mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
fix/onboarding-example-copilotkit-versions
71 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jordan Ritter
|
16790be1e6 |
refactor(showcase): replace job-name parsing with per-slot build-result artifacts
Build matrix slots now publish per-slot build-result-<dispatch_name>
artifacts containing {service, status}. A new aggregate-build-results
job downloads every per-slot artifact, merges them via the shared
mergeBuildResultFiles helper, and uploads the canonical build-results
artifact (results.json) for cross-workflow consumption.
The deploy workflow's resolve-matrix step now downloads build-results
via gh api .../artifacts/<id>/zip and filters its verification matrix
from the structured JSON success set. No more gh api .../jobs calls,
no more capture("^build \\(") regex on job names — those silently
break on job-name renames. The contract (service + status enum) is
enforced in one place: showcase/scripts/lib/build-outputs.ts.
[BLITZ:L3-wf] E-4e/E-4f wiring.
|
||
|
Jordan Ritter
|
5f92ea33df |
feat(showcase): retarget push-to-main redeploy from prod to staging
Push-to-main now redeploys staging only (never prod) via redeploy-env.ts in a dedicated redeploy-staging job, guarded to tolerate per-slot build failures but suppress on wholesale build skip/cancel. Prod stays promote-only. |
||
|
Tyler Slaton
|
cbeb6c8166 |
Merge remote-tracking branch 'origin/main' into tyler/showcase-fix-shelldocs-structure
# Conflicts: # showcase/shell-docs/src/app/[[...slug]]/page.tsx |
||
|
Tyler Slaton
|
37db1c8e5b | Fix shell-docs setup packaging and framework nav | ||
|
dependabot[bot]
|
f12cbc7acd |
chore(ci)(deps): bump the minor-and-patch group with 2 updates
Bumps the minor-and-patch group with 2 updates: [docker/login-action](https://github.com/docker/login-action) and [depot/build-push-action](https://github.com/depot/build-push-action). Updates `docker/login-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee) Updates `depot/build-push-action` from 1.17.0 to 1.18.0 - [Release notes](https://github.com/depot/build-push-action/releases) - [Commits](https://github.com/depot/build-push-action/compare/5f3b3c2e5a00f0093de47f657aeaefcedff27d18...98e78adca7817480b8185f474a400b451d74e287) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: depot/build-push-action dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Jordan Ritter
|
5d1949f532 |
chore(showcase): pin depot/build-push-action comment to v1.17.0
Zizmor's ref-version-mismatch audit flags the existing `# v1` comment because the hash 5f3b3c2e5a00f0093de47f657aeaefcedff27d18 is the v1.17.0 tag, not the v1 head. Update the trailing comment to match. No behavior change — the SHA pin is what governs which commit Actions fetches. This just keeps zizmor green so unrelated showcase-wiring PRs don't trip on a pre-existing pin annotation. |
||
|
Jordan Ritter
|
e248b0edfd |
chore(showcase): wire ms-agent-harness-dotnet for deployment
Brings the Microsoft Agent Harness (.NET) integration live on the showcase Railway project. Integration code itself landed in PR #4982. Changes: - Railway service `showcase-ms-agent-harness-dotnet` created (id 6343d7f9-6c3f-4c8d-9a6e-79f03d2f1e37) with the public domain showcase-ms-agent-harness-dotnet-production.up.railway.app, image source ghcr.io/copilotkit/showcase-ms-agent-harness-dotnet:latest, healthcheck /api/health, and env vars cloned from the sibling showcase-ms-agent-dotnet service. - .github/workflows/showcase_build.yml: add ms-agent-harness-dotnet to workflow_dispatch options, paths-filter, and the ALL_SERVICES matrix (mirroring the ms-agent-dotnet sibling entry). - showcase/integrations/ms-agent-harness-dotnet/manifest.yaml: flip deployed: false -> true so the dashboard surfaces the integration once the image is live. Skips test-and-check-packages pre-commit hook locally because @copilotkit/web-inspector:test has a pre-existing failure on main (window.localStorage.clear telemetry test setup) unrelated to these YAML-only changes. |
||
|
Jordan Ritter
|
1e657ae958 |
chore(ci)(deps): bump pnpm/action-setup from 4.3.0 to 6.0.8 (#4849)
