Release Dev by perasperaactual · Pull Request #382 · Per-Aspera-LLC/stackwright

perasperaactual · 2026-04-27T16:31:29Z

No description provided.

Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

* fix(deploy): migrate from R2 to Cloudflare Pages * fix(deploy): use env vars for deployment variables --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…on (#341) * feat(hooks): add @stackwright/hooks-registry for cross-module singleton - Create new @stackwright/hooks-registry package using Symbol.for() pattern - Update @stackwright/scaffold-core to re-export from shared registry - Fix fallback:'blocking' + output:'export' incompatibility in template - Update E2E config to serve static out/ directory Fixes module isolation where Pro packages' hooks weren't visible to CLI. * fix(hooks): add resetForTesting export and improve singleton tests * fix: address lint warnings for PR #341 * chore: update visual regression baselines and SBOM files * fix(deps): pin undici to ^7.0.0 for jsdom compatibility --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

* feat(hooks): add @stackwright/hooks-registry for cross-module singleton - Create new @stackwright/hooks-registry package using Symbol.for() pattern - Update @stackwright/scaffold-core to re-export from shared registry - Fix fallback:'blocking' + output:'export' incompatibility in template - Update E2E config to serve static out/ directory Fixes module isolation where Pro packages' hooks weren't visible to CLI. * fix(hooks): add resetForTesting export and improve singleton tests * fix: address lint warnings for PR #341 * chore: update visual regression baselines and SBOM files * fix(deps): pin undici to ^7.0.0 for jsdom compatibility * docs: add ADR 006 for shared validation module (fixes #338) --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

* fix(core): resolve theme tokens in icon color prop (fixes #339) * chore: add changeset for #339 fix * fix(core): map background token to --sw-color-bg (fixes #343 review) --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…345) * feat(security): add secrets scanning and plugin security guidelines (fixes #244, #246) * fix(security): use gitleaks v1 (MIT) and fix workflow configuration * refactor(security): use gitleaks CLI instead of GitHub Action - Replace gitleaks-action with direct CLI invocation - CLI is MIT licensed, no license key required - Exit code 1 = leaks found (fails CI), 0 = clean (passes) - Add Go setup step to install gitleaks v9 * fix(security): use --filter for pnpm audit to avoid workspace conflicts --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…rets (#245)

…#245) (#347) * feat(types,build-scripts): add env var resolution for integration secrets (#245) * chore: add changeset for #245 --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

* fix(security): add configSchema field to PrebuildPlugin interface This commit addresses security issue #242 by adding schema validation for integration configs in the Stackwright prebuild pipeline. Changes: - Add configSchema field to PrebuildPlugin interface in packages/types - Add validateIntegrationConfig() and validateIntegrations() functions to packages/build-scripts/src/prebuild.ts - Integrate validation into the prebuild pipeline after env var resolution - Add comprehensive tests for plugin config schema validation Security benefits: - Prevents prototype pollution attacks (__proto__, constructor) - Validates plugin-specific configuration options - Enforces type safety for integration configs The validation is opt-in for plugins - they declare a configSchema if they want their integration configs validated. Existing plugins without a configSchema continue to work as before (with a warning in development). fixes #242 * fix: add plugin config schema validation (#242) --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…#350) Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…362) * fix(cli): remove duplicate preInstall hook call from processTemplate (fixes #351) * chore: add changeset for #351 fix --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…363) - Delete ROADMAP.md (roadmap lives in GitHub Issues; use `pnpm stackwright -- board`) - Update 3 stale ROADMAP.md references in CONTRIBUTING.md - Fix duplicate/truncated paragraph at end of PHILOSOPHY.md - Update PHILOSOPHY.md intro to point to GitHub Issues instead of ROADMAP.md - Delete docs/archive/ (6 completed-work summaries; preserved in git history) - Delete orphaned docs/sbom-ci-workflow.md (no inbound refs, CI already covers it) - Rename docs/security-model-for-docs.md → docs/SECURITY-MODEL.md - Update inbound links to SECURITY-MODEL.md in docs/PLUGIN_SECURITY.md Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

