1db5c8ab4a
fix(install): harden ECC installer lifecycle
...
Make Antigravity 2.0 installs native and safely migrate legacy state. Ensure doctor, repair, status projection, repeat installs, legacy Codex sync, and uninstall converge without losing user files. Exclude Python bytecode and harden repo-scan bootstrap guidance.
Gate publishing and pull-request merges on one exact packed artifact completing install, repeat, drift, repair, status, and uninstall across Linux, macOS, and Windows.
Co-authored-by: lorencifernando-coder <lorenci.fernando@gmail.com >
Co-authored-by: Suliman Abdulrazzaq <suliman9000a@gmail.com >
Co-authored-by: Wu Shuwen <mikewushuwen@outlook.com >
2026-08-13 16:42:51 -04:00
d0fc6be911
chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ( #2590 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 17:24:13 -04:00
a15c8e8533
ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package ( #2364 )
...
* ci: add ruff + mypy to the Python CI job and fix pyproject tool config
The python-tests job runs pytest but not lint/type checks, and the ruff
and mypy configuration in pyproject.toml was silently broken, so neither
tool could run at all.
- add ruff and mypy steps to the existing python-tests job
- fix invalid pyproject keys: [tool.ruff] src-path -> src,
[tool.mypy] src_paths -> mypy_path
- ignore ruff UP042 (the (str, Enum) mixin is intentional)
- resolve ruff findings (unused/unsorted imports) across src and tests
- fix mypy errors in tools/executor.py and prompt/builder.py
* fix(ci): satisfy Python lint after main refresh
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com >
2026-08-11 14:15:57 -04:00
Affaan Mustafa and GitHub
f16a6ff2a6
fix: ship new Itô skills through install manifests ( #2704 )
...
* fix: ship new Ito skills through install manifests
* ci: audit shipped dependencies separately from tooling
* test(release): pass previous version to heading helper
2026-08-07 14:14:21 -04:00
28e53a0bc1
feat(install): add guided multi-harness installer ( #2649 )
...
* feat(install): add guided Claude plugin setup
* fix: support Claude command shims on Windows
* feat: support safe Claude plugin scope migration
* fix(install): preserve interactive setup terminal
* fix(install): auto-migrate setup scope changes
* feat(install): add guided multi-harness installer
* fix(install): sync Yarn binary metadata
* fix(install): handle wizard EOF on Node 18
* ci: allow installer matrix tests to finish
* test(install): allow slower PowerShell delegation
* fix(install): harden guided provider reconciliation
* test(install): harden packaged and local compatibility
* chore: prepare guided installer release 2.2.0
* fix(install): report refreshed Codex marketplace state
* fix(install): verify managed content provenance
* test(install): allow empty Yarn smoke fixture
* test(install): invoke Windows package shims safely
* fix(install): close cross-platform release gaps
* fix(install): require trusted GitHub origins
* fix(install): preserve hook profile precedence
* refactor(install): centralize trusted GitHub origins
* ci: retrigger workflow run after merge of main
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-06 15:39:49 -04:00
ad08352f60
chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates ( #2325 )
...
Bumps the actions-minor-and-patch group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node ), [pnpm/action-setup](https://github.com/pnpm/action-setup ) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v6.3.0...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
Updates `pnpm/action-setup` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271 )
Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:56:09 -07:00
e676d1da7f
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 ( #2328 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:55:45 -07:00
00b443eddb
ci: isolate OMP workflow verification ( #2382 )
...
Co-authored-by: jan <jan@w-saxs001.local >
2026-06-29 15:51:00 -07:00
d71ffd56b9
chore(deps): bump actions/setup-node ( #2204 )
...
