mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
codex/remove-threads-cli-path
38 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Ran Shem Tov
|
d779f71468 |
feat(showcase): deploy strands-typescript integration to staging
Wire the strands-typescript showcase integration for staging deployment, mirroring how the Python strands integration is deployed. - manifest: flip deployed: true so the shell lists it in the integration menu - railway-envs.ts: add showcase-strands-typescript SSOT entry (staging-only for now: prod instance not yet provisioned, so it omits the prod env and is gateIgnore'd until promoted dual-env); regenerate railway-envs.generated.json - showcase_build.yml + showcase_build_check.yml: add the strands-typescript build matrix entry, change-detection filter, and dispatch option (railway_id is the new Railway service id) - golden fixture + image-ref-gate inventory tests updated for the new service Railway staging service showcase-strands-typescript provisioned (showcase-strands-typescript-staging.up.railway.app, health /api/health, OpenAI-via-aimock env). Prod is added later via the promote pipeline. |
||
|
Jordan Ritter
|
6f50bebf0e | fix(cvdiag): materialize _shared into integration build-check Docker context (symlink escaped context → 'too many symlinks') (M6) | ||
|
Jordan Ritter
|
7bde1eef3a | ci(showcase): pull Git LFS assets during build so demo images ship real binaries | ||
|
Jordan Ritter
|
293b981464 |
fix(ci): render real newlines in showcase build & validate Slack alerts
GitHub Actions expression string literals don't interpret `\n`, so
`toJSON(format('...\n...'))` emits literal `\\n` and Slack renders the
two characters backslash-n instead of a line break. Inject real newlines
via a `fromJSON('"\n"')` placeholder, matching the starter-smoke fix.
Fixes the "all builds failed" and "Showcase Build Failed" alerts in
showcase_build.yml and the multi-line "showcase_validate failed" alert
in showcase_validate.yml. showcase_promote.yml already used the
fromJSON placeholder; the single-line validate alert has no newlines
and was left untouched.
|
||
|
Jordan Ritter
|
3c138ec450 |
ci(showcase): build & push the PocketBase image from main
PocketBase had no CI build path: `ghcr.io/copilotkit/showcase-pocketbase`
was a stale April `:latest`, and there was no way to ship pb_migrations /
pb_hooks changes without an ad-hoc manual build. Add a `pocketbase` slot to
showcase_build.yml's build matrix, mirroring the harness/aimock entries:
- dispatch_name `showcase-pocketbase`, context `showcase/pocketbase`, its
own Dockerfile, health `/api/health`, railway_id from the SSOT.
- a paths-filter key gated to `showcase/pocketbase/**` so the slot only
rebuilds when PB's own files change (the image is self-contained — no
shared-module copy), not on every showcase push.
- the workflow_dispatch service choice so PB is human-targetable.
Flip the SSOT entry (railway-envs.ts) to `ciBuilt: true` with
`dispatchName: "showcase-pocketbase"` so it is built+pushed (`:sha` +
`:latest`) and joins the default staging-redeploy scope; the build's
redeploy step only touches the matrix-intersect-success set, so PB still
only redeploys when its own files change. Regenerate
railway-envs.generated.json and the showcase_promote.yml service dropdown,
and update the SSOT/redeploy tests that pinned PB as out-of-band
(CI_BUILT_SERVICES 25 -> 26; webhooks stays the only non-CI-built service).
|
||
|
Jordan Ritter
|
2d5e198502 |
ci(showcase): tolerate starter-* dispatch + keep 6h smoke cron
showcase_build.yml's existing detect-changes job shared the workflow_dispatch
`service` input with the new detect-starter-changes job, so dispatching
`service=starter-<slug>` tripped detect-changes's fail-loud `exit 1` ("did
not match any entry in ALL_SERVICES") and reddened the run even though
build-starters published fine. Scope the showcase fail-loud to non-`starter-*`
inputs via a case statement (mirroring how the starter job scopes its own
fail-loud) so a `starter-*` dispatch resolves to an empty showcase matrix and
SKIPS; typo'd showcase service names still fail loud.
Restore the 6h `schedule` cron in test_smoke-starter.yml. The PR had removed
it, leaving NO post-merge floating-dependency breakage detector for starters
— and its harness-probe replacement depends on S5 Railway services that don't
exist yet. Keep the cron until S5 starter-service probing is confirmed live.
|
||
|
Jordan Ritter
|
f7327bd0a8 |
ci(showcase): publish per-starter GHCR images; reduce smoke-starter to PR gate
showcase_build.yml: add detect-starter-changes + build-starters jobs building each of the 12 starters from examples/integrations/<slug>/Dockerfile via Depot (--platform linux/amd64) and pushing ghcr.io/copilotkit/starter-<slug>:latest + :<sha>. The starter- prefix is disjoint from showcase-* so harness discovery stays clean. test_smoke-starter.yml: drop the 6h schedule cron (live signal now comes from the harness probing deployed Railway services + the harness alert path); keep the examples/integrations/** PR build-sanity gate + offline aimock smoke run. Workflows slot (S4) of the starter-row-group spec (model B). Railway provisioning (S5) is intentionally out of scope, gated on cost approval. |
||
|
Jordan Ritter
|
5748b7c27a |
feat(showcase): serialize promote concurrency and add red-path workflow alerts
Collapse the promote workflow to an input-agnostic concurrency group so promotes can't race the same Railway service; add #oss-alerts failure notifications to the build and validate workflows (build via extended needs, validate via a new workflow-level notify job). |
||
|
Jordan Ritter
|
41fae67618 |
fix(showcase): tighten verify-matrix drift guard + fail-loud boundaries; fix stale comment + flaky test
Closing hardening pass on the showcase deploy-gate's verify-matrix
resolver. The 7-agent review confirmed the gate is correct; this
commit fixes the residual rough edges.
- showcase_deploy.yml: correct the false §3 ok-non-empty comment.
The empty-intersection case can coexist with redeploy_red=false
(every redeploy succeeded, just none probe-eligible) — that's a
correctly-green run, not a red one.
- showcase_deploy.yml: tighten the summary.json shape guard to catch
PARTIAL drift (TOTAL>0 && WITH_STATUS<TOTAL). The previous all-or-
nothing TOTAL>0 && WITH_STATUS==0 check silently dropped drifted
rows on a mixed summary. Validated locally on mixed/normal/empty/
total-drift jq samples.
