dependabot[bot] and GitHub
b8f6ddc643
chore(deps): bump the actions-minor-and-patch group across 1 directory with 2 updates
...
Bumps the actions-minor-and-patch group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ) and [pnpm/action-setup](https://github.com/pnpm/action-setup ).
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 )
Updates `pnpm/action-setup` from 6.0.9 to 6.0.10
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-08-17 04:55:27 +00:00
haelyra
bab38ae91b
fix(security): close installer filesystem races
...
Use no-follow file descriptors for legacy Codex snapshots, verification, restoration, and marker cleanup. Quarantine candidate removals and verify inode identity before deletion.
Carry the lifecycle runner as a verified artifact so privileged release workflows never dynamically check out and execute an output-selected revision.
2026-08-13 16:59:06 -04:00
1db5c8ab4a
fix(install): harden ECC installer lifecycle
...
Make Antigravity 2.0 installs native and safely migrate legacy state. Ensure doctor, repair, status projection, repeat installs, legacy Codex sync, and uninstall converge without losing user files. Exclude Python bytecode and harden repo-scan bootstrap guidance.
Gate publishing and pull-request merges on one exact packed artifact completing install, repeat, drift, repair, status, and uninstall across Linux, macOS, and Windows.
Co-authored-by: lorencifernando-coder <lorenci.fernando@gmail.com >
Co-authored-by: Suliman Abdulrazzaq <suliman9000a@gmail.com >
Co-authored-by: Wu Shuwen <mikewushuwen@outlook.com >
2026-08-13 16:42:51 -04:00
d0fc6be911
chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ( #2590 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 17:24:13 -04:00
a15c8e8533
ci: add Python CI job (ruff, mypy, pytest) for the llm-abstraction package ( #2364 )
...
* ci: add ruff + mypy to the Python CI job and fix pyproject tool config
The python-tests job runs pytest but not lint/type checks, and the ruff
and mypy configuration in pyproject.toml was silently broken, so neither
tool could run at all.
- add ruff and mypy steps to the existing python-tests job
- fix invalid pyproject keys: [tool.ruff] src-path -> src,
[tool.mypy] src_paths -> mypy_path
- ignore ruff UP042 (the (str, Enum) mixin is intentional)
- resolve ruff findings (unused/unsorted imports) across src and tests
- fix mypy errors in tools/executor.py and prompt/builder.py
* fix(ci): satisfy Python lint after main refresh
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com >
2026-08-11 14:15:57 -04:00
Affaan Mustafa and GitHub
cdbb25bf9d
fix: deliver announcements through a scoped Discord webhook ( #2737 )
...
* test: reproduce Discord webhook announcement gap
* fix: deliver ECC announcements through channel webhook
* test: cover webhook replay and least privilege
* fix: make webhook delivery durable and least privilege
* test: cover trusted receipts and cross-workflow races
* fix: serialize and authenticate announcement receipts
2026-08-09 16:41:27 -04:00
Affaan Mustafa and GitHub
2d46e80e09
fix: deliver ECC announcements to Discord ( #2732 )
2026-08-09 06:37:04 -04:00
Affaan Mustafa and GitHub
f16a6ff2a6
fix: ship new Itô skills through install manifests ( #2704 )
...
* fix: ship new Ito skills through install manifests
* ci: audit shipped dependencies separately from tooling
* test(release): pass previous version to heading helper
2026-08-07 14:14:21 -04:00
28e53a0bc1
feat(install): add guided multi-harness installer ( #2649 )
...
* feat(install): add guided Claude plugin setup
* fix: support Claude command shims on Windows
* feat: support safe Claude plugin scope migration
* fix(install): preserve interactive setup terminal
* fix(install): auto-migrate setup scope changes
* feat(install): add guided multi-harness installer
* fix(install): sync Yarn binary metadata
* fix(install): handle wizard EOF on Node 18
* ci: allow installer matrix tests to finish
* test(install): allow slower PowerShell delegation
* fix(install): harden guided provider reconciliation
* test(install): harden packaged and local compatibility
* chore: prepare guided installer release 2.2.0
* fix(install): report refreshed Codex marketplace state
* fix(install): verify managed content provenance
* test(install): allow empty Yarn smoke fixture
* test(install): invoke Windows package shims safely
* fix(install): close cross-platform release gaps
* fix(install): require trusted GitHub origins
* fix(install): preserve hook profile precedence
* refactor(install): centralize trusted GitHub origins
* ci: retrigger workflow run after merge of main
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-08-06 15:39:49 -04:00
Affaan Mustafa and Claude
edaf6fef94
fix(release): drop the dead OMP adapter verification step
...