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4.3.0 to 6.0.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pnpm/action-setup/releases">pnpm/action-setup's releases</a>.</em></p> <blockquote> <h2>v6.0.8</h2> <h2>What's Changed</h2> <ul> <li>docs(README): fix <code>cache_dependency_path</code> type by <a href="https://github.com/haines"><code>@haines</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/257">pnpm/action-setup#257</a></li> <li>fix: drop patchPnpmEnv so standalone+self-update works on Windows by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/258">pnpm/action-setup#258</a></li> <li>fix: update pnpm to 11.1.1 by <a href="https://github.com/mungodewar"><code>@mungodewar</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/248">pnpm/action-setup#248</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mungodewar"><code>@mungodewar</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/248">pnpm/action-setup#248</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8">https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8</a></p> <h2>v6.0.7</h2> <h2>What's Changed</h2> <ul> <li>fix: honor devEngines.packageManager.onFail=error (<a href="https://redirect.github.com/pnpm/action-setup/issues/252">#252</a>) by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/254">pnpm/action-setup#254</a></li> <li>fix: restore inputs from state in post by <a href="https://github.com/haines"><code>@haines</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/255">pnpm/action-setup#255</a></li> <li>fix: self-update bootstrap to packageManager-pinned version (<a href="https://redirect.github.com/pnpm/action-setup/issues/233">#233</a>) by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/256">pnpm/action-setup#256</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/haines"><code>@haines</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/255">pnpm/action-setup#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7">https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7</a></p> <h2>v6.0.6</h2> <h2>What's Changed</h2> <ul> <li>fix: bin_dest output points to self-updated pnpm, not bootstrap by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/249">pnpm/action-setup#249</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6">https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6</a></p> <h2>v6.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: append (not prepend) action node dir to PATH for npm bootstrap by <a href="https://github.com/zkochan"><code>@zkochan</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/241">pnpm/action-setup#241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5">https://github.com/pnpm/action-setup/compare/v6.0.4...v6.0.5</a></p> <h2>v6.0.4</h2> <h2>What's Changed</h2> <ul> <li>fix: use npm co-located with the action node binary by <a href="https://github.com/benquarmby"><code>@benquarmby</code></a> in <a href="https://redirect.github.com/pnpm/action-setup/pull/239">pnpm/action-setup#239</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/benquarmby"><code>@benquarmby</code></a> made their first contribution in <a href="https://redirect.github.com/pnpm/action-setup/pull/239">pnpm/action-setup#239</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4">https://github.com/pnpm/action-setup/compare/v6.0.3...v6.0.4</a></p> <h2>v6.0.3</h2> <p>Updated pnpm to v11.0.0-rc.5</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3">https://github.com/pnpm/action-setup/compare/v6.0.2...v6.0.3</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pnpm/action-setup/commit/0e279bb959325dab635dd2c09392533439d90093"><code>0e279bb</code></a> fix: update pnpm to 11.1.1 (<a href="https://redirect.github.com/pnpm/action-setup/issues/248">#248</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/3e835812ef01165f4f8ae08ade56da44427ed4e0"><code>3e83581</code></a> fix: drop patchPnpmEnv so standalone+self-update works on Windows (<a href="https://redirect.github.com/pnpm/action-setup/issues/258">#258</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/551b42e879e37e74d986effdd2a1647d2b02d464"><code>551b42e</code></a> docs(README): fix <code>cache_dependency_path</code> type (<a href="https://redirect.github.com/pnpm/action-setup/issues/257">#257</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/739bfe42ca9233c5e6aca07c1a25a9d34aca49b0"><code>739bfe4</code></a> fix: self-update bootstrap to packageManager-pinned version (<a href="https://redirect.github.com/pnpm/action-setup/issues/233">#233</a>) (<a href="https://redirect.github.com/pnpm/action-setup/issues/256">#256</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/f61705d907761b3b5209e83910fafd1fea50c5a1"><code>f61705d</code></a> chore: add CODEOWNERS</li> <li><a href="https://github.com/pnpm/action-setup/commit/7a5507b117647ab83e96e9db317ba2234056ebf3"><code>7a5507b</code></a> fix: restore inputs from state in post (<a href="https://redirect.github.com/pnpm/action-setup/issues/255">#255</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/1155470f3e5fb872accd4d104b8dfcda41f676ce"><code>1155470</code></a> fix: honor devEngines.packageManager.onFail=error (<a href="https://redirect.github.com/pnpm/action-setup/issues/252">#252</a>) (<a href="https://redirect.github.com/pnpm/action-setup/issues/254">#254</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/91ab88e2619ed1f46221f0ba42d1492c02baf788"><code>91ab88e</code></a> fix: bin_dest output points to self-updated pnpm, not bootstrap (<a href="https://redirect.github.com/pnpm/action-setup/issues/249">#249</a>)</li> <li><a href="https://github.com/pnpm/action-setup/commit/e578e19d19d31b011b841ba2aca34731a5f706a5"><code>e578e19</code></a> fix: update pnpm to 11.0.4</li> <li><a href="https://github.com/pnpm/action-setup/commit/8912a9102ac27614460f54aedde9e1e7f9aec20d"><code>8912a91</code></a> fix: append (not prepend) action node dir to PATH for npm bootstrap (<a href="https://redirect.github.com/pnpm/action-setup/issues/241">#241</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pnpm/action-setup/compare/v4.3.0...0e279bb959325dab635dd2c09392533439d90093">compare view</a></li> </ul> </details> <br /> |
||
|
dependabot[bot]
|
2a6c966ab9 |
chore(ci)(deps): bump pnpm/action-setup from 4.3.0 to 6.0.8
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4.3.0 to 6.0.8. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v4.3.0...0e279bb959325dab635dd2c09392533439d90093) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Jordan Ritter
|
332cfc6674 |
chore(ci)(deps): bump dorny/paths-filter from 3.0.3 to 4.0.1 (#4850)
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.3 to 4.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.1</h2> <h2>What's Changed</h2> <ul> <li>Support merge queue by <a href="https://github.com/masaru-iritani"><code>@masaru-iritani</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/masaru-iritani"><code>@masaru-iritani</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/255">dorny/paths-filter#255</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1">https://github.com/dorny/paths-filter/compare/v4.0.0...v4.0.1</a></p> <h2>v4.0.0</h2> <h2>What's Changed</h2> <ul> <li>feat: update action runtime to node24 by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/saschabratton"><code>@saschabratton</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/294">dorny/paths-filter#294</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0">https://github.com/dorny/paths-filter/compare/v3.0.3...v4.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/91">Fix getLocalRef() returns wrong ref</a></li> </ul> <h2>v2.10.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/85">Improve robustness of change detection</a></li> </ul> <h2>v2.10.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/82">Add ref input parameter</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/83">Fix change detection in PR when pullRequest.changed_files is incorrect</a></li> </ul> <h2>v2.9.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/78">Fix change detection when base is a tag</a></li> </ul> <h2>v2.9.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/75">Fix fetching git history</a></li> </ul> <h2>v2.9.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/74">Fix fetching git history + fallback to unshallow repo</a></li> </ul> <h2>v2.9.0</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/fbd0ab8f3e69293af611ebaee6363fc25e6d187d"><code>fbd0ab8</code></a> feat: add merge_group event support</li> <li><a href="https://github.com/dorny/paths-filter/commit/efb1da7ce8d89bbc261191e5a2dc1453c3837339"><code>efb1da7</code></a> feat: add dist/ freshness check to PR workflow</li> <li><a href="https://github.com/dorny/paths-filter/commit/d8f7b061b24c30a325ff314b76c37adb05b041ce"><code>d8f7b06</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/302">#302</a> from dorny/issue-299</li> <li><a href="https://github.com/dorny/paths-filter/commit/addbc147a95845176e1bc013a012fbf1d366389a"><code>addbc14</code></a> Update README for v4</li> <li><a href="https://github.com/dorny/paths-filter/commit/9d7afb8d214ad99e78fbd4247752c4caed2b6e4c"><code>9d7afb8</code></a> Update CHANGELOG for v4.0.0</li> <li><a href="https://github.com/dorny/paths-filter/commit/782470c5d953cae2693d643172b14e01bacb71f3"><code>782470c</code></a> Merge branch 'releases/v3'</li> <li><a href="https://github.com/dorny/paths-filter/commit/ce10459c8b92cd8901166c0a222fbb033ef39365"><code>ce10459</code></a> Merge pull request <a href="https://redirect.github.com/dorny/paths-filter/issues/294">#294</a> from saschabratton/master</li> <li><a href="https://github.com/dorny/paths-filter/commit/5f40380c5482e806c81cec080f5192e7234d8fe9"><code>5f40380</code></a> feat: update action runtime to node24</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/d1c1ffe0248fe513906c8e24db8ea791d46f8590...fbd0ab8f3e69293af611ebaee6363fc25e6d187d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> |