- resolve-verify-matrix.ts: add asSupportedEventName narrowing helper
+ use it in the CLI. Replaces the unchecked `as` cast — type system
and runtime now tell one story. Resolver's internal eventName
guard becomes defense-in-depth for direct (test) callers.
- resolve-verify-matrix.ts: make the workflow_run boundary total —
summaryPresent MUST be exactly "true"/"false". Any other value
(including "" from a step-id-rename wiring break) throws now
instead of silently emitting has_services=false.
- resolve-verify-matrix.ts: drop the try/catch around
fileURLToPath(import.meta.url) in `invokedDirectly`. The catch
used to swallow ESM-interop failures and silently no-op the CLI
(exit 0, no GITHUB_OUTPUT write → verify skipped = false-green).
- resolve-verify-matrix.ts: reword parseSsotServices JSDoc to
distinguish schema-drift from truncation (the two are different
failure modes, not one conflated story).
- showcase_build.yml: comment addendum on the redeploy-summary
upload — swapping the guard to `if: always()` would red the
legitimate services=='' path (no summary written), trading the
already-closed false-green for a false-red on every non-buildable
push.
- resolve-verify-matrix.cli.test.ts: switch to spawnSync so stderr
is captured on both zero and non-zero exit (execFileSync only
exposes stderr on throw). Hard-code two stable probe-eligible
names ("aimock", "harness") for the sorted-CSV test rather than
picking probe[0]/probe[1] off the live SSOT — the prior test was
tautological (already-sorted in, sorted out) and would silently
pass if the resolver did nothing.
- resolve-verify-matrix.cli.test.ts: add CLI coverage for the
dropped-token ::warning:: path (FIX 3 — the entire drift-detection
contract had zero CLI coverage), the unexpected-EVENT_NAME error
(FIX 5), and the workflow_run-summary_present total boundary
(FIX 7, both "" and "True" inputs).
- resolve-verify-matrix.test.ts: add unit coverage for the new
workflow_run summaryPresent boundary (empty + "True" + the
workflow_dispatch ignores-summaryPresent regression).
Red-green: 6 tests RED before code changes (FIX 3 warning, FIX 5
unknown EVENT_NAME, FIX 7 unit + CLI ×2 for "" and "True"); 79
tests GREEN after.
Validation: 4 vitest files / 79 tests passing; 87/87 ruby specs
passing; actionlint findings unchanged vs integration baseline
(8 → 8, identical diff); yaml.safe_load OK on both workflows.
|
||
|
Jordan Ritter
|
aafafa53bd |
fix(showcase): validate verify-matrix boundaries (SSOT + summary shape), fail loud, test CLI contract
A 7-agent review of the verify-matrix resolver and its surrounding workflow plumbing found three
boundary surfaces that could silently produce a GREEN deploy on a broken release, plus an
untested CLI contract that CI compares against the literal strings 'true' / 'false'.
FIX 1 — Validate the SSOT shape in loadSsotServices(). The prior `JSON.parse(...) as
{services: SsotService[]}` was an unchecked cast: a truncated/drifted SSOT (emitter crashed
mid-write, or schema renamed) parses fine but silently shrinks/empties the probe-eligible set
→ some redeployed services go unverified, or verify is skipped on a real redeploy. Extract a
pure exported parseSsotServices(raw, path) that requires the shape we depend on (non-empty
services array; each entry has a non-empty string name, an optional string|null dispatchName,
and a probe object with a boolean staging). Throw `::error::SSOT <path> malformed: <detail>`
on any violation. Also re-check existsSync(SSOT_JSON) after the regenerate-if-missing
execFileSync — a regen that exits 0 without writing must not proceed to a useless JSON.parse
crash. Drop the defensive `probe?.staging` once shape is guaranteed.
FIX 2 — Validate summary.json shape in the redeploy-gate bash. The bullseye false-green
surface: if redeploy-env.ts's schema ever drifts (e.g. `status` → `state`, `ok` → `success`),
every `jq select(.status==...)` yields empty → redeploy_red=false AND ok_services="" →
resolver skips verify → GREEN CI on a real unverified redeploy. Add a TOTAL vs WITH_STATUS
shape guard right after loading the summary: if TOTAL > 0 && WITH_STATUS == 0, emit
::error::summary.json has $TOTAL entries but none with status ok|error (schema drift?) and
exit 1. The legitimate empty-array path (TOTAL=0) is preserved.
FIX 3 — Fail loud on unknown eventName in resolveVerifyMatrix. The prior code fell through to
the workflow_run intersection branch for ANY unrecognized eventName (typo, unexpected
trigger), silently emitting has_services=false → indistinguishable from a legit "summary
absent" skip. Add an explicit guard so only workflow_run / workflow_dispatch are accepted;
anything else throws ::error::resolve-verify-matrix: unexpected eventName '<value>'. Tighten
the eventName parameter type to the literal union.
FIX 4 — Trim ok tokens + warn on dropped tokens in okCsvToCanonicalNames. Split, then
.map(t => t.trim()).filter(Boolean) so "a, b" (spaces) matches. Collect tokens that match NO
SSOT service (by name or dispatchName) and have the CLI wrapper emit ::warning::ok_services
tokens dropped (no SSOT match): <list> on stderr when non-empty — surfaces SSOT/build drift.
The pure function stays IO-free; logging lives in the wrapper.
FIX 5 — CLI wrapper integration test. New resolve-verify-matrix.cli.test.ts spawns
`npx tsx showcase/scripts/resolve-verify-matrix.ts` with a temp $GITHUB_OUTPUT file across
four scenarios and asserts the temp file contents EXACTLY (the workflow YAML compares
has_services against the literal strings 'true'/'false', so the byte-for-byte format is part
of the contract). Uses the real railway-envs.generated.json so the loader exercise is real.
FIX 6 — Cleanup. Remove the dead `env: DISPATCH_SERVICE: ...` block on the redeploy-gate
step (the next step redeclares it — leftover from the extraction). Soften the §3
decision-table all-errors bullet to match resolve-verify-matrix.ts's careful wording, and
append that when the success-set is empty (or the intersection collapses to empty), verify
is skipped and the gate reds independently. Append to showcase_build.yml's "Upload redeploy
summary" path-(A) comment that `if-no-files-found: error` still reds path (A) even if a
future change adds `if: always()`.
