mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
503b50ab02
This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump **except** the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
108 lines
3.3 KiB
YAML
108 lines
3.3 KiB
YAML
name: Dead Code
|
|
|
|
# Surfaces likely-dead code on every PR so orphaned files/exports/deps get
|
|
# noticed instead of rotting (see the root Dockerfile cleanup, #3783).
|
|
#
|
|
# Report-only by design: every job writes findings to the run's Step Summary
|
|
# and never fails the build. These tools carry false positives (public API
|
|
# surface, dynamic imports, import-map targets), so a red X here would train
|
|
# people to ignore it. Tighten a job to blocking only once its config is
|
|
# refined enough that a clean run is the steady state.
|
|
|
|
on:
|
|
push:
|
|
branches: [master, next]
|
|
paths:
|
|
- 'ts/**'
|
|
- 'python/**'
|
|
- '.github/actions/**'
|
|
- '.github/workflows/**'
|
|
- '.github/scripts/check-orphan-ci.sh'
|
|
- 'knip.json'
|
|
- 'package.json'
|
|
- 'pnpm-workspace.yaml'
|
|
- 'pnpm-lock.yaml'
|
|
- 'mise.toml'
|
|
- 'mise.lock'
|
|
pull_request:
|
|
branches: [master, next]
|
|
paths:
|
|
- 'ts/**'
|
|
- 'python/**'
|
|
- '.github/actions/**'
|
|
- '.github/workflows/**'
|
|
- '.github/scripts/check-orphan-ci.sh'
|
|
- 'knip.json'
|
|
- 'package.json'
|
|
- 'pnpm-workspace.yaml'
|
|
- 'pnpm-lock.yaml'
|
|
- 'mise.toml'
|
|
- 'mise.lock'
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
knip:
|
|
name: TypeScript (knip)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Setup Node.js, pnpm, Bun
|
|
uses: ./.github/actions/setup-node-pnpm-bun
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Run knip (report-only)
|
|
run: |
|
|
{
|
|
echo '## Knip — TypeScript dead code'
|
|
echo ''
|
|
echo 'Unused files, exports, types and dependencies. False positives'
|
|
echo 'usually mean a missing `entry` in `knip.json`; vet before deleting.'
|
|
echo ''
|
|
echo '```'
|
|
pnpm dlx knip@5 --no-exit-code --no-progress 2>&1 || true
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
vulture:
|
|
name: Python (vulture)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Setup Python with UV
|
|
uses: ./.github/actions/setup-python-uv
|
|
|
|
- name: Run vulture (report-only)
|
|
run: |
|
|
{
|
|
echo '## Vulture — Python dead code'
|
|
echo ''
|
|
echo 'Likely-unused functions, classes and variables. Suppress'
|
|
echo 'confirmed false positives in `python/config/vulture_allowlist.py`.'
|
|
echo ''
|
|
echo '```'
|
|
(cd python && uv run nox -s dead_code) 2>&1 || true
|
|
echo '```'
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
orphaned-ci:
|
|
name: GitHub Actions (orphan check)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Check for orphaned workflows and composite actions
|
|
run: bash .github/scripts/check-orphan-ci.sh >> "$GITHUB_STEP_SUMMARY"
|