mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
503b50ab02
This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump **except** the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
name: Examples Nightly (staging)
|
|
|
|
# Executes the provider examples against the STAGING backend with real
|
|
# credentials. Non-blocking by design: it runs on a schedule (and on demand),
|
|
# never as a required PR check, so staging/LLM flakiness cannot gate merges.
|
|
on:
|
|
schedule:
|
|
- cron: '0 6 * * *' # 06:00 UTC nightly
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Staging is not a secret; the API keys are.
|
|
COMPOSIO_BASE_URL: https://staging-backend.composio.dev
|
|
COMPOSIO_API_KEY: ${{ secrets.COMPOSIO_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
|
|
jobs:
|
|
examples-staging:
|
|
name: ${{ matrix.provider }} examples against staging
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
provider: [mastra, openai]
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Setup Node.js, pnpm, Bun
|
|
uses: ./.github/actions/setup-node-pnpm-bun
|
|
with:
|
|
enable-turbo-cache: 'true'
|
|
|
|
- name: Install Dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build SDK packages
|
|
run: pnpm run build:packages
|
|
|
|
# Both secrets must be present for scheduled and manually dispatched
|
|
# validation. Otherwise smoke can self-skip and the LLM steps can no-op,
|
|
# leaving the whole regression net green while testing nothing.
|
|
- name: Require staging credentials
|
|
if: ${{ env.COMPOSIO_API_KEY == '' || env.OPENAI_API_KEY == '' }}
|
|
run: |
|
|
echo "::error::COMPOSIO_API_KEY and OPENAI_API_KEY are required for examples validation."
|
|
exit 1
|
|
|
|
# Deterministic regression net — needs only COMPOSIO_API_KEY, no LLM.
|
|
# Self-skips when the secret is absent (e.g. fork-triggered dispatch).
|
|
- name: ${{ matrix.provider }} smoke (wrapping + tool-router)
|
|
run: pnpm --filter ${{ matrix.provider }}-example --fail-if-no-match run smoke
|
|
|
|
# Full agent run — only when an LLM key is configured.
|
|
- name: ${{ matrix.provider }} direct-tools example
|
|
if: ${{ env.OPENAI_API_KEY != '' }}
|
|
run: bun ts/examples/${{ matrix.provider }}/src/index.ts
|
|
|
|
- name: ${{ matrix.provider }} tool-router example
|
|
if: ${{ env.OPENAI_API_KEY != '' }}
|
|
run: bun ts/examples/${{ matrix.provider }}/src/tool-router.ts
|