mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
5520cd69b1
## Problem A catalog pin or lockfile edit swaps what every package resolves, without touching a file under `ts/**` or `python/**`. The path filters on our suites did not account for that, so a dependency bump could skip the very checks meant to catch it. This is not hypothetical. In #4135, bumping `@composio/client` from `0.1.0-alpha.76` to `2.0.0-rc.5` — a one-line change in `pnpm-workspace.yaml` — ran **no TypeScript E2E at all**. That client adds a credential-transport guard that refuses plain-HTTP credentials to non-loopback hosts, which breaks `@e2e-tests/cli-toolkits-list` (the harness serves its mock backend at `http://host.docker.internal:${port}`). The PR was green throughout; the breakage only surfaced when the suite was dispatched by hand. `ts.test.yml` ran on that PR purely by luck, because the changeset file matched `.changeset/**`. ## Change Add the dependency-resolution inputs to every path-filtered SDK workflow that lacked them: | workflow | added | | --- | --- | | `ts.test-e2e.yml` | `pnpm-workspace.yaml`, `pnpm-lock.yaml` | | `ts.test.yml` | `pnpm-workspace.yaml`, `pnpm-lock.yaml` | | `ts.typecheck.yml` | `pnpm-workspace.yaml`, `pnpm-lock.yaml` | | `ts.examples.yml` | `pnpm-workspace.yaml`, `pnpm-lock.yaml` | | `py.check.yaml` | `python/pyproject.toml`, `uv.lock` | | `py.test.yml` | `uv.lock` | `ts.audit.yml` and `ts.build.yml` already listed both pnpm files and are unchanged. `ts.release.yml` and `ts.examples-nightly.yml` have no path filters. `py.check.yaml` was the widest gap on the Python side: it matched only `python/**/*.py`, so the `composio-client` pin bump in #4135 triggered no ruff or mypy run. ## Verification Every touched file still parses as YAML, and each of the six now matches on the dependency inputs. The trade is more CI on lockfile-only changes, which seems clearly worth it against a silent client swap.