The step ran node tests/omp/omp-plugin.test.js, which has never existed in
this repository. It was added by #2382 without the test file, so Verify
Release failed on every tag and no release could publish.
The OpenCode payload is already verified by tests/scripts/build-opencode.test.js
in the preceding step, and the plugin and marketplace manifests by
tests/plugin-manifest.test.js in Verify release metadata stays in sync.
Co-Authored-By: Claude <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_0149VwNuynam6rvEfcMmiHHa
2026-07-27 14:07:43 -04:00
dependabot[bot] and GitHub
a7996b03f5
chore(deps): update checkout action to v7 ( #2456 )
...
Update the final SLSA workflow checkout step to the same exact v7.0.0 SHA used across the rest of the repository.
2026-07-26 03:12:29 -07:00
dependabot[bot] and GitHub
efc91870c7
chore(deps): update pinned GitHub actions ( #2540 )
...
Update actions/stale to v10.4.0 and softprops/action-gh-release to v3.0.2 while preserving exact SHA pinning.
2026-07-26 03:11:38 -07:00
ad08352f60
chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates ( #2325 )
...
Bumps the actions-minor-and-patch group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node ), [pnpm/action-setup](https://github.com/pnpm/action-setup ) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v6.3.0...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
Updates `pnpm/action-setup` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271 )
Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:56:09 -07:00
891412c126
chore(deps): bump slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml ( #2330 )
...
Bumps [slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml](https://github.com/slsa-framework/slsa-github-generator ) from 1.4.0 to 2.1.0.
- [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases )
- [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md )
- [Commits](https://github.com/slsa-framework/slsa-github-generator/compare/68bad40844440577b33778c9f29077a3388838e9...f7dd8c54c2067bafc12ca7a55595d5ee9b75204a )
---
updated-dependencies:
- dependency-name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:55:47 -07:00
e676d1da7f
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 ( #2328 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:55:45 -07:00
00b443eddb
ci: isolate OMP workflow verification ( #2382 )
...
Co-authored-by: jan <jan@w-saxs001.local >
2026-06-29 15:51:00 -07:00
e53b4d9e39
Finalize and enhance SLSA generic generator workflow ( #2197 )
...
* Add SLSA generic generator workflow
* ci: finalize SLSA generator and fix bun test timeout
- Harden SLSA workflow with persist-credentials: false and pinned actions
- Update SLSA workflow to build real npm artifacts and fix digest outputs
- Increase trae-install test timeout to prevent ETIMEDOUT under Bun
- Fix Validate Components security violation in SLSA workflow
* ci: finalize SLSA generator and fix bun test timeout
- Harden SLSA workflow with persist-credentials: false and pinned actions
- Update SLSA workflow to build real npm artifacts and fix digest outputs
- Rename workflow to "SLSA generic generator workflow #1 "
- Increase trae-install test timeout to prevent ETIMEDOUT under Bun
- Fix Validate Components security violation in SLSA workflow
* Update generator-generic-ossf-slsa3-publish.yml
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
* generator-generic-ossf-slsa3-publish.yml
* .github/workflows/generator-generic-ossf-slsa3-publish.yml
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* Update .github/workflows/generator-generic-ossf-slsa3-publish.yml
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---------
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-06-15 14:01:29 -04:00
1c3280dc0d
fix(security): add host/origin allowlist + validate git refs + quote workflow input ( #2185 )
...
Three defense-in-depth fixes around untrusted input flowing to subprocess execution:
1. **Control-pane HTTP server (scripts/lib/control-pane/server.js)**
The local control-pane API binds to 127.0.0.1 but had no Host or Origin
validation, so a DNS-rebinding attack from a malicious website could pivot
into the loopback endpoints — including POST /api/actions/:id, which spawns
'cargo run -- graph ...' with caller-supplied query strings. Add a hostname
allowlist (loopback variants plus the explicitly configured --host) and
reject mismatched Host (421) or non-loopback Origin (403) before any route
handler runs.