Tests: red→green for FIX 1/3/4/5 verified locally. Resolve-verify-matrix vitest count:
12 → 28. Full requested suite (resolve-verify-matrix + cli + aggregate-build-results +
lint-rule-no-public-env): 72 passed. showcase/bin ruby specs: 87 runs / 0 failures / 0
errors / 0 skips. actionlint baseline preserved (8 findings, identical to integration tip).
|
||
|
Jordan Ritter
|
c579ad753a |
fix(showcase): extract+test verify-matrix resolver; skip verify when redeploy success-set empty
Extract the inline bash+jq decision logic from showcase_deploy.yml's
resolve-matrix job into showcase/scripts/resolve-verify-matrix.ts, a
pure function with a vitest suite. The bash had produced two confirmed
bugs across prior CR rounds, so making it testable is the lasting fix.
Issue A (the bug this PR fixes): when summary_present=true but
ok_services is empty (every service errored on redeploy), the old bash
skipped the intersection and fell through to the full probe-eligible
fleet, gratuitously probing every service against stale :latest. The
resolver now returns has_services=false in that case — enforce-redeploy
-gate independently reds the workflow on redeploy_red=true, so this
case is already loud; there is nothing left to verify.
Parity preserved for unchanged cases:
- workflow_dispatch + 'all'/empty → full probe-eligible set
- workflow_dispatch + specific svc → that one (unknown → error exit)
- workflow_run + summary_present=false → has_services=false
- workflow_run + present + ok non-empty → intersection with probe-
eligible (SSOT key OR dispatchName aliases both resolve)
Also clarified the Upload-redeploy-summary comment in showcase_build.yml
to document both red paths (hard crash → redeploy step exits non-zero;
exit-0-but-no-file → if-no-files-found:error reds the step) so no
false-green path is possible.
Tests: 12-case vitest suite covers each decision-table row plus the
Issue A fix (written red-first; failed against a naive full-fleet
fallback, passed once the early return was added). CLI parity verified
against the real generated SSOT for the three representative env-var
combinations (workflow_run + present + ok=[a,c]; workflow_run + present
+ ok empty; workflow_dispatch + 'all').
|
||
|
Jordan Ritter
|
22895c104e |
fix(showcase): skip verify on no-redeploy run + make redeploy-summary upload mandatory
Three correctness holes uncovered by confirmation review of the earlier
deploy-gate fix:
(1) showcase_deploy.yml — Build verify matrix step: when workflow_run fires
with summary_present=false (legitimate "build redeployed nothing", e.g.
docs/script-only push under showcase/**), the gate correctly no-oped but
the matrix fell through the empty-OK_FROM_REDEPLOY branch and resolved to
the FULL probe-eligible set. Verify then ran against the whole staging
fleet for a push that deployed nothing — gratuitous, and false-reds the
deploy workflow if any unrelated staging service happens to be unhealthy
at probe time. Thread github.event_name + summary_present into the step
via env and add an explicit (workflow_run && summary_present==false)
guard that sets services_csv="" / has_services=false. workflow_dispatch
fall-through (full fleet / chosen service) preserved. workflow_run +
summary present + all-errors path unchanged: enforce-redeploy-gate still
trips RED on redeploy_red=true.
(2) showcase_build.yml — Upload redeploy summary step: was gated on
services != '' && hashFiles('.redeploy/summary.json') != ''. If
redeploy-env.ts crashes before writing summary.json (the script is
documented "always exits 0", but a crash/OOM/unhandled-rejection can
skip the write), services != '' but hashFiles == '' silently skipped
the upload. The deploy side then saw "artifact absent", treated it as
"nothing redeployed", skipped the gate, and produced a FALSE GREEN
despite a real redeploy failure. Drop the hashFiles clause so the upload
is mandatory whenever a redeploy was attempted; if-no-files-found:error
(already set) then fails the step → fails the redeploy-staging job →
fails the build workflow → showcase_deploy.yml's resolve-matrix.if
(workflow_run.conclusion == 'success') blocks the deploy run from
starting at all. Loud failure on the build side. The legitimate
services == '' (matrix ∩ success-set empty) path is preserved by the
services != '' guard.
(3) showcase_deploy.yml — check-redeploy-summary github-script: was a
single per_page:100 list call. While the current run uploads ~28
artifacts (well within 100), a future expansion past 100 could push
redeploy-summary off the first page and produce a false "absent" → gate
skipped → false-green. Switch to github.paginate.iterator with the
endpoint's name="redeploy-summary" filter for an exact-match,
pagination-safe lookup. No try/catch is added: github-script propagates
unhandled rejections by default, so a 5xx/permission error fails the
step → resolve-matrix.result == 'failure' → enforce-redeploy-gate trips
RED. Silent default-to-false on API error would open the gate on a
broken pipeline, which is what we explicitly do NOT want.
Validation: actionlint shows 8 findings on both files, identical to the
integration baseline (zero new findings). python3 yaml.safe_load OK on
both. Regression suites green: showcase/scripts vitest 44/44
(aggregate-build-results + lint-rule-no-public-env);
showcase/bin/spec/all_tests.rb 87 runs / 251 assertions / 0 failures.
