toolcache roots
* test: make nounset toolcache probe deterministic
2026-05-28 21:16:07 +01:00
3dee915b3b
ci: warm pnpm store before node fanout ( #87518 )
...
* ci: warm pnpm store before node fanout
* test: update pnpm cache acceptance key
* ci: clarify pnpm cache save controls
2026-05-28 13:11:20 -07:00
1507a9701b
refactor: centralize inbound supplemental context
...
* refactor: centralize inbound supplemental context
* refactor: trim supplemental finalizer typing
* docs: clarify supplemental context projection
* refactor: move inbound finalization into core
* refactor: simplify channel inbound facts
* refactor: fold supplemental media into inbound finalizer
* refactor: migrate channel inbound callers to builder
* docs: mark inbound finalizer compat types deprecated
* refactor: wire runtime turn context builder
* refactor: replace channel turn runtime API
* fix: respect discord quote visibility
* fix: avoid deprecated line dispatch helper
* refactor: deprecate channel message SDK seams
* docs: trim channel outbound SDK page
* test: migrate irc inbound assertion
* refactor: deprecate outbound SDK facades
* refactor: deprecate channel helper SDK facades
* refactor: deprecate channel streaming SDK facade
* refactor: move direct dm helpers into inbound SDK
* chore: mark legacy test-utils SDK alias deprecated
* refactor: remove unused allow-from read helper
* refactor: route remaining channel dispatch through core
* refactor: enforce modern extension SDK imports
* test: give slow image root tests more time
* ci: support node fallback on windows
* fix: add transcripts tool display metadata
* refactor: trim legacy channel test seams
* fix: preserve channel compat after rebase
* fix: keep deprecated channel inbound aliases
* fix: preserve discord thread context visibility
* fix: clean final rebase conflicts
* fix: preserve channel message dispatch aliases
* fix: sync channel refactor after rebase
* fix: sync channel refactor after latest main
* fix: dedupe memory-core subagent mock
* test: align clickclack inbound dispatch assertions
* fix: sync plugin sdk api hash after rebase
* fix: sync channel refactor after latest main
* fix: sync plugin sdk api hash after rebase
* fix: sync plugin sdk api hash after latest main
* test: remove stale inbound context awaits
2026-05-27 09:26:06 +01:00
d122839eb7
ci: retry corepack pnpm activation
2026-05-27 00:49:26 +01:00
bb48fcf36a
ci: support windows node download fallback
2026-05-26 22:29:46 +01:00
1d972af69d
ci: enforce Node 22 floor in setup helper
2026-05-26 22:26:08 +01:00
03ae999a1a
ci: normalize Windows toolcache paths
2026-05-26 21:55:57 +01:00
c84f61cd2e
ci: normalize Windows toolcache Node paths
2026-05-26 17:41:30 +01:00
e37ac22fdd
ci: resolve major node fallback versions
2026-05-26 13:47:19 +01:00
50c7d780dc
ci: add node download fallback
2026-05-26 13:47:19 +01:00
4c6aeb9bb2
ci: use local node toolcache setup
2026-05-26 13:47:19 +01:00
84e4bff73b
ci: restore pnpm store cache with corepack
2026-05-26 13:39:00 +01:00
13f72e4102
ci: avoid pnpm setup action download
2026-05-26 13:39:00 +01:00
bc3d6bafae
ci: disable pnpm action cache on Windows
2026-05-26 04:31:33 +01:00
93015982d3
fix(release): stabilize beta validation after main rebase
2026-05-26 03:06:26 +01:00
9f7485e182
test: port release validation stabilizers
2026-05-25 21:50:49 +01:00
b6940b5dc4
ci(release): pass node pin to pnpm setup
2026-05-22 19:27:56 +01:00
a26aba67a8
ci(release): harden node setup before pnpm cache
2026-05-22 19:27:56 +01:00
a0702e195d
build(pnpm): use packageManager as pnpm source
...
Recreated from #85108 because the original branch could not be updated by maintainers.
Preserves current-main pnpm install hardening while switching workflow pnpm setup to packageManager, and adds exact version-scoped release-age exclusions for already-locked packages that pnpm 11.2.2 audits during install.
Co-authored-by: Altay <altay@hey.com >
2026-05-22 19:17:43 +01:00
5c39e0019d
ci: harden pnpm setup node selection
2026-05-20 05:34:20 +01:00
79197b3196
ci(release): stabilize beta validation gates
2026-05-20 00:53:32 +01:00
8b95270cc9
ci(pnpm): use pnpm 11 in workflows
2026-05-11 00:48:14 +01:00
c53b8196c8
ci(release): disable corepack download prompts
2026-05-09 23:25:27 +01:00
8084bbf8ed
ci: save pnpm store cache explicitly
2026-04-23 11:09:37 +01:00
fbddef34bd
perf(ci): trim provider catalog test setup
2026-04-22 05:57:22 +01:00
24644e3c27
ci: remove sticky disk cache plumbing
2026-04-20 16:03:55 +01:00
4dcadecab0
ci: remove Blacksmith pnpm sticky disk action
2026-04-20 15:56:56 +01:00
53fd262173
ci: align pnpm pins and vitest config
2026-04-04 05:44:29 +01:00
6a812b621d
ci: modernize GitHub Actions workflow versions
2026-03-13 16:57:23 +00:00
797b6fe614
ci: tighten cache docs and node22 gate
2026-03-12 20:07:44 +05:30
e1d054547e
ci: restore PR pnpm cache fallback
2026-03-12 20:07:44 +05:30
29b36f8e4a
ci: harden pnpm sticky cache on PRs
2026-03-12 20:07:44 +05:30
deada7edd3
build: default to Node 24 and keep Node 22 compat
2026-03-12 20:07:44 +05:30
c6634b4083
CI: add toggle to skip pnpm actions cache restore
2026-03-02 19:54:52 -08:00
578a7a82be
CI: add exact-key mode for pnpm cache restore
2026-03-02 19:30:29 -08:00
ffd3ad032a
CI: add sticky-disk mode to pnpm cache action
2026-03-02 18:48:18 -08:00
9130fd2b06
ci: harden workflow action input handling
2026-02-19 15:27:48 +01:00
cef9bfce22
CI: scope heavy jobs, build once, and remove duplicate validation work ( #11570 )
...
* CI: scope jobs and reuse build artifacts
* CI: fix scope fallback and remove unused artifact job
* CI: remove setup-node pnpm cache inputs
* CI: add pnpm store cache and dist artifact smoke
* CI: extract pnpm cache action and consume dist artifact
2026-02-08 02:08:56 -08:00
Peter Steinberger