mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.3.2-beta.336
341 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 jkomyno
|
fdb366d090 |
Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout
# Conflicts: # install.sh # test/install-sh-release-resolution.test.sh # ts/packages/cli/test/__utils__/services/test-layer.ts # ts/packages/cli/test/src/commands/install.cmd.test.ts |
||
|
jkomyno
|
d17844c848 |
ci(cli): fail the installation guard when a freshly built release skips the PATH write
The shell-config check accepted the legacy install.sh block on every leg, justified by a comment claiming no leg installs a binary built from this checkout. Build CLI Binaries calls this workflow with the tag it just released, so that leg does exercise the new binary — and a completely broken `composio install` that fell through to install.sh's writer still reported success. Callers now declare built_from_this_checkout; those legs must show the CLI-managed PATH line. promote-stable keeps the permissive check, since it rebuilds the promoted beta's own commit, which can predate the writer. |
||
|
Alberto Schiabel
|
331a1373de | Merge branch 'next' into feat/cli-install-shell-flag | ||
|
jkomyno
|
72c9fb1dc8 | fix(docs): remove legacy fish path on uninstall | ||
|
jkomyno
|
4a179f8fdc | ci(cli): avoid unavailable installer routes | ||
|
jkomyno
|
32b84ab192 | Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout | ||
|
jkomyno
|
aa28325394 | test(cli): add a fish leg to the local install e2e | ||
|
jkomyno
|
367db3b069 | ci(cli): pin the installer preview comment to the tested head commit | ||
|
jkomyno
|
5d007da225 |
fix(ci): accept the legacy PATH block when verifying installed shell config
The shell-config assertions only passed for binaries that write the new CLI-managed PATH line, but every leg of this workflow installs a published release binary: workflow_dispatch re-verification of existing releases, workflow_call with the default 'latest', and promote-stable rebuilds of an older beta all install pre-change binaries that write the legacy COMPOSIO_INSTALL_DIR block (as does install.sh's own fallback). Accept either working PATH layout, fail only when neither is present, and keep rejecting a mixed state where the new PATH line coexists with a persisted COMPOSIO_INSTALL_DIR. |
||
|
Alberto Schiabel
|
03291bfaa4 |
fix(ci): use locked Node version for Cloudflare E2E (#4035)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/4010 and credits @MGPOCKY for identifying the stale Cloudflare E2E Node override - lets Cloudflare E2E resolve the exact Node.js version from mise.lock through the shared setup action - retains the release job's explicit Node.js 24.17.0 publishing pin and corrects its outdated explanation - verifies the release workflow guard, workflow YAML parsing, formatting, and whitespace checks Co-authored-by: MGPOCKY <kkm1447@naver.com> |
||
|
jkomyno
|
0c768c3203 |
refactor(cli): select installer shell via COMPOSIO_INSTALL_SHELL
Replace the base installer's --shell flag with a COMPOSIO_INSTALL_SHELL environment variable, matching the COMPOSIO_INSTALL_VERSION precedent and reading more naturally in the curl-pipe form: curl -fsSL https://composio.dev/install | COMPOSIO_INSTALL_SHELL=zsh sh The variable is validated before any network call. Shell variants set it explicitly when invoking the base installer, so the route stays authoritative over any inherited value. The composio install --shell CLI flag and the delegation/fallback behavior are unchanged. |
||
|
jkomyno
|
fac4bdca5d |
feat(cli): add --shell flag to the base installer
Teach install.sh a --shell <zsh|bash|fish> flag that performs the same shell setup the /install/<shell> variants do: delegate to 'composio install --shell' when the installed CLI supports it, fall back to writing the # Composio CLI PATH block inline otherwise. The shell variants become thin wrappers that fetch the base installer and append '--shell <name>' to the forwarded arguments, so the delegation and fallback logic now lives in exactly one script. This also removes the double-configuration hazard of a variant blindly forwarding a user-supplied --shell. Shell setup no longer depends on the composio.dev/install/<shell> redirect rules existing: post-install guidance, docs, and release notes now print 'curl -fsSL https://composio.dev/install | sh -s -- --shell <shell>', which works through the single existing redirect. The variant scripts and their raw-URL preview commands keep working for when the routes land. Coverage: direct --shell delegation, fallback on unsupported or failing CLI, missing and invalid values failing before any network call, and a Docker e2e leg for the idempotent --shell bash flow. |
||
|
jkomyno
|
2eacb56bd2 | ci(cli): post installer preview commands on PRs | ||
|
jkomyno
|
7df5c98bc3 | ci(cli): merge duplicate install verification steps | ||
|
jkomyno
|
1c4386fffd | ci(cli): build packages before upgrade test | ||
|
jkomyno
|
bd43e8f79e | ci(cli): validate installer in clean containers | ||
|
jkomyno
|
4e30d1ffe5 | docs(cli): document install-only shell workflow | ||
|
jkomyno
|
d999857170 | feat(cli): add install-only POSIX installer | ||
|
jkomyno
|
40f6b8b54e | feat(cli): add explicit shell setup to install | ||
|
Kshitij Jhunjhunwala
|
f9ddd94e10 | Merge next into analytics identity | ||
|
Alberto Schiabel
|
7bf09cdbb8 |
fix(cli): make GitHub releases the version authority (#3993)
This PR: - fixes https://github.com/ComposioHQ/composio/issues/3932 - replaces the private CLI package semver with the non-release `0.0.0-development` sentinel - injects the exact GitHub release tag version into every standalone binary and verifies it during the build - makes every push to `next` a beta, with explicit semver selection for intentional minor or major betas and stable releases only through beta promotion - resolves skill installation, setup repair, companion repair, and upgrades from packaged `release-tag.txt` metadata - adds regression coverage for release selection, compiled version identity, and packaged-tag asset lookup; all 1,009 CLI tests and the monorepo typecheck pass - updates the direct CLI changelog and release guidance; no Changeset is added because CLI packages are excluded from Changesets |