Bumps the actions-minor-and-patch group with 1 update in the / directory: [actions/setup-node](https://github.com/actions/setup-node ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 23:39:00 -04:00
ECC Test
3e30f1a56a
ci: harden workflows and sponsor code review config
2026-06-09 21:20:17 -04:00
09e2bc58d3
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 ( #2183 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-07 13:25:31 +08:00
dependabot[bot] and Affaan Mustafa
cde0b12180
chore(deps): bump pnpm/action-setup from 6.0.6 to 6.0.8
...
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup ) from 6.0.6 to 6.0.8.
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/91ab88e2619ed1f46221f0ba42d1492c02baf788...0e279bb959325dab635dd2c09392533439d90093 )
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-17 01:33:19 -04:00
Affaan Mustafa and Affaan Mustafa
f7035b5644
Harden CI installs against supply-chain lifecycle hooks
2026-05-15 17:29:03 -04:00
Affaan Mustafa and GitHub
c2c54e7c0b
ci: restore dependency caches without saving ( #1934 )
2026-05-15 13:51:51 -04:00
f7315016c0
feat: add command registry and coverage checks ( #1906 )
...
Salvages the useful parts of #1897 without generated .caliber state or stale counts.
- adds a deterministic command registry generator and drift check
- commits the current command registry for 75 commands
- validates the rc.1 README catalog summary against live counts
- adds a single Ubuntu Node 20 coverage job instead of running coverage in every matrix cell
Co-authored-by: jodunk <jodunk@users.noreply.github.com >
2026-05-14 22:02:36 -04:00
Affaan Mustafa and GitHub
7d15a2282b
security: add supply-chain IOC scanner ( #1904 )
2026-05-14 21:15:35 -04:00
Affaan Mustafa and GitHub
797f283036
ci: require npm audit signature checks
...
Require npm registry signature verification wherever workflow npm audit checks run.
- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior
Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846
2026-05-12 23:48:56 -04:00
Affaan Mustafa and GitHub
daf0355531
ci: harden workflow install boundaries
...
- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk
2026-05-12 21:55:36 -04:00
Affaan Mustafa and Affaan Mustafa
6fbf58d590
ci: keep package manager cache failures non-blocking
2026-05-12 18:03:30 -04:00
Affaan Mustafa and GitHub
e674a7dbd7
fix: harden CI validators
...
Ports personal-path validator hardening and quoted checkout detection onto current main.
2026-05-11 03:08:43 -04:00
c013479019
build(deps): bump pnpm/action-setup from 6.0.0 to 6.0.6 ( #1708 )
...
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup ) from 6.0.0 to 6.0.6.
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/08c4be7e2e672a47d11bd04269e27e5f3e8529cb...91ab88e2619ed1f46221f0ba42d1492c02baf788 )
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-11 01:12:31 -04:00
01b171947c
chore(deps): bump actions/cache from 5.0.4 to 5.0.5 ( #1497 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-11 01:11:50 -04:00
Affaan Mustafa
0a87323eda
feat(ecc2): finalize rc1 release surface
2026-04-28 22:10:04 -04:00
Affaan Mustafa
6b7bd7156c
fix: relax pnpm strict build checks in CI
2026-04-15 16:44:58 -07:00
Affaan Mustafa and GitHub
85e331e49a
Merge pull request #1369 from affaan-m/dependabot/github_actions/pnpm/action-setup-6.0.0
...
build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0
2026-04-13 01:05:16 -07:00
Affaan Mustafa
1a950e4f83
fix: allow pnpm cache probe under node 18
2026-04-13 00:21:42 -07:00
Affaan Mustafa
ef7613c526
fix: use corepack pnpm on node 18
2026-04-13 00:17:17 -07:00
Affaan Mustafa
bd207aabe1
fix: use pnpm 9 for node 18 workflow jobs
2026-04-13 00:13:54 -07:00
Affaan Mustafa
6eadf786f5
fix: pin pnpm version for setup action v6
2026-04-13 00:10:39 -07:00
Affaan Mustafa
adb46a95a6
chore: update pnpm action version comments
2026-04-12 23:53:57 -07:00
Affaan Mustafa and GitHub
2fb041c6de
Merge pull request #1368 from affaan-m/dependabot/github_actions/actions/upload-artifact-7.0.1
...