|
||
|
Jordan Ritter
|
a6239cde11 |
fix(showcase): close deploy-gate false-greens and broaden public-env lint rule
Seven-agent CR surfaced correctness defects in the build/deploy/promote pipeline and in the no-public-env-shell-read oxlint rule. This commit closes the false-green paths and broadens lint coverage. Workflow fixes: - showcase_deploy.yml: drop `continue-on-error: true` on the redeploy-summary artifact download. The dispatch path is already guarded by the `if: workflow_run` clause, so the bash "no summary" branch handles legitimate manual dispatches. A genuine workflow_run download failure must now fail loud instead of silently widening verify to the full service set against stale `:latest`. - showcase_build.yml: redeploy-staging now intersects the build matrix with the aggregator success set (`needs.aggregate-build-results.outputs.results`, status == "success") before producing the redeploy CSV. Failed/skipped slots no longer get redeployed (which would just re-pull stale `:latest` and look healthy). - showcase_build.yml: `notify-all-builds-failed` now additionally requires `needs.build.result == 'failure'` so it doesn't Slack-spam when the build job was SKIPPED (verify-image-refs upstream failure). - showcase_build.yml: `notify` now lists [build, aggregate-build-results, redeploy-staging] in `needs:` so aggregator/redeploy failures still emit a Slack signal. `if: failure()` still skips when none of the needs failed. - showcase_build.yml: `set -euo pipefail` on the Prepare build args step so a transient $GITHUB_OUTPUT write failure can't ship images without COMMIT_SHA/BRANCH baked in. - showcase_deploy.yml: `enforce-redeploy-gate` now also trips on a resolve-matrix failure (`needs.resolve-matrix.result == 'failure'`) so an upstream crash that leaves `redeploy_red` empty can't bypass the gate. - Doc-comment accuracy: drop stale `(PR #5093)` reference; correct the env-IDs source-of-truth comment; document the optional `skip_build` field in ALL_SERVICES; clarify that health_path is informational and verify uses per-service drivers; add the missing `resolve-targets` step 0 to the promote workflow's "Order:" header. Aggregator fix (RED-GREEN): - aggregate-build-results.ts: throw on zero slot dirs. The job is gated upstream on has_changes == 'true', so zero slot dirs is a broken artifact download, not a legitimate empty build set. Silently emitting any_success=false + results=[] is indistinguishable from "all builds failed" and lets the deploy workflow fall back to probing the full service set against stale `:latest`. Refuse the ambiguity. - aggregate-build-results.test.ts: existing empty-INPUT_DIR test was updated to assert the throw (was: return []). Oxlint rule (RED-GREEN): - no-public-env-shell-read.mjs: handle destructuring reads (const { NEXT_PUBLIC_X } = process.env and aliased form), template-literal computed keys (process.env[\`NEXT_PUBLIC_X\`]), and explicitly skip assignment-LHS / `delete` targets (writes are not reads). Optional chaining already worked through the existing MemberExpression path. Aliasing (`const e = process.env; e.X`) is intentionally documented as out of scope (needs scope tracking). Description sharpened to say the rule guards a specific banned-key set, not all NEXT_PUBLIC_* reads. - .oxlintrc.json: tighten the off-override glob from `showcase/**/*runtime-config*` to `showcase/**/lib/runtime-config*.{ts,tsx}` so it only silences the intended implementation files, not arbitrary paths containing that substring. - lint-rule-no-public-env.test.ts: rewritten as table-driven coverage of every BANNED_KEYS entry (dotted + bracket-string forms), every ALLOWED key (asserting non-firing), all new variants from the rule expansion, the assignment/delete non-fire cases, and override scoping (runtime-config exempt; packages exempt; shell-tree non-runtime-config flagged). Validation: - actionlint on all three workflows: 8 pre-existing findings (depot label, pre-existing SC2086 infos in untouched steps); my edits add zero. - python3 yaml.safe_load: all three workflows OK. - vitest aggregate-build-results.test.ts: 6/6 pass (incl. new throw test). - vitest lint-rule-no-public-env.test.ts: 34/34 pass. - vitest full showcase/scripts suite: 1654/1654 pass across 46 files. - ruby showcase/bin/spec/all_tests.rb: 87 runs, 0 failures. - Intersection jq proof (matrix a,b,c × success a,c) → "a,c"; all-failed → ""; skipped status excluded. |
||
|
Jordan Ritter
|
7ee7374a29 | ci(showcase): bridge staging redeploy summary into build workflow artifact | ||
|
Jordan Ritter
|
b7fae67f01 |
refactor(showcase): drop NEXT_PUBLIC_* build-args from CI and Dockerfiles
Implements plan-B B11. URL and analytics NEXT_PUBLIC_* values now reach each shell at runtime via Option B (env-driven runtime-config), so the GHA showcase_build.yml workflow no longer threads them through as Docker build-args and the shell-dashboard/shell-docs Dockerfiles no longer declare the matching ARG/ENV pairs. - showcase_build.yml: shell-dashboard and shell-docs matrix entries lose build_args_pb_url / build_args_shell_url / build_args_ops_url / build_args_base_url / build_args_analytics; the 'Prepare build args' step drops the corresponding env: keys and if-branches plus the five analytics NEXT_PUBLIC_* secrets. COMMIT_SHA and BRANCH stay — they identify the artifact. - showcase/shell-dashboard/Dockerfile: remove ARG/ENV for NEXT_PUBLIC_SHELL_URL, NEXT_PUBLIC_POCKETBASE_URL, OPS_BASE_URL plus the explanatory comments. Update the runner-stage comment to point at runtime-config.ts as the new source of truth. - showcase/shell-docs/Dockerfile: remove ARG/ENV for NEXT_PUBLIC_BASE_URL, NEXT_PUBLIC_SHELL_URL, NEXT_PUBLIC_POSTHOG_KEY, NEXT_PUBLIC_REB2B_KEY, NEXT_PUBLIC_SCARF_PIXEL_ID, NEXT_PUBLIC_REO_KEY, NEXT_PUBLIC_GOOGLE_ANALYTICS_TRACKING_ID. COMMIT_SHA / BRANCH retained. shell/Dockerfile and shell-dojo/Dockerfile already only declare commit-sha and branch ARGs — no changes needed there (per plan-B B11.4). |
||
|
Jordan Ritter
|
1a51fb1316 |
feat(showcase): add webhooks dispatch entry to build + verify workflows
Adds 'webhooks' as a workflow_dispatch choice in both showcase_build.yml
and showcase_deploy.yml so humans can redeploy/verify the webhooks service
on demand. webhooks' GHCR image (showcase-eval-webhook) is built by a
separate release workflow in the showcase-eval-webhook repo, so:
- paths-filter uses a sentinel that cannot match any in-tree path,
keeping push-driven runs from ever including webhooks.
- The build matrix entry carries skip_build: true; the Build and push
step skips the Depot build for that slot. The per-slot result still
publishes (job.status == success) so the redeploy path proceeds and
redeploy-env.ts picks the existing :latest from GHCR.
The SSOT entry in railway-envs.ts gains dispatchName: 'webhooks' so the
forward/reverse round-trip tests cover it. New tests pin that the SSOT
dispatchName is mirrored in both workflow files' dispatch choice lists
AND ALL_SERVICES JSON.