||
|
Alberto Schiabel
|
3335bb3013 |
fix(docs): restore API reference pages dropped by undeclared tags (#3973)
This PR: - fixes a regression introduced by https://github.com/ComposioHQ/composio/pull/3956: fumadocs-openapi 11's `groupBy: 'tag'` silently skips operations whose tag is not declared in the document's top-level `tags` array, which 404'd all 16 Projects and Organization Management operation pages (e.g. `/reference/api-reference/projects/postProjectUsageSummary`) on both v3.1 and v3, and dropped them from the sitemap and search index - adds `declareOperationTags()` (`docs/lib/openapi-tags.ts`), applied at spec load time in `lib/openapi.ts` (covers build-time-fetched specs) and at sync time in `scripts/fetch-openapi.mjs`, which now also warns when the upstream payload omits tags; the checked-in specs are normalized accordingly (purely additive) - adds CI guards in `tests/static/api-reference-routes.test.ts`: spec invariants (every visible operation has a tag and `operationId`), bidirectional spec-vs-generated-routes set equality through the production loader path, a negative test pinning fumadocs' silent-drop behavior (fails when upstream fixes it, signaling the workaround can be retired), and validation that every `ApiEndpointsTable` quick-link href resolves to a generated page - extends `Docs - Check Links` with a nightly (02:30 UTC) + manual external-URL sweep via a new `lint:links:external` script; the validator only fails on evidence a link is dead (404/410 or repeated network errors, with UA/timeout/GET-fallback/retry and per-URL caching) and scheduled failures file a deduplicated tracking issue; PR runs keep the fast internal-only check - fixes six dead external links the first sweep found (moved Claude Agent SDK docs, stale dashboard settings URL ×2, a `master`-branch path now pinned to tag `0.5.0+post.1`, and two removed `ComposioHQ` example repos whose mentions were dropped — their code is embedded in the pages via `RepoBrowser`) ## Context fumadocs-openapi 10 generated a page for any tag string found on an operation; v11 requires the tag to be declared top-level and skips silently otherwise (`preset-auto.js`: `builder.fromTagName(tag)` → `continue`, no warning). The backend spec generator omits `Projects`, `Organization Management`, and `Invite Codes` from `tags`, so their operation pages vanished while the checked-in MDX tag landing pages kept rendering with dead quick links. With the normalizer, the generated URL set is byte-identical to the pre-#3956 set (234 routes, verified via `getReferenceSource().getPages()` diff); no revert needed. Existing checks missed this because `lint:links` only extracts markdown links and `Card` hrefs (the dead links live in `ApiEndpointsTable`'s array prop) and validates against the same loader that shrank, and the integration suite samples fixed routes under tags that survived. The new completeness guard derives expectations from the specs themselves, so routine data syncs don't churn it. |
||
|
Kshitij Jhunjhunwala
|
9aa3e4b1c6 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
jkomyno
|
6725d1c078 | Merge branch 'next' into kj/decommission-npm-brew | ||
|
jkomyno
|
fa0b8f7c1c | fix(cli): align generated Windows install guidance | ||
|
jkomyno
|
6dc77c987d | fix(cli): preserve release bundle in manual installs | ||
|
Alberto Schiabel
|
64acec65b6 |
ci(ts): fix next push trigger and cache reuse (#3971)
This PR: - fixes the `ts.build.yml` push trigger, which still pointed at `master`: the repo's default branch is `next`, so the workflow has not run on push since 2025-10-24 and never populated the turbo/pnpm caches that PR runs restore from (GitHub cache isolation lets PRs read base-branch caches, but not other PRs') - fixes the same stale `master` push trigger in `py.check.yaml` (all other workflows already list `next`) - adds a `cache-save` input (default `'true'`, preserving current behavior for every other consumer) to the `setup-node-pnpm-bun` composite action, swapping `actions/cache` for `actions/cache/restore` (same repo, same v6.1.0 SHA pin) when disabled - wires `cache-save` in `ts.build.yml` so only push runs on `next` persist caches: PR-scoped saves are invisible to other branches, so they only cost post-job time and evict default-branch entries from the 10 GB repo cache quota ## Context Measured on run [30364148082](https://github.com/ComposioHQ/composio/actions/runs/30364148082) (PR run, ~90s wall time): | Step | Time | |---|---| | Checkout | 5s | | Setup Node.js, pnpm, Bun | 34s (mise 1s, setup-node 5s, setup-bun 2s, pnpm 2s, **pnpm store restore 18s** for 658 MB, turbo restore 1s) | | `pnpm install --frozen-lockfile` | 14s | | `pnpm lint` | 1s | | `pnpm run build:packages` | 24s, **0/19 turbo cache hits** | | Post-job cache saves | ~11s (turbo save + a 658 MB pnpm store save that failed with "Unable to reserve cache", racing the parallel ts.* jobs on the same PR) | The build restored a turbo cache only via the fallback restore-key `Linux-turbo-build-` from an unrelated branch, hence 0 hits. Once push runs fire on `next` again, every merge saves a fresh `Linux-turbo-build-<sha>` cache that PR runs match through the restore-key prefix, so unchanged packages become turbo hits (up to ~20s off the build step) and the ~11s post-job save disappears from PR runs. The per-commit key suffix is kept intentionally: the turbo cache accumulates, so each default-branch save needs a fresh key and readers match via the prefix (documented inline in the action). |
||
|
Alberto Schiabel
|
a78a3fcb97 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
Alberto Schiabel
|
f233e46937 |
chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966)