||
|
Jordan Ritter
|
c18031d986 |
chore(ci)(deps): bump docker/login-action from 3.7.0 to 4.1.0 (#4852)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <ul> <li>Fix scoped Docker Hub cleanup path when registry is omitted by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1020.0 in <a href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in <a href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a> <a href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li> <li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 in <a href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p> <h2>v4.0.0</h2> <ul> <li>Node 24 as default runtime (requires <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Actions Runner v2.327.1</a> or later) by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/929">docker/login-action#929</a></li> <li>Switch to ESM and update config/test wiring by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/927">docker/login-action#927</a></li> <li>Bump <code>@actions/core</code> from 1.11.1 to 3.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/919">docker/login-action#919</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@aws-sdk/client-ecr-public</code> from 3.890.0 to 3.1000.0 in <a href="https://redirect.github.com/docker/login-action/pull/909">docker/login-action#909</a> <a href="https://redirect.github.com/docker/login-action/pull/920">docker/login-action#920</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.63.0 to 0.77.0 in <a href="https://redirect.github.com/docker/login-action/pull/910">docker/login-action#910</a> <a href="https://redirect.github.com/docker/login-action/pull/928">docker/login-action#928</a></li> <li>Bump <code>@isaacs/brace-expansion</code> from 5.0.0 to 5.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/921">docker/login-action#921</a></li> <li>Bump js-yaml from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/login-action/pull/901">docker/login-action#901</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v3.7.0...v4.0.0">https://github.com/docker/login-action/compare/v3.7.0...v4.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/4907a6ddec9925e35a0a9e82d7399ccc52663121"><code>4907a6d</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/930">#930</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...</li> <li><a href="https://github.com/docker/login-action/commit/1e233e691a8881d7f35ca7c2d5dfaaed80b39636"><code>1e233e6</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/6c24ead68057f18c30c808a431f0b85dc25663cb"><code>6c24ead</code></a> build(deps): bump the aws-sdk-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/ee034d70944e3546349cd24295914f139342f1e6"><code>ee034d7</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/958">#958</a> from docker/dependabot/npm_and_yarn/lodash-4.18.1</li> <li><a href="https://github.com/docker/login-action/commit/1527209db9734bd2352a2dc1a63d79c9aa5358bb"><code>1527209</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/937">#937</a> from docker/dependabot/npm_and_yarn/proxy-agent-depen...</li> <li><a href="https://github.com/docker/login-action/commit/d39362aba4d72f8d9d93e0962119840690133e1b"><code>d39362a</code></a> build(deps): bump lodash from 4.17.23 to 4.18.1</li> <li><a href="https://github.com/docker/login-action/commit/a6f092b568105cbb6d9deb7e55e0a4c5c1025fce"><code>a6f092b</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/60953f0bed2120ec69659d271fe18d34bc069779"><code>60953f0</code></a> build(deps): bump the proxy-agent-dependencies group with 2 updates</li> <li><a href="https://github.com/docker/login-action/commit/62c688590fb4ab6c6e89a217ced0a7b2ddcf1340"><code>62c6885</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/936">#936</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/login-action/commit/102c0e672992d2e992c89b6f4808d65a353b5a1a"><code>102c0e6</code></a> chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...4907a6ddec9925e35a0a9e82d7399ccc52663121">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> |
||
|
dependabot[bot]
|
1b0adb5675 |
chore(ci)(deps): bump actions/setup-node from 4.4.0 to 6.4.0
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
66467b7668 |
chore(ci)(deps): bump docker/login-action from 3.7.0 to 4.1.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...4907a6ddec9925e35a0a9e82d7399ccc52663121) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