[BLITZ:L3-wf] E-6a/E-6b/E-6c/E-6d wiring.
|
||
|
Jordan Ritter
|
7e4754c06c |
fix(showcase): skip redeploy-staging when no build succeeded; alert #oss-alerts
redeploy-staging now also gates on aggregate-build-results.outputs.any_success == 'true'. When every slot fails, the previous behavior silently kicked a redeploy that just re-pulled the stale :latest and reported healthy. With this gate, the redeploy is suppressed and a sibling notify-all-builds-failed job marks the workflow red and posts to #oss-alerts so the all-broken state cannot hide behind a green run. The new notify-all-builds-failed job is distinct from the existing notify: job (which fires on any build-slot failure); both can fire and that overlap is intentional, per the Slack alert SOP. [BLITZ:L3-wf] E-5c wiring. |
||
|
Jordan Ritter
|
16790be1e6 |
refactor(showcase): replace job-name parsing with per-slot build-result artifacts
Build matrix slots now publish per-slot build-result-<dispatch_name>
artifacts containing {service, status}. A new aggregate-build-results
job downloads every per-slot artifact, merges them via the shared
mergeBuildResultFiles helper, and uploads the canonical build-results
artifact (results.json) for cross-workflow consumption.
The deploy workflow's resolve-matrix step now downloads build-results
via gh api .../artifacts/<id>/zip and filters its verification matrix
from the structured JSON success set. No more gh api .../jobs calls,
no more capture("^build \\(") regex on job names — those silently
break on job-name renames. The contract (service + status enum) is
enforced in one place: showcase/scripts/lib/build-outputs.ts.
[BLITZ:L3-wf] E-4e/E-4f wiring.
|
||
|
Jordan Ritter
|
5f92ea33df |
feat(showcase): retarget push-to-main redeploy from prod to staging
Push-to-main now redeploys staging only (never prod) via redeploy-env.ts in a dedicated redeploy-staging job, guarded to tolerate per-slot build failures but suppress on wholesale build skip/cancel. Prod stays promote-only. |
||
|
Tyler Slaton
|
cbeb6c8166 |
Merge remote-tracking branch 'origin/main' into tyler/showcase-fix-shelldocs-structure
# Conflicts: # showcase/shell-docs/src/app/[[...slug]]/page.tsx |
||
|
Tyler Slaton
|
37db1c8e5b | Fix shell-docs setup packaging and framework nav | ||
|
dependabot[bot]
|
f12cbc7acd |
chore(ci)(deps): bump the minor-and-patch group with 2 updates
Bumps the minor-and-patch group with 2 updates: [docker/login-action](https://github.com/docker/login-action) and [depot/build-push-action](https://github.com/depot/build-push-action). Updates `docker/login-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee) Updates `depot/build-push-action` from 1.17.0 to 1.18.0 - [Release notes](https://github.com/depot/build-push-action/releases) - [Commits](https://github.com/depot/build-push-action/compare/5f3b3c2e5a00f0093de47f657aeaefcedff27d18...98e78adca7817480b8185f474a400b451d74e287) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: depot/build-push-action dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Jordan Ritter
|
5d1949f532 |
chore(showcase): pin depot/build-push-action comment to v1.17.0
Zizmor's ref-version-mismatch audit flags the existing `# v1` comment because the hash 5f3b3c2e5a00f0093de47f657aeaefcedff27d18 is the v1.17.0 tag, not the v1 head. Update the trailing comment to match. No behavior change — the SHA pin is what governs which commit Actions fetches. This just keeps zizmor green so unrelated showcase-wiring PRs don't trip on a pre-existing pin annotation. |
||
|
Jordan Ritter
|
e248b0edfd |
chore(showcase): wire ms-agent-harness-dotnet for deployment
Brings the Microsoft Agent Harness (.NET) integration live on the showcase Railway project. Integration code itself landed in PR #4982. Changes: - Railway service `showcase-ms-agent-harness-dotnet` created (id 6343d7f9-6c3f-4c8d-9a6e-79f03d2f1e37) with the public domain showcase-ms-agent-harness-dotnet-production.up.railway.app, image source ghcr.io/copilotkit/showcase-ms-agent-harness-dotnet:latest, healthcheck /api/health, and env vars cloned from the sibling showcase-ms-agent-dotnet service. - .github/workflows/showcase_build.yml: add ms-agent-harness-dotnet to workflow_dispatch options, paths-filter, and the ALL_SERVICES matrix (mirroring the ms-agent-dotnet sibling entry). - showcase/integrations/ms-agent-harness-dotnet/manifest.yaml: flip deployed: false -> true so the dashboard surfaces the integration once the image is live. Skips test-and-check-packages pre-commit hook locally because @copilotkit/web-inspector:test has a pre-existing failure on main (window.localStorage.clear telemetry test setup) unrelated to these YAML-only changes. |
||
|
Jordan Ritter
|
1e657ae958 |
chore(ci)(deps): bump pnpm/action-setup from 4.3.0 to 6.0.8 (#4849)
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4.3.0 to 6.0.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's releases</a>.</em></p> <blockquote> <h2>v6.0.8</h2> <h2>What's Changed</h2> <ul> <li>docs(README): fix <code>cache_dependency_path</code> type by <a href="https://github.com/haines"><code>@haines</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/257">pnpm/action-setup#257</a></li> <li>fix: drop patchPnpmEnv so standalone+self-update works on Windows by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/258">pnpm/action-setup#258</a></li> <li>fix: update pnpm to 11.1.1 by <a href="https://github.com/mungodewar"><code>@mungodewar</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/248">pnpm/action-setup#248</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mungodewar"><code>@mungodewar</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/248">pnpm/action-setup#248</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8">https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8</a></p> <h2>v6.0.7</h2> <h2>What's Changed</h2> <ul> <li>fix: honor devEngines.packageManager.onFail=error (<a href="https://redirect.github.com/pnpm/action-setup/issues/252">#252</a>) by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/254">pnpm/action-setup#254</a></li> <li>fix: restore inputs from state in post by <a href="https://github.com/haines"><code>@haines</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/255">pnpm/action-setup#255</a></li> <li>fix: self-update bootstrap to packageManager-pinned version (<a href="https://redirect.github.com/pnpm/action-setup/issues/233">#233</a>) by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/256">pnpm/action-setup#256</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/haines"><code>@haines</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/255">pnpm/action-setup#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7">https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7</a></p> <h2>v6.0.6</h2> <h2>What's Changed</h2> <ul> <li>fix: bin_dest output points to self-updated pnpm, not bootstrap by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/249">pnpm/action-setup#249</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6">https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6</a></p> <h2>v6.