This PR: - replaces ESLint with oxlint across the pnpm workspace and the Bun-based docs site, porting the rules to `.oxlintrc.json` / `docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors kept via `oxlint-plugin-eslint`) - migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate pipeline). The CLI's `typescript` dependency rebinds only the compiler-API import — its typecheck still runs the root TS7 `tsc`, since the alias package only ships a `tsc6` bin (documented in `ts/packages/cli/AGENTS.md`) - removes the `paths` mappings that pointed `@composio/core` (and, in `experimental`, `@composio/json-schema-to-zod` plus core-internal `#`-imports) at sibling `src` directories: under TS7, tsdown's tsgo-based dts step emitted stray `.d.ts` files next to those out-of-root sources on every dependent package build. Workspace deps now resolve through their built dist types, which turbo's `dependsOn: ^build` already guarantees exist — and which the deep-path exports (`@composio/core/*`) always used anyway - renames the cli boundary tooling `eslint-boundaries*` → `lint-boundaries*` and hardens the scanner to reject `oxlint-disable` spellings so the disable manifest cannot be bypassed - rewrites inline `eslint-disable` comments to oxlint rule names (comment-only; no runtime changes), and adds **one new** declared boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled for `node:crypto` (MD5 for the presigned-upload checksum is not in Web Crypto), because oxlint also catches dynamic `await import()` where ESLint did not. The manifest grows 46 → 47 deliberately - updates CI path filters, `turbo.jsonc` lint inputs, and the docs typescript-check workflow (renamed to "Docs - Lint and TypeScript Validation" since it now lints too); drops `eslint`, `typescript-eslint`, `eslint-config-next`, and `globals` from the dependency graphs - ships no changeset: I built `@composio/core` and `@composio/anthropic` on this branch and on the pre-migration base and diffed the emitted `dist/**/*.d.mts`. The provider output is byte-identical. Core's output is **semantically identical but not byte-identical**: TS7 changes quote style (`"x"` → `'x'`), object-property and union-member ordering in inferred types, and picks equivalent shorter re-export alias paths for five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` → `OpenAI.Beta.Threads.Run` — verified both names alias the same type in the shipped typings). Chunk-name hashes shift as a consequence. No type gains, losses, or shape changes; `attw` and `publint` pass on the TS7 build ## Context First of a three-PR split of #3958. The type-safety refactors are stacked on this branch and merge after it: - docs: https://github.com/ComposioHQ/composio/pull/3967 - `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968 |
||
|
Kshitij Jhunjhunwala
|
a205b68b0f |
chore(cli): decommission npm and Homebrew install channels (PRDE-1155, PRDE-1156)
curl install.sh is now the only CLI install channel. - INSTALL.md: drop npm/pnpm/yarn section; Windows guidance is WSL - install.sh: Windows error no longer advises the dead npm package - build-cli-binaries.yml: strip npm section from generated release INSTALL.md - cli.install-health-check.yml: drop stale npm dist-tag/Homebrew comment - cli.test-installation.yml: delete no-op npm-fallback job and its toolchain-versions feeder job; prune summary references - delete cli.bump-homebrew-tap.yml + bump-homebrew-formula.py (automation never fired: GITHUB_TOKEN-published releases suppress release-triggered workflows and HOMEBREW_TAP_TOKEN is dead) - ts/packages/cli/package.json: drop unused publishConfig (package is private) - cli-release skill + CLI AGENTS.md: remove Homebrew steps from release docs - toolchain-versions.json: drop now-unused node_install_compat matrix Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
6dfe1ea439 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
Kshitij Jhunjhunwala
|
15007c26ad |
chore(cli): rename COMPOSIO_POSTHOG_KEY to COMPOSIO_POSTHOG_PROJECT_API_KEY
PostHog's own term for the public write-only phc_* credential is the project API key; the old name read like a secret. Covers the env var, the build-time bake define, the baked constant, and the workflow env. The GitHub repo variable itself must be renamed manually. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Anshu Garg
|
57557fc54b |
docs(webhooks): render the webhook payload reference (PLEN-2793) (#3910)
## Summary Implements the docs half of **PLEN-2793** — renders a typed public reference for the payloads Composio delivers to customer webhook URLs, under **API Reference → Webhook Events**. Pairs with platform PR ComposioHQ/platform#11389, which generates the spec. ## What's here - **`docs/public/openapi-webhooks.json`** — the generated OpenAPI **3.1** spec (top-level `webhooks`: `composio.trigger.message`, `composio.connected_account.expired`, `composio.trigger.disabled`), produced from the webhook payload Zod schemas in Apollo (SSOT). Finishes the earlier untracked WIP: adds the missing `trigger.disabled` event and reuses shared schemas as `$ref` (`WebhookEventEnvelope`, `ConnectedAccountDetailed`). - **`docs/lib/openapi.ts`** — adds the spec as a **second input** to the v3.1 reference source. Fumadocs (`fumadocs-openapi`) renders the `webhooks` block natively; operations group under the "Webhook Events" tag at `api-reference/webhook-events/*`. - **`webhook-events/index.mdx`** — landing page listing the three events, cross-linked to the Webhook Subscriptions API and signature verification. ## Why a separate 3.1 spec `webhooks` is a 3.1-only top-level field; the main `openapi.json` is 3.0. A separate file keeps the main spec (and its sync pipeline) untouched and avoids the docs' union-normalisation pass. See the platform PR for the full rationale. ## Verified locally - [x] `bun scripts/validate-links.ts` — **0 errors** (the generated `handle_composio_*` webhook pages resolve; no collision with the hand-authored `index.mdx`) - [x] `bun test tests/static/` — 33 pass / 0 fail - [x] `bun run types:check` — clean ## Notes - Setup, subscription, and signature-verification docs already exist (`setting-up-triggers/*`) and are cross-linked, not rewritten. - Follow-up (optional): auto-sync the webhooks spec from Apollo on prod deploy (currently committed by hand), mirroring the main-spec `docs-update-data` pipeline. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
503b50ab02 |