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
2026-04-12 23:53:01 -07:00
Affaan Mustafa
3792b69a38
fix: block unsafe privileged workflow checkouts
2026-04-12 23:23:01 -07:00
dependabot[bot] and GitHub
4b92288a27
build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0
...
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/fc06bc1257f339d1d5d8b3a19a8cae5388b55320...08c4be7e2e672a47d11bd04269e27e5f3e8529cb )
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-12 04:52:33 +00:00
dependabot[bot] and GitHub
45faeb90a7
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-12 04:52:29 +00:00
87363f0e59
chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 ( #1060 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Affaan Mustafa <me@affaanmustafa.com >
2026-03-31 14:07:40 -07:00
a1cebd29f7
chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.0 ( #1061 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.6.2 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 14:06:07 -07:00
09398b42c2
chore(deps): bump actions/setup-node from 4.4.0 to 6.3.0 ( #1058 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 4.4.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...53b83947a5a98c8d113130e565377fae1a50d02f )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 14:06:02 -07:00
d1e2209a52
chore(deps): bump actions/cache from 4.3.0 to 5.0.4 ( #1057 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.3.0 to 5.0.4.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...668228422ae6a00e4ad889ee87cd7109ec5666a7 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.4
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-31 14:04:33 -07:00
Affaan Mustafa
866d9ebb53
fix: harden unicode safety checks
2026-03-29 21:21:18 -04:00
Andriy Kalashnykov
46f37ae4fb
chore: pin actions to commit SHAs and add Skills section to CLAUDE.md
...
Pin all GitHub Actions to commit SHAs instead of mutable version tags
across ci.yml, release.yml, maintenance.yml, and all reusable workflows.
This prevents supply-chain attacks via tag hijacking.
Add the required Skills section to CLAUDE.md mapping project files
(README.md, .github/workflows/*.yml) to their respective review skills.
2026-03-29 17:16:56 -04:00
dagecko
28a1fbc3f2
fix: pin 6 actions to commit SHA, extract 1 expression to env var
2026-03-28 15:57:55 -04:00
to.watanabe
d8e3b9d593
fix(ci): remove --ignore-engines for Yarn Berry (v4+)
...
Yarn Berry removed the --ignore-engines flag; engine checking is no
longer a core feature. The deprecated flag causes yarn install to exit
with error code 1.
2026-03-28 12:27:04 +09:00
to.watanabe
7148d9006f
fix(ci): enable Corepack for yarn and relax pnpm strict mode
...
All 18 pnpm/yarn CI jobs fail on main because:
1. pnpm v9+ refuses to install when package.json declares
"packageManager": "yarn@4.9.2" — fixed by setting
COREPACK_ENABLE_STRICT=0 and --no-frozen-lockfile
2. CI runners only have Yarn Classic (v1.x) but the project
uses Yarn Berry (v4.x) — fixed by activating Corepack
before the cache/install steps
2026-03-28 12:27:04 +09:00
Affaan Mustafa
7726c25e46
fix(ci): restore validation and antigravity target safety
2026-03-23 14:29:21 -07:00
Justin Philpott and GitHub
01ed1b3b03
fix(ci): enforce catalog count integrity ( #525 )
...
* fix(ci): enforce catalog count integrity
* test: harden catalog structure parsing
2026-03-16 13:37:51 -07:00
Affaan Mustafa and Affaan Mustafa
4fa817cd7d
ci: install validation deps for hook checks
2026-03-10 20:14:18 -07:00
Roei Bar Aviv and GitHub
7c0bc25982
feat: add comprehensive CI/CD pipeline
...
Adds GitHub Actions workflows for CI, maintenance, and releases with multi-platform testing matrix.
2026-01-28 23:05:43 -08:00