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: append (not prepend) action node dir to PATH for npm bootstrap by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/241">pnpm/action-setup#241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5">https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5</a></p> <h2>v6.0.4</h2> <h2>What's Changed</h2> <ul> <li>fix: use npm co-located with the action node binary by <a href="https://github.com/benquarmby"><code>@benquarmby</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/239">pnpm/action-setup#239</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/benquarmby"><code>@benquarmby</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/239">pnpm/action-setup#239</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4">https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4</a></p> <h2>v6.0.3</h2> <p>Updated pnpm to v11.0.0-rc.5</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3">https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pnpm/action-setup/commit/0e279bb959325dab635dd2c09392533439d90093"><code>0e279bb</code></a> fix: update pnpm to 11.1.1 (<a href="https://redirect.github.com/pnpm/action-setup/issues/248">#248</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/3e835812ef01165f4f8ae08ade56da44427ed4e0"><code>3e83581</code></a> fix: drop patchPnpmEnv so standalone+self-update works on Windows (<a href="https://redirect.github.com/pnpm/action-setup/issues/258">#258</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/551b42e879e37e74d986effdd2a1647d2b02d464"><code>551b42e</code></a> docs(README): fix <code>cache_dependency_path</code> type (<a href="https://redirect.github.com/pnpm/action-setup/issues/257">#257</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/739bfe42ca9233c5e6aca07c1a25a9d34aca49b0"><code>739bfe4</code></a> fix: self-update bootstrap to packageManager-pinned version (<a href="https://redirect.github.com/pnpm/action-setup/issues/233">#233</a>) (<a href="https://redirect.github.com/pnpm/action-setup/issues/256">#256</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/f61705d907761b3b5209e83910fafd1fea50c5a1"><code>f61705d</code></a> chore: add CODEOWNERS</li> <li><a href="https://github.com/pnpm/action-setup/commit/7a5507b117647ab83e96e9db317ba2234056ebf3"><code>7a5507b</code></a> fix: restore inputs from state in post (<a href="https://redirect.github.com/pnpm/action-setup/issues/255">#255</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/1155470f3e5fb872accd4d104b8dfcda41f676ce"><code>1155470</code></a> fix: honor devEngines.packageManager.onFail=error (<a href="https://redirect.github.com/pnpm/action-setup/issues/252">#252</a>) (<a href="https://redirect.github.com/pnpm/action-setup/issues/254">#254</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/91ab88e2619ed1f46221f0ba42d1492c02baf788"><code>91ab88e</code></a> fix: bin_dest output points to self-updated pnpm, not bootstrap (<a href="https://redirect.github.com/pnpm/action-setup/issues/249">#249</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/e578e19d19d31b011b841ba2aca34731a5f706a5"><code>e578e19</code></a> fix: update pnpm to 11.0.4</li> <li><a href="https://github.com/pnpm/action-setup/commit/8912a9102ac27614460f54aedde9e1e7f9aec20d"><code>8912a91</code></a> fix: append (not prepend) action node dir to PATH for npm bootstrap (<a href="https://redirect.github.com/pnpm/action-setup/issues/241">#241</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pnpm/action-setup/compare/v4.3.0...0e279bb959325dab635dd2c09392533439d90093">compare view</a></li> </ul> </details> <br /> |
||
|
dependabot[bot]
|
2a6c966ab9 |
chore(ci)(deps): bump pnpm/action-setup from 4.3.0 to 6.0.8
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4.3.0 to 6.0.8. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v4.3.0...0e279bb959325dab635dd2c09392533439d90093) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Jordan Ritter
|
332cfc6674 |
chore(ci)(deps): bump dorny/paths-filter from 3.0.3 to 4.0.1 (#4850)
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.3 to 4.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <h2>What's Changed</h2> <ul> <li>Support merge queue by <a href="https://github.com/masaru-iritani"><code>@masaru-iritani</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/masaru-iritani"><code>@masaru-iritani</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1">https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <h2>What's Changed</h2> <ul> <li>feat: update action runtime to node24 by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/saschabratton"><code>@saschabratton</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0">https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix getLocalRef() returns wrong ref</a></li> </ul> <h2>v2.10.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve robustness of change detection</a></li> </ul> <h2>v2.10.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add ref input parameter</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix change detection in PR when pullRequest.changed_files is incorrect</a></li> </ul> <h2>v2.9.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix change detection when base is a tag</a></li> </ul> <h2>v2.9.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/75">Fix fetching git history</a></li> </ul> <h2>v2.9.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/74">Fix fetching git history + fallback to unshallow repo</a></li> </ul> <h2>v2.9.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/fbd0ab8f3e69293af611ebaee6363fc25e6d187d"><code>fbd0ab8</code></a> feat: add merge_group event support</li> <li><a href="https://github.com/dorny/paths-filter/commit/efb1da7ce8d89bbc261191e5a2dc1453c3837339"><code>efb1da7</code></a> feat: add dist/ freshness check to PR workflow</li> <li><a href="https://github.com/dorny/paths-filter/commit/d8f7b061b24c30a325ff314b76c37adb05b041ce"><code>d8f7b06</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/302">#302</a> from dorny/issue-299</li> <li><a href="https://github.com/dorny/paths-filter/commit/addbc147a95845176e1bc013a012fbf1d366389a"><code>addbc14</code></a> Update README for v4</li> <li><a href="https://github.com/dorny/paths-filter/commit/9d7afb8d214ad99e78fbd4247752c4caed2b6e4c"><code>9d7afb8</code></a> Update CHANGELOG for v4.0.0</li> <li><a href="https://github.com/dorny/paths-filter/commit/782470c5d953cae2693d643172b14e01bacb71f3"><code>782470c</code></a> Merge branch 'releases/v3'</li> <li><a href="https://github.com/dorny/paths-filter/commit/ce10459c8b92cd8901166c0a222fbb033ef39365"><code>ce10459</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/294">#294</a> from saschabratton/master</li> <li><a href="https://github.com/dorny/paths-filter/commit/5f40380c5482e806c81cec080f5192e7234d8fe9"><code>5f40380</code></a> feat: update action runtime to node24</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/d1c1ffe0248fe513906c8e24db8ea791d46f8590...fbd0ab8f3e69293af611ebaee6363fc25e6d187d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> |
