Files
Alberto Schiabel 503b50ab02 chore(deps): refresh SDK, Python, and CI dependencies (#3955)
This PR:

- splits https://github.com/ComposioHQ/composio/pull/3953 in two: this
PR carries every dependency and GitHub Actions bump **except** the docs
site, which follows in a stacked PR
- consolidates and supersedes Dependabot PRs #3915, #3916, and #3934
through #3942
- adopts TypeScript 7.0.2 for primary compilation while retaining the
`@typescript/typescript6` API lane that TypeScript-ESLint still
requires, following the upstream side-by-side guidance
- refreshes Python core and provider dependencies, lockfiles, and the
Ruff 0.16 lint configuration
- updates every GitHub Action with a verified newer official release,
including majors, while retaining immutable commit SHA pins and
migrating setup-uv cache pruning
- deletes four per-package `eslint.config.mjs` shims: under ESLint 10
the default per-file config lookup re-anchors the root config's globs
into each package, so `pnpm lint` stayed green while the CLI's
try/catch, `process.env` and node-builtin bans went unenforced
- bounds and documents the new `brace-expansion` and `@hono/node-server`
security overrides, raising the `@hono/node-server` floor to 2.0.10 to
clear GHSA-9mqv-5hh9-4cgg
- preserves intentional compatibility fixtures and lanes for AI SDK 6,
Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints

## Context

The docs site is a separate Bun workspace with its own `bun.lock` and is
not a pnpm workspace member, so the two halves share no lockfile and no
build. Splitting them keeps the Fumadocs 11 migration (a breaking API
change with real refactoring) reviewable on its own, independently of
the mechanical version bumps here.

The `brace-expansion` override deliberately spans majors:
GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with
no 1.x or 2.x backport, so narrowing it to the 5.x line puts
`brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and
`pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the
trade-off it buys is recorded inline in `pnpm-workspace.yaml`.

Verified on this branch standalone: `pnpm install --frozen-lockfile`,
`pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963
tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
2026-07-27 17:57:29 +05:30

71 lines
2.4 KiB
YAML

name: Examples Nightly (staging)
# Executes the provider examples against the STAGING backend with real
# credentials. Non-blocking by design: it runs on a schedule (and on demand),
# never as a required PR check, so staging/LLM flakiness cannot gate merges.
on:
schedule:
- cron: '0 6 * * *' # 06:00 UTC nightly
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}
cancel-in-progress: false
permissions:
contents: read
env:
# Staging is not a secret; the API keys are.
COMPOSIO_BASE_URL: https://staging-backend.composio.dev
COMPOSIO_API_KEY: ${{ secrets.COMPOSIO_API_KEY }}
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
jobs:
examples-staging:
name: ${{ matrix.provider }} examples against staging
runs-on: ubuntu-latest
timeout-minutes: 20
strategy:
fail-fast: false
matrix:
provider: [mastra, openai]
steps:
- name: Checkout Code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Setup Node.js, pnpm, Bun
uses: ./.github/actions/setup-node-pnpm-bun
with:
enable-turbo-cache: 'true'
- name: Install Dependencies
run: pnpm install --frozen-lockfile
- name: Build SDK packages
run: pnpm run build:packages
# Both secrets must be present for scheduled and manually dispatched
# validation. Otherwise smoke can self-skip and the LLM steps can no-op,
# leaving the whole regression net green while testing nothing.
- name: Require staging credentials
if: ${{ env.COMPOSIO_API_KEY == '' || env.OPENAI_API_KEY == '' }}
run: |
echo "::error::COMPOSIO_API_KEY and OPENAI_API_KEY are required for examples validation."
exit 1
# Deterministic regression net — needs only COMPOSIO_API_KEY, no LLM.
# Self-skips when the secret is absent (e.g. fork-triggered dispatch).
- name: ${{ matrix.provider }} smoke (wrapping + tool-router)
run: pnpm --filter ${{ matrix.provider }}-example --fail-if-no-match run smoke
# Full agent run — only when an LLM key is configured.
- name: ${{ matrix.provider }} direct-tools example
if: ${{ env.OPENAI_API_KEY != '' }}
run: bun ts/examples/${{ matrix.provider }}/src/index.ts
- name: ${{ matrix.provider }} tool-router example
if: ${{ env.OPENAI_API_KEY != '' }}
run: bun ts/examples/${{ matrix.provider }}/src/tool-router.ts