chore(deps): refresh SDK, Python, and CI dependencies (#3955)
This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump **except** the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`. |
||
|
Alberto Schiabel
|
ceb98789c8 | Merge branch 'next' into claude/cli-adoption-funnel-d95660 | ||
|
daksh
|
12db4def0d |
ci(docs): run the failure alert outside the docs working directory
The job sets `defaults.run.working-directory: ./docs`, which the alerting step
inherited. That path only exists once checkout has run, so any failure before it
— the app-token step, for instance — would leave the runner unable to start the
step's shell. Combined with continue-on-error, the alert would be dropped
silently for exactly the earliest and least visible failures.
Pin the step to ${{ github.workspace }}, which the runner creates before any
step executes.
Reported by Cursor Bugbot on #3947.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
|
daksh
|
0454f423a7 |
ci(docs): give the docs data sync its own production API key
`secrets.COMPOSIO_API_KEY` is shared with ts.test-e2e, py.test, py.check and ts.examples-nightly. Those pin COMPOSIO_BASE_URL to staging, and the nightly examples run is currently green against staging with this key — so the secret is a live staging credential, not an expired one. #3770 moved this job to production and added a guard rejecting any non-production base URL, but no production credential was provisioned. The staging key has returned 401 against backend.composio.dev on every run since, silently freezing the committed toolkit catalog. Repointing the shared secret at production would fix docs and break the staging suites, and py.check sets no base URL at all — a production key there would aim type-inference tests at production. So take a separate secret instead. Requires COMPOSIO_DOCS_API_KEY to be set with production read access. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
daksh
|
7af576a976 |
ci(docs): file a tracking issue when the docs data sync fails
The scheduled `Docs - Update Data` workflow has failed on every run since 2026-07-13 and nobody noticed for 11 days. The failure mode is silent by construction: when the sync breaks, `docs/public/data/toolkits.json` simply stops being refreshed, the docs site keeps building from the last good commit, and nothing 500s. Toolkits added to production after the last green run just have no page and 404 — which is how `saperly` ended up missing from docs.composio.dev/toolkits while being live in the API. Add a `failure()` step that opens one tracking issue, deduped by label so a 5-hourly cron does not file 60 duplicates. The body names the most likely cause up front: `COMPOSIO_API_KEY` needs production read access against backend.composio.dev, and a staging-only key returns 401. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
ecbd1a33ce |
fix(cli): address PR review — identity coverage, logout, alias retry; trim comments
Review feedback (KJ): - Strip the added explanatory comments across dispatch.ts, constants.ts, _shared.ts, build-binary.ts and the workflow; keep only pre-existing ones. - Shorten the CHANGELOG entry to a single line. - Revert the .gitignore addition. Bugbot findings: - Already-authenticated installs never stitched (events stayed anonymous after upgrade, since only `login` persisted the id). Backfill now runs from any command that already resolves a session: whoami, init, connected-accounts link, plus the existing login paths. - `composio login --agent` skipped the stitch; the agent branch now resolves session info best-effort and links. - `composio logout` left `apollo_user_id` behind, so later events kept attributing to the previous person. Added clearApolloIdentityForAnalytics. - A failed alias was never retried, because any persisted `apollo_user_id` counted as "already aliased" — including when nothing was ever enqueued (no project key / telemetry off). Track `aliased_apollo_user_id` separately and only record it once the enqueue actually happened. Tests: alias retry after a skipped enqueue, and logout reverting to install_id. Full suite 956 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
96516e3dd5 |
chore(cli): trim telemetry comments; bake PostHog key at build (not source)
Hygiene pass on the direct-to-PostHog telemetry: condense verbose block comments in dispatch.ts/constants.ts. Source the public write-only PostHog project key from a build-time COMPOSIO_POSTHOG_KEY env var, baked into the binary via `bun build --define` (scripts/_shared.ts posthogBakeArgs), instead of a committed source literal. This mirrors the dashboard's env-driven NEXT_PUBLIC_POSTHOG_TOKEN pattern and, for this OSS repo, keeps the key out of public git history and out of fork/local builds (they compile a no-op binary). `--define` is used rather than a second `--env` because Bun honors only one `--env` and it would clobber the existing DEBUG_OVERRIDE_* inline. CI passes the key as an Actions variable on the cross-compile step; empty -> telemetry no-ops. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
9498679c26 |
fix(release): guard and document CLI releases (#3895)
This PR: - removes the stale `@composio/cli` changeset that wedges `changesets/action` and preserves its release note in the CLI changelog - adds `validate:changesets` before the TypeScript release action and covers ignored-package changesets in the release regression suite - makes the guard read changeset files directly so it also works in shallow and detached CI checkouts - refreshes `mise.lock` after the pinned Python standalone artifacts moved to the 20260718 build - adds the repo-local `cli-release` skill with beta, stable-promotion, verification, and failure-recovery procedures - replaces the contradictory "stable via changeset" contributor guidance with the tested-beta promotion path - extends skill taxonomy, routing probes, and PR path filters so the guard cannot silently drift ## Regression coverage The validator test creates a changeset fixture outside a Git repository, verifies that an ignored CLI package is rejected, then verifies that a normal package changeset passes. This reproduces the shallow-checkout failure without relying on a local `next` ref. ## Verification - `pnpm validate:agent-skills` - `pnpm validate:skill-routing` - `pnpm validate:changesets` - `pnpm test:release-workflow` - `pnpm lint` - `pnpm install --frozen-lockfile` - all 24 TypeScript package test tasks - skill-creator `quick_validate.py` - Prettier check - `git diff --check` - manual beta release [`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294): 33/33 release and installation jobs passed |