2. **OpenCode git-summary tool (.opencode/tools/git-summary.ts)**
The tool was building 'git diff ${baseBranch}...HEAD --stat' with execSync
and a raw model-supplied baseBranch string. Switch run() to execFileSync
with an args array (no shell), validate baseBranch against a conservative
git-ref allowlist (rejects shell metacharacters, leading -, embedded ..),
and clamp the depth arg to a small positive integer before interpolating
into 'git log --oneline -<N>'.
3. **Reusable test workflow (.github/workflows/reusable-test.yml)**
The 'Install dependencies' step interpolated ${{ inputs.package-manager }}
directly into a bash 'case' and into an echo, so a downstream caller that
forwarded attacker-controllable input could inject into the runner. Move
the input into a PACKAGE_MANAGER env var and reference $PACKAGE_MANAGER
inside the script per the GitHub script-injection guidance.
Detected by Aeon + semgrep p/security-audit (host check via threat-model
manual-review axis; git-summary via detect-child-process; workflow via
run-shell-injection).
Verification: node tests/run-all.js — 2686/2687 pre-existing tests pass; the
one failure (observe.sh legacy output fallback) reproduces on main without
this branch applied. Added 2 new control-pane tests covering the allowlist
classifier and the DNS-rebinding-gate behavior end-to-end.
---
Filed by [Aeon](https://github.com/aaronjmars/aeon-aaron ).
Co-authored-by: aeonframework <aeon@aaronjmars.com >
2026-06-15 13:49:40 -04:00
d71ffd56b9
chore(deps): bump actions/setup-node ( #2204 )
...
Bumps the actions-minor-and-patch group with 1 update in the / directory: [actions/setup-node](https://github.com/actions/setup-node ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 23:39:00 -04:00
ECC Test
3e30f1a56a
ci: harden workflows and sponsor code review config
2026-06-09 21:20:17 -04:00
ECC Test
10c303e609
ci: harden release announce checkout
2026-06-09 21:03:22 -04:00
edebcc89ef
feat(discord): release -> #announcements auto-post + pin + GitHub Discussions ( #2201 )
...
On a published GitHub release, post the notes to the ECC Discord
#announcements channel (via bot), pin it, and cross-post to GitHub
Discussions (Announcements category). Release data flows through env vars
(no shell interpolation of untrusted input). Secrets: DISCORD_BOT_TOKEN,
DISCORD_ANNOUNCE_CHANNEL_ID (repo secrets), GITHUB_TOKEN.
Ties the 2.0.0/1.11.0 official release to the community launch.
Co-authored-by: ECC Test <ecc@example.test >
2026-06-08 22:38:03 -04:00
09e2bc58d3
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 ( #2183 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-07 13:25:31 +08:00
dependabot[bot] and GitHub
870c5eb21b
chore(deps): bump actions/stale to 10.3.0 ( #2045 )
...
Bumps actions/stale from 10.2.0 to 10.3.0. Verified by the full CI matrix on the PR.
2026-05-25 14:06:27 -04:00
Affaan Mustafa and Affaan Mustafa
9ee1e15564
docs: define ECC 2.0 hypergrowth release lane
...
Refresh the active 2.0 release surface for the affaan-m/ECC repo identity, update package/plugin/workflow launch metadata, and add an operator command center for release video, partner, sponsor, consulting, and social launch execution.
2026-05-19 05:42:38 -04:00
Affaan Mustafa
7911af4a39
security: scope release oidc publishing
2026-05-18 13:41:10 -04:00
dependabot[bot] and Affaan Mustafa
cde0b12180
chore(deps): bump pnpm/action-setup from 6.0.6 to 6.0.8
...
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup ) from 6.0.6 to 6.0.8.
