Move untrusted PR event data (title, head ref, base ref, SHAs) from
inline ${{ }} interpolation in shell run: blocks to env: blocks,
referencing them as shell variables instead. This prevents arbitrary
code execution via crafted PR titles or branch names.
Affected workflows:
- test_smoke-starter.yml: PR title, user login, head SHA
- publish-release.yml: PR head ref (branch name)
- static_quality.yml: PR base ref, base SHA, head SHA
The format job in static_quality.yml globs *.json (and *.yaml) to feed
oxfmt --write on PR-changed files. Lockfiles match those globs but oxfmt
rejects them internally (likely a size threshold or filename heuristic),
so lockfile-only PRs failed with 'Expected at least one target file' and
exit 123 even though the count check thought there were 18 files to format.
Exclude package-lock.json, pnpm-lock.yaml, and yarn.lock from the glob.
Lockfiles are auto-generated and should never be hand-formatted regardless,
so this is corrective — small JSON/YAML config files (tsconfig.json,
package.json, *.yml workflow files) still get formatted as before.
Caused PR #4438's format check to fail; surfaced again on this PR which
only touches lockfiles.
oxfmt 0.36 supports .md but not .mdx — including .mdx in the file-list
glob causes MDX-only PRs to fail with "Expected at least one target
file" because oxfmt drops every input as an unknown target and then
errors on the empty target set. Mixed PRs (.mdx + .tsx/.json/etc) pass
because the non-MDX files keep the target set non-empty, which is why
this has only surfaced now on a shell-docs-only sync PR.
Removing .mdx from the glob lets MDX-only PRs hit the existing count=0
skip path and pass cleanly. Add .mdx back when oxfmt ships MDX support.
Two bugs in the earlier version, both surfaced once main advanced and
was merged into the branch:
- `fetch-depth: ${{ ... && 0 || 1 }}` evaluated to `1` on PRs because
the short-circuit treats `0` as falsy, so the base SHA was missing
locally and `git diff` exited 128.
- Diffing against the PR's stored `base.sha` includes every file main
touched since the PR opened once main is merged into the branch, which
defeats the whole point of this change. Diff against the current tip
of the base branch instead.
The static / quality "format" job ran oxfmt across the whole tree on
every PR. When main advanced with stale files, unrelated PRs picked up
those re-formats and ended up with a noisy `style: auto-fix formatting`
commit.
Now the job collects `git diff --name-only base...HEAD` for oxfmt-
supported extensions and passes only those paths to oxfmt. Push events
on main continue to check the whole repo so the baseline is still
enforced.
GitHub's "Create a merge commit" merge option builds the commit message
from the PR body. When the body contains markdown lists or blank lines
(e.g. PR #4113 → merge 5ed233f01), commitlint parses subsequent
paragraphs as additional commit subjects and fails with subject-empty /
type-empty.
Two-layer fix:
- commitlint.config.js: ignore standard "Merge " prefixed messages.
- static_quality.yml: guard the push-path `--last` step with a
parent-count check so true merge commits (which keep the PR-title
header and thus don't match the "Merge " prefix) are skipped
before commitlint runs at all.
Merged standalone commitlint into static_quality as 4th parallel job.
Upgraded all actions to v4, added concurrency group. Format job now
auto-fixes and commits back to same-repo PR branches. Commitlint
posts helpful PR comment with valid prefixes on failure.
- Add package.json exports for v2/{express,hono,node} subpaths
- Add elysia devDependency and tsdown entry points
- Exclude bun integration tests from vitest config
- Update CI workflows to include runtime-servers test job
- Add runtime-server-adapter docs page
- Add changeset for the fetch-based runtime feature
Replace eslint and prettier with oxlint and oxfmt for faster linting
and formatting across the monorepo. Remove all eslint and prettier
configs, dependencies, and related packages. Add .oxlintrc.json and
.oxfmtrc.json for the new tooling. Update CI workflows and lefthook
hooks accordingly. Reformat codebase with oxfmt.
https://claude.ai/code/session_01GMkSf29p78HuMR1mbXn8He
Flatten all packages from packages/v1/* and packages/v2/* into packages/* —
every package now lives directly under the @copilotkit/ scope with no v1/v2
subdirectories.
- Move all v1 packages (react-core, react-ui, runtime, shared, etc.) from
packages/v1/* to packages/*
- Absorb v2 react code into packages/react-core/src/v2/ (exported via /v2 subpath)
- Absorb v2 agent code into packages/runtime/src/agent/ (exported via /v2 subpath)
- Move v2 packages (core, angular, demo-agents, etc.) to packages/*
- Replace all @copilotkitnext/* imports with @copilotkit/* equivalents
- Keep @copilotkitnext/angular as the sole exception (angular remains on next)
- Update CI workflows, renovate config, release scripts for flat structure
- No public API surface changes — all exports fields are preserved
Co-authored-by: Alem Tuzlak <t.zlak@hotmail.com>
Signed-off-by: Tyler Slaton <tyler@copilotkit.ai>
These 8 workflows install uv but never invoke it. Only e2e_dojo.yml
actually needs uv (the dojo scripts use uv sync/run for Python agents).
Removing the unnecessary step saves CI time and reduces confusion.
Parallel CI workflows were each getting a different Nx Cloud execution
ID, resulting in separate CIPEs instead of one unified view. Set a
stable NX_CI_EXECUTION_ID env var using head_ref + sha + run_attempt
so all workflows for the same push are grouped together. Also add
NX_CI_EXECUTION_ENV per workflow to create labeled tab sections in the
Nx Cloud CIPE page.
The @copilotkitnext/runtime:build step OOMs on GitHub Actions runners
with the default ~2GB heap. Set NODE_OPTIONS=--max-old-space-size=4096
on all three failing workflows.
Jordan Ritter