a4268a37db |
chore(ci)(deps): bump dorny/paths-filter from 3.0.3 to 4.0.1
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.3 to 4.0.1. - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](https://github.com/dorny/paths-filter/compare/d1c1ffe0248fe513906c8e24db8ea791d46f8590...fbd0ab8f3e69293af611ebaee6363fc25e6d187d) --- updated-dependencies: - dependency-name: dorny/paths-filter dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Alem Tuzlak
|
edf10769ac |
chore(ci): pin actions to SHA, add zizmor + dependabot, tighten permissions
Comprehensive CI/CD security hardening pass over all 33 workflows. Action pinning - Every `uses:` is now pinned to a 40-char commit SHA with a `# vX.Y.Z` comment alongside (167 occurrences resolved). Tag-style refs like `@v4` are mutable and have been used in past supply-chain attacks (e.g. tj-actions/changed-files in March 2025) to repoint widely-used actions to malicious commits. - Removed redundant `version: "10.13.1"` hardcodes from `pnpm/action-setup` call sites so the action inherits from package.json `packageManager` (one source of truth). Automated maintenance - Added `.github/dependabot.yml` for the `github-actions` ecosystem so SHA pins stay current. Without this, pins go stale fast and new upstream advisories never reach us. Minor/patch bumps are grouped; major bumps stay separate so they get a real review. Static analysis - Added `.github/zizmor.yml` configuration and `.github/workflows/security_zizmor.yml` (blocking on PR, runs on push to main, weekly schedule for advisory drift). zizmor catches the well-known classes of Actions footguns: template injection from untrusted input, dangerous triggers, unpinned uses, excessive token scopes, secret exfil patterns. - All 28 high-severity and 54 medium-severity findings from the baseline scan are remediated. Each suppression in zizmor.yml carries a per-finding justification comment so future maintainers can audit the trust assumption. Workflow hardening (from zizmor + manual audit) - Added `persist-credentials: false` to every `actions/checkout` except the 7 workflows that legitimately push back to the repo via the workflow token (release tagging, auto-formatting, docs-sync, registry updates). Each retained credential persistence carries a `persist-credentials required: ...` comment explaining the call site. - Routed every attacker-controllable expansion (`github.head_ref`, `github.event.pull_request.head.repo.full_name`, `inputs.*`, step outputs) through `env:` and referenced as quoted shell variables. Eliminates 17 template-injection vectors in fork-PR-reachable workflows. - Added per-job `permissions:` blocks across 14 workflows; demoted broad workflow-level `id-token: write` to the specific Depot-runner jobs that need it; narrowed `pull-requests: write` / `actions: write` to the jobs that actually call those APIs. Audit-driven fixes - `publish-release.yml` build job: dropped `token:` and added `persist-credentials: false`. The subsequent `Upload workspace` step was packing `.git/config` (with the persisted GITHUB_TOKEN) into a 1-day-retention artifact downloadable by anyone with `actions:read`. - `auto_merge_showcases.yml`: team-membership check now authorizes on the PR AUTHOR (`pull_request.user.login`), never `context.actor` — the actor is whoever triggered the latest event, so a team member synchronizing or reopening an outsider's PR would otherwise green-light auto-merge of code they didn't author. - `static_quality.yml`: pinned ruff to a specific version so a compromised release can't land on the next PR run with the persisted-credentials write token in the format job. - `showcase_capture-previews.yml`: switched the args-string construction to a bash array so a slug or demo value containing whitespace or shell metacharacters stays a single argument rather than being re-tokenized by the shell. |
||
|
Jordan Ritter
|
18c8acb90d |
ci(shell-docs): pipe client-side analytics keys through Docker build (#4786)