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/91ab88e2619ed1f46221f0ba42d1492c02baf788...0e279bb959325dab635dd2c09392533439d90093 )
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-17 01:33:19 -04:00
Affaan Mustafa and Affaan Mustafa
a8e3bcb00f
Add supply-chain advisory source refresh
2026-05-15 23:09:54 -04:00
Affaan Mustafa and Affaan Mustafa
f7035b5644
Harden CI installs against supply-chain lifecycle hooks
2026-05-15 17:29:03 -04:00
Affaan Mustafa and Affaan Mustafa
6951b8d5d2
Add scheduled supply-chain watch workflow
2026-05-15 16:56:49 -04:00
Affaan Mustafa and GitHub
c2c54e7c0b
ci: restore dependency caches without saving ( #1934 )
2026-05-15 13:51:51 -04:00
Affaan Mustafa and GitHub
13585f1092
feat: add platform and supply-chain audit commands ( #1926 )
2026-05-15 08:06:26 -04:00
f7315016c0
feat: add command registry and coverage checks ( #1906 )
...
Salvages the useful parts of #1897 without generated .caliber state or stale counts.
- adds a deterministic command registry generator and drift check
- commits the current command registry for 75 commands
- validates the rc.1 README catalog summary against live counts
- adds a single Ubuntu Node 20 coverage job instead of running coverage in every matrix cell
Co-authored-by: jodunk <jodunk@users.noreply.github.com >
2026-05-14 22:02:36 -04:00
Affaan Mustafa and GitHub
7d15a2282b
security: add supply-chain IOC scanner ( #1904 )
2026-05-14 21:15:35 -04:00
Affaan Mustafa and GitHub
209abd403b
ci: disable checkout credential persistence in privileged workflows ( #1851 )
2026-05-13 01:15:49 -04:00
Affaan Mustafa and GitHub
797f283036
ci: require npm audit signature checks
...
Require npm registry signature verification wherever workflow npm audit checks run.
- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior
Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846
2026-05-12 23:48:56 -04:00
Affaan Mustafa and GitHub
daf0355531
ci: harden workflow install boundaries
...
- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk
2026-05-12 21:55:36 -04:00
Affaan Mustafa and GitHub
33db548be3
ci: ignore install scripts in release workflows ( #1839 )
2026-05-12 21:36:36 -04:00
Affaan Mustafa and Affaan Mustafa
6fbf58d590
ci: keep package manager cache failures non-blocking
2026-05-12 18:03:30 -04:00
Affaan Mustafa and GitHub
e674a7dbd7
fix: harden CI validators
...
Ports personal-path validator hardening and quoted checkout detection onto current main.
2026-05-11 03:08:43 -04:00
c013479019
build(deps): bump pnpm/action-setup from 6.0.0 to 6.0.6 ( #1708 )
...
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup ) from 6.0.0 to 6.0.6.
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/08c4be7e2e672a47d11bd04269e27e5f3e8529cb...91ab88e2619ed1f46221f0ba42d1492c02baf788 )
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-11 01:12:31 -04:00
01b171947c
chore(deps): bump actions/cache from 5.0.4 to 5.0.5 ( #1497 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.4 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-11 01:11:50 -04:00
Affaan Mustafa
0a87323eda
feat(ecc2): finalize rc1 release surface
2026-04-28 22:10:04 -04:00
Affaan Mustafa
6b7bd7156c
fix: relax pnpm strict build checks in CI
2026-04-15 16:44:58 -07:00
Affaan Mustafa
8b5c0c1b07
fix: allow manual release workflow dispatch
2026-04-14 21:02:23 -07:00
Affaan Mustafa
b5c4d2beb9
fix: wire npm auth into release publish
2026-04-14 20:43:22 -07:00
Affaan Mustafa
34380326c8
fix: publish npm releases and clarify install identifiers
2026-04-14 20:42:28 -07:00
Affaan Mustafa and GitHub
85e331e49a
Merge pull request #1369 from affaan-m/dependabot/github_actions/pnpm/action-setup-6.0.0
...
build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.0
2026-04-13 01:05:16 -07:00
Affaan Mustafa and GitHub
5c4570baa5
Merge pull request #1370 from affaan-m/dependabot/github_actions/softprops/action-gh-release-3.0.0
...
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
2026-04-13 00:30:59 -07:00
Affaan Mustafa
1a950e4f83
fix: allow pnpm cache probe under node 18
2026-04-13 00:21:42 -07:00
