mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Jordan Ritter
a6239cde11
Seven-agent CR surfaced correctness defects in the build/deploy/promote pipeline and in the no-public-env-shell-read oxlint rule. This commit closes the false-green paths and broadens lint coverage. Workflow fixes: - showcase_deploy.yml: drop `continue-on-error: true` on the redeploy-summary artifact download. The dispatch path is already guarded by the `if: workflow_run` clause, so the bash "no summary" branch handles legitimate manual dispatches. A genuine workflow_run download failure must now fail loud instead of silently widening verify to the full service set against stale `:latest`. - showcase_build.yml: redeploy-staging now intersects the build matrix with the aggregator success set (`needs.aggregate-build-results.outputs.results`, status == "success") before producing the redeploy CSV. Failed/skipped slots no longer get redeployed (which would just re-pull stale `:latest` and look healthy). - showcase_build.yml: `notify-all-builds-failed` now additionally requires `needs.build.result == 'failure'` so it doesn't Slack-spam when the build job was SKIPPED (verify-image-refs upstream failure). - showcase_build.yml: `notify` now lists [build, aggregate-build-results, redeploy-staging] in `needs:` so aggregator/redeploy failures still emit a Slack signal. `if: failure()` still skips when none of the needs failed. - showcase_build.yml: `set -euo pipefail` on the Prepare build args step so a transient $GITHUB_OUTPUT write failure can't ship images without COMMIT_SHA/BRANCH baked in. - showcase_deploy.yml: `enforce-redeploy-gate` now also trips on a resolve-matrix failure (`needs.resolve-matrix.result == 'failure'`) so an upstream crash that leaves `redeploy_red` empty can't bypass the gate. - Doc-comment accuracy: drop stale `(PR #5093)` reference; correct the env-IDs source-of-truth comment; document the optional `skip_build` field in ALL_SERVICES; clarify that health_path is informational and verify uses per-service drivers; add the missing `resolve-targets` step 0 to the promote workflow's "Order:" header. Aggregator fix (RED-GREEN): - aggregate-build-results.ts: throw on zero slot dirs. The job is gated upstream on has_changes == 'true', so zero slot dirs is a broken artifact download, not a legitimate empty build set. Silently emitting any_success=false + results=[] is indistinguishable from "all builds failed" and lets the deploy workflow fall back to probing the full service set against stale `:latest`. Refuse the ambiguity. - aggregate-build-results.test.ts: existing empty-INPUT_DIR test was updated to assert the throw (was: return []). Oxlint rule (RED-GREEN): - no-public-env-shell-read.mjs: handle destructuring reads (const { NEXT_PUBLIC_X } = process.env and aliased form), template-literal computed keys (process.env[\`NEXT_PUBLIC_X\`]), and explicitly skip assignment-LHS / `delete` targets (writes are not reads). Optional chaining already worked through the existing MemberExpression path. Aliasing (`const e = process.env; e.X`) is intentionally documented as out of scope (needs scope tracking). Description sharpened to say the rule guards a specific banned-key set, not all NEXT_PUBLIC_* reads. - .oxlintrc.json: tighten the off-override glob from `showcase/**/*runtime-config*` to `showcase/**/lib/runtime-config*.{ts,tsx}` so it only silences the intended implementation files, not arbitrary paths containing that substring. - lint-rule-no-public-env.test.ts: rewritten as table-driven coverage of every BANNED_KEYS entry (dotted + bracket-string forms), every ALLOWED key (asserting non-firing), all new variants from the rule expansion, the assignment/delete non-fire cases, and override scoping (runtime-config exempt; packages exempt; shell-tree non-runtime-config flagged). Validation: - actionlint on all three workflows: 8 pre-existing findings (depot label, pre-existing SC2086 infos in untouched steps); my edits add zero. - python3 yaml.safe_load: all three workflows OK. - vitest aggregate-build-results.test.ts: 6/6 pass (incl. new throw test). - vitest lint-rule-no-public-env.test.ts: 34/34 pass. - vitest full showcase/scripts suite: 1654/1654 pass across 46 files. - ruby showcase/bin/spec/all_tests.rb: 87 runs, 0 failures. - Intersection jq proof (matrix a,b,c × success a,c) → "a,c"; all-failed → ""; skipped status excluded.