||
|
composio-zen[bot]
|
4b790dc0ce |
fix(docs): correct toolkit versions and enforce production source (#3837)
## What this fixes This is a follow-up to #3770, not a second root-cause fix. #3770 moved the docs data workflow from staging to production, centralized the production API URL, removed staging hosts from the committed data, and added the hostname guard. The committed toolkit catalog still retained staging-derived `version` values, however, because that PR intentionally did not regenerate the full catalog. After #3770 merged, the scheduled production regeneration began failing with `401 Unauthorized`: the repository's existing `COMPOSIO_API_KEY` secret is staging-scoped. The customer-visible result was that nearly every toolkit page showed the internal staging version `20260703_00`; Gmail's production version was `20260702_01`. ## Changes - Correct every `version` in `docs/public/data/toolkits.json` from the production toolkit changelog. Toolkits absent from that changelog receive `null`, matching the full generator's semantics. No other JSON field changes. - Move production changelog fetching and version application into shared `toolkit-versions.ts` logic used by the full catalog generator. - Add `bun run generate:toolkit-versions` as the narrow, reproducible generator for version-only repairs. - Reject any non-production `COMPOSIO_API_BASE` in the toolkit and meta-tool generators before a request is made. - Keep the version-distribution check as a smoke signal for the known whole-catalog staging-bump pattern, while testing the production source boundary separately. The distribution heuristic is no longer described as proof of provenance. - Fail before writing when the production changelog response is malformed or contains no versions. ## CI policy compatibility - Replace the enterprise-blocked mise action with allowlisted tool setup actions while continuing to resolve exact versions from mise.lock. Install the existing pinned mise CLI release through a checksum-verified repository script for lock freshness and preinstall validation. - Run the existing GitHub Advanced Security alert check locally and notify Slack through the already-allowlisted Slack action, avoiding the central workflow dependency rejected by the enterprise action policy. ## Verification - `bun test tests/static/` — 30 passed. - Targeted ESLint for every changed script/test — passed. - `bun run types:check` — passed. - `bun run build` — passed. - Explicit staging override of `generate-toolkits.ts` — rejected before network access. - Verified the JSON data change remains version-only; toolkit ordering, tools, triggers, descriptions, and counts are unchanged. ## Remaining deployment action An administrator still needs to replace `COMPOSIO_API_KEY` with a production-scoped key. The scheduled `docs-update-data` workflow is correctly pinned to production and therefore fails loudly with the current staging credential instead of republishing staging data. Once the secret is corrected, the normal full-catalog generator remains the authoritative refresh path. Triggered by: abhishek@composio.dev | Source: slack Session: https://zen.corp.composio.io/dashboard/#/chat/zen-3a77f73eb146 --------- Co-authored-by: Zen Agent <zen@composio.dev> Co-authored-by: abhishek <abhishek@composio.dev> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
782f1df5c7 |
fix(ci): validate Python release metadata (#3824)
This PR: - validates Python package versions and release-note coverage before a `py@*` tag can build or publish artifacts - runs the existing repository release-workflow guard in the tag-release workflow - installs the pinned Node, pnpm, and Bun toolchain only for the metadata validation step - prevents a tag from publishing artifacts whose package, runtime, provider, or docs versions drift apart Validation: - `pnpm test:release-workflow` - `pnpm exec prettier --check .github/workflows/py.release.yml` |
||
|
Alberto Schiabel
|
8a19b75915 |
fix(docs): publish production API URLs and guard against staging leaks (#3770)
## What was wrong The API reference docs were shipping staging URLs to users. There were two separate leaks, both from the same source: the scheduled `docs-update-data` workflow fetches the OpenAPI specs and toolkit data from staging every 5 hours and auto-commits them. The first leak was the curl base URL. `servers[0].url` in `openapi.json` and `openapi-v3.json` rendered as `http://staging-apollo.composio.dev` in every curl example. That is what https://github.com/ComposioHQ/composio/pull/3761 tried to fix. The second leak was in the toolkit data. `toolkits.json` carried 269 `https://staging-backend.composio.dev/api/v1/auth-apps/add` default values, surfaced in the white-labeling and auth-config docs. #3761 never touched this file. ## Which PR caused it Karan asked on Slack whether we could pin down the PR that introduced this. We can. It was https://github.com/ComposioHQ/composio/pull/3426 (commit `a3e58a421`, merged 2026-07-03), which flipped `servers[0].url` from `https://backend.composio.dev` / `PRODUCTION API` to `http://staging-apollo.composio.dev` / `STAGING API` in both specs. It was not a hand-written change. #3426 is itself an auto-generated PR from this same `docs-update-data` workflow, opened by `github-actions[bot]` on the `docs/auto-update-data` branch. The workflow fetched from staging, staging serves the staging server URL in its spec, and the value landed in the committed files where nobody caught it inside