||
|
Jordan Ritter
|
c18031d986 |
chore(ci)(deps): bump docker/login-action from 3.7.0 to 4.1.0 (#4852)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <ul> <li>Fix scoped Docker Hub cleanup path when registry is omitted by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1020.0 in <a href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in <a href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a> <a href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li> <li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 in <a href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p> <h2>v4.0.0</h2> <ul> <li>Node 24 as default runtime (requires <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Actions Runner v2.327.1</a> or later) by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/929">docker/login-action#929</a></li> <li>Switch to ESM and update config/test wiring by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/927">docker/login-action#927</a></li> <li>Bump <code>@actions/core</code> from 1.11.1 to 3.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/919">docker/login-action#919</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@aws-sdk/client-ecr-public</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.63.0 to 0.77.0 in <a href="https://redirect.github.com/docker/login-action/pull/910">docker/login-action#910</a> <a href="https://redirect.github.com/docker/login-action/pull/928">docker/login-action#928</a></li> <li>Bump <code>@isaacs/brace-expansion</code> from 5.0.0 to 5.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/921">docker/login-action#921</a></li> <li>Bump js-yaml from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/901">docker/login-action#901</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v3.7.0...v4.0.0">https://github.com/docker/login-action/compare/v3.7.0...v4.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/4907a6ddec9925e35a0a9e82d7399ccc52663121"><code>4907a6d</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/930">#930</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li> <li><a href="https://github.com/docker/login-action/commit/1e233e691a8881d7f35ca7c2d5dfaaed80b39636"><code>1e233e6</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/6c24ead68057f18c30c808a431f0b85dc25663cb"><code>6c24ead</code></a> build(deps): bump the aws-sdk-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/ee034d70944e3546349cd24295914f139342f1e6"><code>ee034d7</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/958">#958</a> from docker/dependabot/npm_and_yarn/lodash-4.18.1</li> <li><a href="https://github.com/docker/login-action/commit/1527209db9734bd2352a2dc1a63d79c9aa5358bb"><code>1527209</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/937">#937</a> from docker/dependabot/npm_and_yarn/proxy-agent-depen...</li> <li><a href="https://github.com/docker/login-action/commit/d39362aba4d72f8d9d93e0962119840690133e1b"><code>d39362a</code></a> build(deps): bump lodash from 4.17.23 to 4.18.1</li> <li><a href="https://github.com/docker/login-action/commit/a6f092b568105cbb6d9deb7e55e0a4c5c1025fce"><code>a6f092b</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/60953f0bed2120ec69659d271fe18d34bc069779"><code>60953f0</code></a> build(deps): bump the proxy-agent-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/62c688590fb4ab6c6e89a217ced0a7b2ddcf1340"><code>62c6885</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/936">#936</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/login-action/commit/102c0e672992d2e992c89b6f4808d65a353b5a1a"><code>102c0e6</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...4907a6ddec9925e35a0a9e82d7399ccc52663121">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> |
||
|
dependabot[bot]
|
1b0adb5675 |
chore(ci)(deps): bump actions/setup-node from 4.4.0 to 6.4.0
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
66467b7668 |
chore(ci)(deps): bump docker/login-action from 3.7.0 to 4.1.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...4907a6ddec9925e35a0a9e82d7399ccc52663121) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
a4268a37db |
chore(ci)(deps): bump dorny/paths-filter from 3.0.3 to 4.0.1
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.3 to 4.0.1. - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/d1c1ffe0248fe513906c8e24db8ea791d46f8590...fbd0ab8f3e69293af611ebaee6363fc25e6d187d) --- updated-dependencies: - dependency-name: dorny/paths-filter dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Alem Tuzlak
|
edf10769ac |
chore(ci): pin actions to SHA, add zizmor + dependabot, tighten permissions
Comprehensive CI/CD security hardening pass over all 33 workflows. Action pinning - Every `uses:` is now pinned to a 40-char commit SHA with a `# vX.Y.Z` comment alongside (167 occurrences resolved). Tag-style refs like `@v4` are mutable and have been used in past supply-chain attacks (e.g. tj-actions/changed-files in March 2025) to repoint widely-used actions to malicious commits. - Removed redundant `version: "10.13.1"` hardcodes from `pnpm/action-setup` call sites so the action inherits from package.json `packageManager` (one source of truth). Automated maintenance - Added `.github/dependabot.yml` for the `github-actions` ecosystem so SHA pins stay current. Without this, pins go stale fast and new upstream advisories never reach us. Minor/patch bumps are grouped; major bumps stay separate so they get a real review. Static analysis - Added `.github/zizmor.yml` configuration and `.github/workflows/security_zizmor.yml` (blocking on PR, runs on push to main, weekly schedule for advisory drift). zizmor catches the well-known classes of Actions footguns: template injection from untrusted input, dangerous triggers, unpinned uses, excessive token scopes, secret exfil patterns. - All 28 high-severity and 54 medium-severity findings from the baseline scan are remediated. Each suppression in zizmor.yml carries a per-finding justification comment so future maintainers can audit the trust assumption. Workflow hardening (from zizmor + manual audit) - Added `persist-credentials: false` to every `actions/checkout` except the 7 workflows that legitimately push back to the repo via the workflow token (release tagging, auto-formatting, docs-sync, registry updates). Each retained credential persistence carries a `persist-credentials required: ...