111 lines
3.2 KiB
JSON
111 lines
3.2 KiB
JSON
{
|
|
"$schema": "https://raw.githubusercontent.com/nicolo-ribaudo/oxlint-json-schema/refs/heads/main/.oxlintrc.json",
|
|
"plugins": ["typescript", "unicorn", "oxc", "react", "nextjs", "import"],
|
|
"jsPlugins": ["./packages/react-ui/oxlint-rules/copilotkit-plugin.mjs"],
|
|
"categories": {
|
|
"correctness": "warn",
|
|
"suspicious": "warn"
|
|
},
|
|
"rules": {
|
|
"react/react-in-jsx-scope": "off",
|
|
"import/no-unassigned-import": "off",
|
|
"unicorn/no-array-sort": "off",
|
|
"copilotkit/require-cpk-prefix": "off",
|
|
"no-restricted-imports": "off",
|
|
|
|
"typescript/consistent-type-imports": [
|
|
"warn",
|
|
{ "prefer": "type-imports", "fixStyle": "separate-type-imports" }
|
|
],
|
|
"typescript/no-import-type-side-effects": "warn",
|
|
"import/consistent-type-specifier-style": ["warn", "prefer-top-level"],
|
|
"typescript/no-unnecessary-type-assertion": "error",
|
|
|
|
"react/self-closing-comp": "warn",
|
|
"unicorn/prefer-optional-catch-binding": "warn",
|
|
"eslint/no-useless-computed-key": "warn",
|
|
"unicorn/prefer-string-slice": "warn",
|
|
"unicorn/prefer-array-flat-map": "warn"
|
|
},
|
|
"overrides": [
|
|
{
|
|
"files": ["packages/**/*.{ts,tsx}"],
|
|
"rules": {
|
|
"copilotkit/no-single-arg-zod-record": "error"
|
|
}
|
|
},
|
|
{
|
|
"files": ["packages/**/*.{ts,tsx}", "examples/**/*.{ts,tsx}"],
|
|
"rules": {
|
|
"no-restricted-imports": [
|
|
"error",
|
|
{
|
|
"paths": [
|
|
{
|
|
"name": "@a2ui/lit",
|
|
"message": "Do not use value imports from '@a2ui/lit' — it registers custom elements as a side effect, which breaks React Strict Mode. Use `import type` for types, or import from '@a2ui/lit/0.8' for value access (core only, no UI side effects).",
|
|
"allowTypeImports": true
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"files": ["packages/react-ui/src/**/*.{ts,tsx}"],
|
|
"rules": {
|
|
"copilotkit/require-cpk-prefix": "warn"
|
|
}
|
|
},
|
|
{
|
|
"files": ["**/__tests__/**", "**/*.test.*", "**/*.spec.*"],
|
|
"rules": {
|
|
"copilotkit/require-cpk-prefix": "off"
|
|
}
|
|
},
|
|
{
|
|
"files": [
|
|
"packages/angular/**/*.ts",
|
|
"packages/runtime/src/graphql/**/*.ts"
|
|
],
|
|
"rules": {
|
|
"typescript/consistent-type-imports": "off",
|
|
"typescript/no-import-type-side-effects": "off",
|
|
"import/consistent-type-specifier-style": "off"
|
|
}
|
|
},
|
|
{
|
|
"files": [
|
|
"showcase/shell-dashboard/src/**/*.{ts,tsx}",
|
|
"showcase/shell-docs/src/**/*.{ts,tsx}",
|
|
"showcase/shell/src/**/*.{ts,tsx}",
|
|
"showcase/shell-dojo/src/**/*.{ts,tsx}"
|
|
],
|
|
"rules": {
|
|
"copilotkit/no-public-env-shell-read": "error"
|
|
}
|
|
},
|
|
{
|
|
"files": [
|
|
"showcase/shell-docs/src/content/**",
|
|
"showcase/**/lib/runtime-config*.{ts,tsx}",
|
|
"showcase/**/*.test.{ts,tsx}",
|
|
"showcase/**/*.spec.{ts,tsx}"
|
|
],
|
|
"rules": {
|
|
"copilotkit/no-public-env-shell-read": "off"
|
|
}
|
|
}
|
|
],
|
|
"ignorePatterns": [
|
|
"dist/**",
|
|
"node_modules/**",
|
|
".next/**",
|
|
".nuxt/**",
|
|
"coverage/**",
|
|
"storybook-static/**",
|
|
"**/@generated/**",
|
|
"docs/**"
|
|
]
|
|
}
|