a large auto-generated diff. That is the reason the real fix belongs in the generator and the workflow, not in a one-off edit to the JSON. ## Why #3761 was not enough #3761 pinned `spec.servers` to production inside `fetch-openapi.mjs`. That closed the first leak, but three things stayed open. It only covered the OpenAPI specs. The 269 staging hosts in `toolkits.json` come from a different generator, `generate-toolkits.ts`, and stayed live on the docs site. It added no CI guard. The fix was a single line in a generator with nothing asserting it. A later refactor that dropped or reordered that line would republish staging on the next 5-hour regeneration, which is precisely the recurring failure that produced the original report. And it scrubbed the symptom rather than the source. The workflow kept fetching from staging; the pin just rewrote one field afterward. ## The fix I addressed it at four layers, so no single regression brings staging back. **Source.** `docs-update-data.yml` no longer overrides the base URL to staging. The generators default to production, so the docs reflect production. **Generators.** The production URL now lives in one place, `docs/scripts/production-api.mjs`. The toolkit and meta-tools generators sanitize any staging host to production before writing, so a staging fetch can no longer republish staging. **Committed data.** I rewrote the 269 staging hosts already in `toolkits.json` to production. **Guard.** `docs/tests/static/production-urls.test.ts` asserts the OpenAPI `servers` is production and scans both specs and every `public/data/*.json` for any `staging-*.composio.dev` host. It is an independent oracle: it hardcodes the expected value and deliberately does not import the generator constants, so a wrong edit there fails CI instead of moving both sides together. I verified it catches both the original `staging-apollo` and the `staging-backend` leaks. ## One thing to confirm before merge `COMPOSIO_API_KEY` is paired with `COMPOSIO_BASE_URL_STAGING` in every other workflow, so it is most likely a staging key. If that is the case, provision a production-capable key before the next scheduled run. Otherwise that run fails on auth, which is loud and safe, rather than silently republishing staging. The generator sanitizer and the guard keep the output correct regardless of which environment the fetch hits, so there is no risk in the interim. ## Testing - `bun test tests/static/` passes 21 of 21 (16 existing, 5 new). - The shared module loads and all three generators build under bun. - No `staging-*.composio.dev` host remains under `docs/public/`. - `docs-update-data.yml` re-validated as valid YAML. |
||
|
dependabot[bot]
|
78591f7623 |
chore(deps): bump the github-actions group with 5 updates (#3792)
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.10` | `1.11` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | Updates `anthropics/claude-code-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.10 to 1.11 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.11">v1.11</a> (2026-07-04)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/116">#116</a> keep the permission profile helper backward compatible</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.10">v1.10</a> (2026-07-02)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/113">#113</a> add Codex permission profile support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/52fe01ec70a42f454c9d2ebd47598f9fd6893d56"><code>52fe01e</code></a> fix: keep permission profile helper backward compatible (<a href="https://redirect.github.com/openai/codex-action/issues/116">#116</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/0d2a018b4dacc6b0eaa3918e0d2780df6d6fd23e"><code>0d2a018</code></a> docs: update CHANGELOG for v1.10 (<a href="https://redirect.github.com/openai/codex-action/issues/114">#114</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/6b771854be52d8637d060e4b15120b9d746282ab...52fe01ec70a42f454c9d2ebd47598f9fd6893d56">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `actions/stale` from 10.3.0 to 10.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fixed <code>only-issue-types</code> validation by <a href="https://github.com/trueberryless"><code>@trueberryless</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/trueberryless"><code>@trueberryless</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a> Bump undici to 6.27.0 via override, clean up stale license files, and version...</li> <li><a href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a> fix: <code>only-issue-types</code> does not affect PRs (<a href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li> <li>See full diff in <a href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare view</a></li> </ul> </details> <br /> Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/denoland/setup-deno/releases">denoland/setup-deno's releases</a>.</em></p> <blockquote> <h2>v2.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: update README and tests by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/85">denoland/setup-deno#85</a></li> <li>2.0.1 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/86">denoland/setup-deno#86</a></li> <li>Add problem matchers for <code>deno lint</code> by <a href="https://github.com/r7kamura"><code>@r7kamura</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li>refactor: use GitHub downloads for stable version download by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/91">denoland/setup-deno#91</a></li> <li>2.0.2 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/92">denoland/setup-deno#92</a></li> <li>refactor: convert action to TS and bundle code by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li>feat: add "lts" version option by <a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li>feat: add built-in caching via inputs by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/89">denoland/setup-deno#89</a></li> <li>feat: include a hash of deno.lock files in the cache key automatically by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/98">denoland/setup-deno#98</a></li> <li>fix: switch back to package.json as it's necessary for GH actions by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/101">denoland/setup-deno#101</a></li> <li>2.0.3 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/102">denoland/setup-deno#102</a></li> <li>Update actions/checkout by <a href="https://github.com/katayama8000"><code>@katayama8000</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li>docs: add lts as possible release-channel output by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/99">denoland/setup-deno#99</a></li> <li>docs: condense Deno version information in one section by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/100">denoland/setup-deno#100</a></li> <li>docs: fix identifier for latest stable release by <a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li>feat: upgrade Node.js runtime from node20 to node24 by <a href="https://github.com/nikicat"><code>@nikicat</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> <li>2.0.4 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/125">denoland/setup-deno#125</a></li> <li>chore: use versions.json from dl.deno.land by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/130">denoland/setup-deno#130</a></li> <li>2.0.5 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/131">denoland/setup-deno#131</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/r7kamura"><code>@r7kamura</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li><a href="https://github.com/csvn"><code>@csvn</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li><a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li><a href="https://github.com/katayama8000"><code>@katayama8000</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li><a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li><a href="https://github.com/nikicat"><code>@nikicat</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5">https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/denoland/setup-deno/commit/22d081ff2d3a40755e97629de92e3bcbfa7cf2ed"><code>22d081f</code></a> 2.0.5 (<a href="https://redirect.github.com/denoland/setup-deno/issues/131">#131</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/28c677f5df3d8f072e45566ed931347ae6325d53"><code>28c677f</code></a> chore: use versions.json from dl.deno.land (<a href="https://redirect.github.com/denoland/setup-deno/issues/130">#130</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ff4860f9d7236f320afa0f82b7e6457384805d05"><code>ff4860f</code></a> 2.0.4 (<a href="https://redirect.github.com/denoland/setup-deno/issues/125">#125</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/6a293fc1a20bd1d541577761b3169054c853c099"><code>6a293fc</code></a> feat: upgrade Node.js runtime from node20 to node24 (<a href="https://redirect.github.com/denoland/setup-deno/issues/123">#123</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/390061ada6be77a29ed6544d545349413e1f645c"><code>390061a</code></a> docs: fix identifier for latest stable release (<a href="https://redirect.github.com/denoland/setup-deno/issues/115">#115</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bdaa2e4f849cbc8d7b46337cf37db0dc9b321074"><code>bdaa2e4</code></a> docs: condense Deno version information in one section (<a href="https://redirect.github.com/denoland/setup-deno/issues/100">#100</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/e4ff81cdb2791c6378ce29a7fbf02fc798992f78"><code>e4ff81c</code></a> docs: add lts as possible release-channel output (<a href="https://redirect.github.com/denoland/setup-deno/issues/99">#99</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bac1f7276ce08dba2dadbc204ad8385615bf7bdb"><code>bac1f72</code></a> Update actions/checkout (<a href="https://redirect.github.com/denoland/setup-deno/issues/106">#106</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/2f7698fd116bfedbd1c3cd4119337b5a787ef53a"><code>2f7698f</code></a> 2.0.3 (<a href="https://redirect.github.com/denoland/setup-deno/issues/102">#102</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ee64dd32002995d8c023a32a49c0085d179610b1"><code>ee64dd3</code></a> fix: switch back to package.json as it's necessary for GH actions (<a href="https://redirect.github.com/denoland/setup-deno/issues/101">#101</a>)</li> <li>Additional commits viewable in <a href="https://github.com/denoland/setup-deno/compare/667a34cdef165d8d2b2e98dde39547c9daac7282...22d081ff2d3a40755e97629de92e3bcbfa7cf2ed">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
b0a02c9693 |
feat(examples): make validation provider agnostic (#3790)
This PR: - makes example typecheck, lint, and Workers dry-runs discover packages by script presence instead of a Mastra-only filter - runs the nightly staging suite as a provider matrix, starting with Mastra and failing when a matrix package is missing - keeps direct and Tool Router agents explicit while sharing the Tool Router agent between Node.js and Cloudflare Workers - keeps root ESLint rules in Turbo's lint cache key and documents both Worker secrets ## Testing - `pnpm run typecheck` - `pnpm run typecheck:examples` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` (0 errors; 72 existing warnings) - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - confirmed Turbo includes `eslint.config.mjs` in the Mastra lint task inputs - confirmed a missing provider package fails instead of silently passing the nightly smoke step ## Post-Deploy Monitoring & Validation - after merge, dispatch `ts.examples-nightly.yml` on `next` and confirm the `mastra examples against staging` matrix leg runs smoke, direct-tools, and Tool Router successfully - healthy signal: smoke reports wrapped tools and both agent steps return non-empty output - failure signal: workflow logs contain `SMOKE FAIL`, `Agent returned empty output`, `No projects matched`, or a secret preflight error; revert this PR if the foundation gate begins false-passing or blocking unrelated example work - validation window and owner: the first post-merge dispatch plus the next scheduled 06:00 UTC nightly, owned by the TypeScript examples maintainers --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