## Summary Client-side telemetry on `docs.showcase.copilotkit.ai` was silent. The shell-docs Dockerfile and `showcase_build.yml` workflow never plumbed the `NEXT_PUBLIC_*` analytics keys through to `next build`, so the client JS chunks shipped with empty strings (verified by grepping the live bundle: `let l = i(95704).env.NEXT_PUBLIC_POSTHOG_KEY` — a runtime lookup with no inlined value). Railway runtime env doesn't reach the Docker build phase, so server-side reads (middleware `POSTHOG_KEY`, server-component canonical URLs) worked but client-side reads (posthog-js init, RB2B, Scarf, Reo, GA) silently no-op'd in the browser. ## Changes - **`showcase/shell-docs/Dockerfile`** — declare `ARG` + `ENV` for `NEXT_PUBLIC_POSTHOG_KEY`, `NEXT_PUBLIC_RB2B_ID`, `NEXT_PUBLIC_SCARF_PIXEL_ID`, `NEXT_PUBLIC_REO_KEY`, `NEXT_PUBLIC_GOOGLE_ANALYTICS_TRACKING_ID` in the builder stage so they reach `next build`. - **`.github/workflows/showcase_build.yml`** — add `build_args_analytics: "yes"` flag to the shell-docs matrix entry; extend the `Prepare build args` step to emit the five `NEXT_PUBLIC_*` `--build-arg`s when the flag is set, sourcing values from repo secrets. Mirrors the existing shell-dashboard pattern (`build_args_pb_url` / `build_args_shell_url` / `build_args_ops_url`). ## Secrets Existing repo secret reused: `POSTHOG_PROJECT_KEY`. New repo secrets required (configured separately in repo settings before this lands): - `RB2B_ID` - `SCARF_PIXEL_ID` - `REO_PROJECT_KEY` - `GOOGLE_ANALYTICS_TRACKING_ID` ## Out of scope (intentionally) - `NEXT_PUBLIC_BASE_URL` is already correctly working via Railway runtime env (canonical links render with `https://docs.copilotkit.ai`) — left alone. - Server-side `POSTHOG_KEY` (no `NEXT_PUBLIC_` prefix) stays on Railway runtime env; middleware reads it at Edge Runtime. ## Test plan - [ ] Next build of shell-docs succeeds with new ARGs in scope - [ ] After deploy, search the live bundle on `docs.showcase.copilotkit.ai` for the literal `phc_` prefix — must be present (not `process.env.NEXT_PUBLIC_POSTHOG_KEY` runtime lookup) - [ ] PostHog Live Events shows `$pageview` (client) and `$autocapture` arriving from staging - [ ] RB2B / Scarf / Reo / GA dashboards show events from staging - [ ] Server-side `seo_redirect` + `docs_pageview` continue firing (no regression) |
||
|
Sam Julien
|
f4e3ee6951 |
fix(shell-docs): correct REB2B var name (was RB2B_ID, code reads REB2B_KEY)
The previous commit used `NEXT_PUBLIC_RB2B_ID` based on a stale entry in the cutover plan doc, but `app/layout.tsx:86` reads `NEXT_PUBLIC_REB2B_KEY`. Without this fix the build-arg would be piped under the wrong name and the REB2B Script tag would still not render. |
||
|
Sam Julien
|
6eba49c26b |
ci(shell-docs): pipe client-side analytics keys through Docker build
Client-side telemetry on docs.showcase.copilotkit.ai was silent: the shell-docs Dockerfile and Showcase Build & Push workflow never plumbed NEXT_PUBLIC_POSTHOG_KEY / RB2B_ID / SCARF_PIXEL_ID / REO_KEY / GOOGLE_ANALYTICS_TRACKING_ID through to `next build`. Railway runtime env doesn't reach the Docker build phase, so the client JS chunks shipped with empty strings — posthog-js.init etc. silently no-op'd in the browser. Mirrors the shell-dashboard pattern: matrix flag triggers the args block; values come from repo secrets (POSTHOG_PROJECT_KEY already existed; RB2B_ID, SCARF_PIXEL_ID, REO_PROJECT_KEY, GOOGLE_ANALYTICS_TRACKING_ID added separately in repo settings). Server-side telemetry (middleware seo_redirect, docs_pageview) was unaffected — it reads POSTHOG_KEY at Edge Runtime, which Railway runtime env satisfies. |
||
|
Jordan Ritter
|
4964d695ce |
feat(ci): add Slack + PR comment notification on showcase build failure
Posts to #oss-alerts and comments on the originating PR with failure details so the merge author knows their change broke the Docker build. |
||
|
Jordan Ritter
|
ff2eb9c84b |
fix(ci): restore Railway deploy trigger in showcase build workflow
The decoupled build workflow (PR #4471) removed the Railway deploy trigger, assuming environmentPatchCommit auto-update would handle deploys. Not all services have auto-update configured, so GHCR images were pushed but Railway never pulled them. Restore the explicit serviceInstanceRedeploy call after each GHCR push. |
||
|
Jordan Ritter
|
0b44960db8 |
Decouple showcase build and deploy into separate workflows
The old "Showcase: Build & Deploy" workflow used a single concurrency group
that cancelled in-flight builds on every push to main. When multiple PRs
merged in quick succession, most service builds got cancelled and never
deployed.
Split into two workflows:
1. showcase_build.yml ("Showcase: Build & Push") - triggered on push to main,
builds Docker images and pushes to GHCR. Has NO concurrency group so every
run completes. Railway auto-update picks up the new :latest tag.
2. showcase_deploy.yml ("Showcase: Verify Deploy") - triggered by workflow_run
from the build workflow. Polls Railway to verify each service picked up the
new image and is healthy. Uses cancel-in-progress since verification is
idempotent. Posts results to showcase-harness via webhook.
Also updates showcase_capture-previews.yml to trigger from the renamed build
workflow.
|