` comment explaining the call site. - Routed every attacker-controllable expansion (`github.head_ref`, `github.event.pull_request.head.repo.full_name`, `inputs.*`, step outputs) through `env:` and referenced as quoted shell variables. Eliminates 17 template-injection vectors in fork-PR-reachable workflows. - Added per-job `permissions:` blocks across 14 workflows; demoted broad workflow-level `id-token: write` to the specific Depot-runner jobs that need it; narrowed `pull-requests: write` / `actions: write` to the jobs that actually call those APIs. Audit-driven fixes - `publish-release.yml` build job: dropped `token:` and added `persist-credentials: false`. The subsequent `Upload workspace` step was packing `.git/config` (with the persisted GITHUB_TOKEN) into a 1-day-retention artifact downloadable by anyone with `actions:read`. - `auto_merge_showcases.yml`: team-membership check now authorizes on the PR AUTHOR (`pull_request.user.login`), never `context.actor` — the actor is whoever triggered the latest event, so a team member synchronizing or reopening an outsider's PR would otherwise green-light auto-merge of code they didn't author. - `static_quality.yml`: pinned ruff to a specific version so a compromised release can't land on the next PR run with the persisted-credentials write token in the format job. - `showcase_capture-previews.yml`: switched the args-string construction to a bash array so a slug or demo value containing whitespace or shell metacharacters stays a single argument rather than being re-tokenized by the shell. |
||
|
Jordan Ritter
|
18c8acb90d |
ci(shell-docs): pipe client-side analytics keys through Docker build (#4786)
## Summary Client-side telemetry on `docs.showcase.copilotkit.ai` was silent. The shell-docs Dockerfile and `showcase_build.yml` workflow never plumbed the `NEXT_PUBLIC_*` analytics keys through to `next build`, so the client JS chunks shipped with empty strings (verified by grepping the live bundle: `let l = i(95704).env.NEXT_PUBLIC_POSTHOG_KEY` — a runtime lookup with no inlined value). Railway runtime env doesn't reach the Docker build phase, so server-side reads (middleware `POSTHOG_KEY`, server-component canonical URLs) worked but client-side reads (posthog-js init, RB2B, Scarf, Reo, GA) silently no-op'd in the browser. ## Changes - **`showcase/shell-docs/Dockerfile`** — declare `ARG` + `ENV` for `NEXT_PUBLIC_POSTHOG_KEY`, `NEXT_PUBLIC_RB2B_ID`, `NEXT_PUBLIC_SCARF_PIXEL_ID`, `NEXT_PUBLIC_REO_KEY`, `NEXT_PUBLIC_GOOGLE_ANALYTICS_TRACKING_ID` in the builder stage so they reach `next build`. - **`.github/workflows/showcase_build.yml`** — add `build_args_analytics: "yes"` flag to the shell-docs matrix entry; extend the `Prepare build args` step to emit the five `NEXT_PUBLIC_*` `--build-arg`s when the flag is set, sourcing values from repo secrets. Mirrors the existing shell-dashboard pattern (`build_args_pb_url` / `build_args_shell_url` / `build_args_ops_url`). ## Secrets Existing repo secret reused: `POSTHOG_PROJECT_KEY`. New repo secrets required (configured separately in repo settings before this lands): - `RB2B_ID` - `SCARF_PIXEL_ID` - `REO_PROJECT_KEY` - `GOOGLE_ANALYTICS_TRACKING_ID` ## Out of scope (intentionally) - `NEXT_PUBLIC_BASE_URL` is already correctly working via Railway runtime env (canonical links render with `https://docs.copilotkit.ai`) — left alone. - Server-side `POSTHOG_KEY` (no `NEXT_PUBLIC_` prefix) stays on Railway runtime env; middleware reads it at Edge Runtime. ## Test plan - [ ] Next build of shell-docs succeeds with new ARGs in scope - [ ] After deploy, search the live bundle on `docs.showcase.copilotkit.ai` for the literal `phc_` prefix — must be present (not `process.env.NEXT_PUBLIC_POSTHOG_KEY` runtime lookup) - [ ] PostHog Live Events shows `$pageview` (client) and `$autocapture` arriving from staging - [ ] RB2B / Scarf / Reo / GA dashboards show events from staging - [ ] Server-side `seo_redirect` + `docs_pageview` continue firing (no regression) |
||
|
Sam Julien
|
f4e3ee6951 |
fix(shell-docs): correct REB2B var name (was RB2B_ID, code reads REB2B_KEY)
The previous commit used `NEXT_PUBLIC_RB2B_ID` based on a stale entry in the cutover plan doc, but `app/layout.tsx:86` reads `NEXT_PUBLIC_REB2B_KEY`. Without this fix the build-arg would be piped under the wrong name and the REB2B Script tag would still not render. |
||
|
Sam Julien
|
6eba49c26b |
ci(shell-docs): pipe client-side analytics keys through Docker build
Client-side telemetry on docs.showcase.copilotkit.ai was silent: the shell-docs Dockerfile and Showcase Build & Push workflow never plumbed NEXT_PUBLIC_POSTHOG_KEY / RB2B_ID / SCARF_PIXEL_ID / REO_KEY / GOOGLE_ANALYTICS_TRACKING_ID through to `next build`. Railway runtime env doesn't reach the Docker build phase, so the client JS chunks shipped with empty strings — posthog-js.init etc. silently no-op'd in the browser. Mirrors the shell-dashboard pattern: matrix flag triggers the args block; values come from repo secrets (POSTHOG_PROJECT_KEY already existed; RB2B_ID, SCARF_PIXEL_ID, REO_PROJECT_KEY, GOOGLE_ANALYTICS_TRACKING_ID added separately in repo settings). Server-side telemetry (middleware seo_redirect, docs_pageview) was unaffected — it reads POSTHOG_KEY at Edge Runtime, which Railway runtime env satisfies. |
||
|
Jordan Ritter
|
4964d695ce |
feat(ci): add Slack + PR comment notification on showcase build failure
Posts to #oss-alerts and comments on the originating PR with failure details so the merge author knows their change broke the Docker build. |
||
|
Jordan Ritter
|
ff2eb9c84b |
fix(ci): restore Railway deploy trigger in showcase build workflow
The decoupled build workflow (PR #4471) removed the Railway deploy trigger, assuming environmentPatchCommit auto-update would handle deploys. Not all services have auto-update configured, so GHCR images were pushed but Railway never pulled them. Restore the explicit serviceInstanceRedeploy call after each GHCR push. |
||
|
Jordan Ritter
|
0b44960db8 |
Decouple showcase build and deploy into separate workflows
The old "Showcase: Build & Deploy" workflow used a single concurrency group
that cancelled in-flight builds on every push to main. When multiple PRs
merged in quick succession, most service builds got cancelled and never
deployed.
Split into two workflows:
1. showcase_build.yml ("Showcase: Build & Push") - triggered on push to main,
builds Docker images and pushes to GHCR. Has NO concurrency group so every
run completes. Railway auto-update picks up the new :latest tag.
2. showcase_deploy.yml ("Showcase: Verify Deploy") - triggered by workflow_run
from the build workflow. Polls Railway to verify each service picked up the
new image and is healthy. Uses cancel-in-progress since verification is
idempotent. Posts results to showcase-harness via webhook.
Also updates showcase_capture-previews.yml to trigger from the renamed build
workflow.
|