15a03c10fb |
ci: add dead-code detection (knip + vulture + orphaned-CI check) (#3787)
## What Adds a **report-only** `Dead Code` CI workflow that surfaces likely-orphaned code on every PR, across all three surfaces — TypeScript, Python, and GitHub Actions. Follow-up to the root `Dockerfile` cleanup (#3783) and the dead-code sweep in #3786: instead of finding this stuff by hand, catch it automatically. | Surface | Tool | Wiring | |---|---|---| | TypeScript | [**knip**](https://knip.dev) | `knip.json`; runs via `pnpm dlx knip@5`. Finds unused files, exports, types, and dependencies. | | Python | [**vulture**](https://github.com/jendrikseipp/vulture) | `dead_code` nox session + `make dead-code`; allowlist at `python/config/vulture_allowlist.py`. Finds unused functions/classes/variables (complements Ruff's F401/F841). | | GitHub Actions | small bash script | `.github/scripts/check-orphan-ci.sh` — flags reusable workflows and composite actions with no callers. | ## Why report-only (not blocking) Every job writes findings to the run's **Step Summary** and **never fails the build**. These tools carry unavoidable false positives on a library monorepo — public API surface, dynamic imports, import-map targets (e.g. core's `#platform`), framework entry points. A red ❌ on false positives would just train everyone to ignore the check. Once a job's config is refined enough that a clean run is the steady state, it can be flipped to blocking. ## Validation (ran each locally) - **knip**: 0 unused *files* after scoping out the e2e-test workspaces (knip crashes traversing `ts/e2e-tests/**` — pre-existing knip bug, filed via `ignoreWorkspaces`) and build/docs artifacts. Export/dep categories surface advisory items. - **vulture**: clean run (report-only); allowlist suppresses the 3 `TYPE_CHECKING` re-exports in `custom_tool.py`; `build/`/`dist/` excluded. Surfaces 4 genuine minor items (`bases`, `desc`×3). - **orphan-CI script**: finds none — the repo has no orphaned CI plumbing today. - **Pinning**: `jk actions check` clean for this workflow; `actions/checkout` is SHA-pinned, the two local composite actions need no pin. Local usage is documented under **Dead code detection** in `CONTRIBUTING.md`. ## Note on scope These cover TS/Python/GHA — they would *not* have caught the root `Dockerfile` itself (an arbitrary root file no tool tracks). That class stays a manual-review concern; the orphan-CI script is the closest analogue for the CI surface. |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
Anas Khan
|
57574e4f7c |
fix(cli): point CLI install URL at the next branch (#3758)
The documented one-line CLI install command curls `install.sh` from the `main` branch: ```bash curl -fsSL https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh | bash ``` But the repository's default branch is `next` and there is no `main` branch. `raw.githubusercontent.com` does not fall back to the default branch, so the documented command returns HTTP 404 and the install fails for anyone who copies it from `INSTALL.md`. This replaces the `main` branch segment with `next` in the `raw.githubusercontent.com/ComposioHQ/composio/<branch>/install.sh` URL at every documented occurrence, so the install one-liner resolves. It matches the `next` branch already used for the raw asset URL in `README.md`. `install.sh` itself needs no change: it downloads binaries from release assets, not from a branch raw URL. Fixes # <!-- No open issue; self-identified bug. Leave the Fixes line blank, or remove it. --> ### Changes - `INSTALL.md`: update the 5 `.../composio/main/install.sh` URLs to `.../composio/next/install.sh` (One-line Install, Install specific version, and the Troubleshooting / manual-download / environment-variable examples). - `.github/workflows/build-cli-binaries.yml`: same `main` -> `next` update at the 2 URLs inside the `create-install-instructions` job's heredoc, which regenerates `INSTALL.md` as a GitHub Release artifact, so the released copy carries the working URL too and stays consistent with the checked-in file. ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [x] Documentation - [ ] Breaking change <!-- It is a documentation URL fix that also updates the CI job which regenerates that documentation. Marked Documentation; a reviewer may also consider it a Bug fix. --> ### How Has This Been Tested? No application code changed (static Markdown plus a CI heredoc), so no unit test applies. Verified the branch/URL facts directly: ``` # Default branch is next; no main branch exists git ls-remote --symref origin HEAD # -> ref: refs/heads/next git ls-remote --heads origin main next # only refs/heads/next (+ changeset-release/next); no main # The broken vs working URL, live curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh # 404 curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/next/install.sh # 200 # After the change: 0 remaining main URLs, 7 next URLs grep -rn "composio/main/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # no matches grep -rn "composio/next/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # 7 matches # The workflow YAML still parses cleanly after the heredoc edit python -c "import yaml; yaml.safe_load(open('.github/workflows/build-cli-binaries.yml'))" ``` ### Screenshots (if applicable) N/A. ### Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed <!-- YAML re-parses; grep + curl checks above --> - [x] I updated documentation as needed <!-- this change is the documentation fix --> - [ ] I added tests or explain why not applicable <!-- N/A: static docs URL + CI heredoc, no code path to test --> - [ ] I added a changeset if this change affects published packages <!-- N/A: docs + CI only, no published package --> ### Additional context The 14 `github.com/ComposioHQ/composio/tree/main/...` `homepage` fields in `ts/**/package.json` also point at the non-existent `main` branch, but those are published-package metadata (a different URL form that would require a changeset) and are left out to keep this PR single-purpose. They are a reasonable follow-up. |