@v4

* static export fixes (#335) * fix(deploy): enable static export for R2 bucket hosting (#332) Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * fix(deploy): add trailing slash support for R2 static hosting (#334) Co-authored-by: Stackwright Bot <bot@per-aspera.dev> --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * release CI security fixes (#348) * fix(deploy): enable static export for R2 bucket hosting (#332) Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * fix(deploy): add trailing slash support for R2 static hosting (#334) Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * fix(deploy): migrate from R2 to Cloudflare Pages (#336) Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * Fix/cloudflare pages (#337) * fix(deploy): migrate from R2 to Cloudflare Pages * fix(deploy): use env vars for deployment variables --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * feat(hooks): add @stackwright/hooks-registry for cross-module singleton (#341) * feat(hooks): add @stackwright/hooks-registry for cross-module singleton - Create new @stackwright/hooks-registry package using Symbol.for() pattern - Update @stackwright/scaffold-core to re-export from shared registry - Fix fallback:'blocking' + output:'export' incompatibility in template - Update E2E config to serve static out/ directory Fixes module isolation where Pro packages' hooks weren't visible to CLI. * fix(hooks): add resetForTesting export and improve singleton tests * fix: address lint warnings for PR #341 * chore: update visual regression baselines and SBOM files * fix(deps): pin undici to ^7.0.0 for jsdom compatibility --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * docs: document shared validation module architecture (fixes #338) (#342) * feat(hooks): add @stackwright/hooks-registry for cross-module singleton - Create new @stackwright/hooks-registry package using Symbol.for() pattern - Update @stackwright/scaffold-core to re-export from shared registry - Fix fallback:'blocking' + output:'export' incompatibility in template - Update E2E config to serve static out/ directory Fixes module isolation where Pro packages' hooks weren't visible to CLI. * fix(hooks): add resetForTesting export and improve singleton tests * fix: address lint warnings for PR #341 * chore: update visual regression baselines and SBOM files * fix(deps): pin undici to ^7.0.0 for jsdom compatibility * docs: add ADR 006 for shared validation module (fixes #338) --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * fix(core): resolve theme tokens in icon color prop (fixes #339) (#343) * fix(core): resolve theme tokens in icon color prop (fixes #339) * chore: add changeset for #339 fix * fix(core): map background token to --sw-color-bg (fixes #343 review) --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * feat(security): add secrets scanning and plugin security guidelines (#345) * feat(security): add secrets scanning and plugin security guidelines (fixes #244, #246) * fix(security): use gitleaks v1 (MIT) and fix workflow configuration * refactor(security): use gitleaks CLI instead of GitHub Action - Replace gitleaks-action with direct CLI invocation - CLI is MIT licensed, no license key required - Exit code 1 = leaks found (fails CI), 0 = clean (passes) - Add Go setup step to install gitleaks v9 * fix(security): use --filter for pnpm audit to avoid workspace conflicts --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * feat(types,build-scripts): add env var resolution for integration secrets (#245) * chore: add changeset for #245 * feat(types,build-scripts): env var resolution for integration secrets (#245) (#347) * feat(types,build-scripts): add env var resolution for integration secrets (#245) * chore: add changeset for #245 --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev> * chore: consolidate dependabot dependency updates * chore: apply review fixes to dependabot batch update * chore: add changeset for dependabot dependency consolidation * fix(ci): delete lockfile before pnpm install on PRs to ensure fresh generation * fix(ci): add lockfile diagnostics to debug broken lockfile issue * fix(ci): clear stale pnpm store on PR runs to prevent broken lockfile generation * ci: add detailed lockfile diagnostics after pnpm install * ci: add comprehensive lockfile content analysis after pnpm install * fix(ci): revert pnpm/action-setup to @v4 to fix ERR_PNPM_BROKEN_LOCKFILE on audit pnpm/action-setup@v6 sets up the pnpm environment in a way that causes pnpm audit to fail with ERR_PNPM_BROKEN_LOCKFILE even on valid lockfiles. The dev branch uses @v4 which works correctly with pnpm@10.30.3. Reverting to @v4 restores parity with dev and unblocks CI. * ci: remove duplicate audit from lint-and-format, bump pnpm to 10.33.0 --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…ks (fixes #352) (#365) Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…oggle icon (#366) Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…kage

Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

Bumps [@changesets/cli](https://github.com/changesets/changesets) from 2.30.0 to 2.31.0. - [Release notes](https://github.com/changesets/changesets/releases) - [Commits](https://github.com/changesets/changesets/compare/@changesets/cli@2.30.0...@changesets/cli@2.31.0) --- updated-dependencies: - dependency-name: "@changesets/cli" dependency-version: 2.31.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

… mapping-key normalization (#381) * feat(cli): add --content flag to page add for inline YAML (#188) * feat(types,build-scripts): add plugin content schema extension and YAML normalization - Add `contentItemSchemas` and `knownContentTypeKeys` to PrebuildPlugin interface - Add `buildExtendedPageContentSchema()` to @stackwright/types for merging OSS and plugin schemas - Add `ValidatePageContentOptions` to validatePageContent() for plugin-aware validation - Add content format normalization in runPrebuild: YAML mapping-key-as-type format ({ page_header: { title } }) is auto-normalized to OSS type-field format ({ type: 'page_header', title }) before validation and processing - Plugin contentItemSchemas and knownContentTypeKeys are now collected and applied during page validation, enabling pro content types to pass schema validation --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

…hangesets/cli-2.31.0 chore(deps-dev): bump @changesets/cli from 2.30.0 to 2.31.0

# Conflicts: # .github/workflows/security.yml # docs/PLUGIN_SECURITY.md # examples/stackwright-docs/build-manifest.json # examples/stackwright-docs/cyclonedx.json # examples/stackwright-docs/spdx.json # examples/stackwright-docs/spdx.spdx # packages/build-scripts/src/prebuild.ts # packages/cli/src/utils/template-processor.ts # packages/types/src/types/validation.ts # packages/types/test/integration-security.test.ts # pnpm-lock.yaml

github-actions · 2026-04-27T16:54:37Z

🧪 Coverage Report\n\n### Overall Coverage\n\n| Metric | Coverage |\n|--------|----------|\n| Lines | ⚠️ 74.00% |\n| Statements | ⚠️ 72.83% |\n| Functions | ⚠️ 74.08% |\n| Branches | ⚠️ 63.42% |\n\n### Coverage by Package\n\n| Package | Lines | Statements | Functions | Branches |\n|---------|-------|-----------|-----------|----------|\n| @stackwright/build-scripts | 78.40% | 76.66% | 77.33% | 67.58% |\n| @stackwright/cli | 56.35% | 56.03% | 53.14% | 55.01% |\n| @stackwright/collections | 100.00% | 92.85% | 100.00% | 85.71% |\n| @stackwright/core | 79.55% | 78.21% | 77.37% | 62.09% |\n| @stackwright/icons | 100.00% | 100.00% | 100.00% | 100.00% |\n| @stackwright/mcp | 86.89% | 84.71% | 78.43% | 66.07% |\n| @stackwright/nextjs | 84.52% | 83.52% | 77.27% | 83.16% |\n| @stackwright/themes | 98.85% | 93.68% | 96.15% | 82.35% |\n| @stackwright/types | 82.63% | 81.99% | 84.21% | 64.45% |\n\n---\n📊 Full HTML report available in workflow artifacts\n

github-actions · 2026-04-27T16:54:49Z

⚡ Performance Benchmark Results

✅ Build Time Benchmarks: PASSED

❌ Bundle Size Benchmarks: FAILED

❌ Runtime Vitals Benchmarks: FAILED

📝 Note: Detailed results are available in the job logs.

🎯 Performance Budgets:

Build time: <70s total
First-load JS: <100KB gzipped
FCP: <1.5s, LCP: <2.5s, TTI: <3s

Updated: 2026-04-27T18:11:41.188Z

github-actions · 2026-04-27T16:55:39Z

✅ Visual Regression Test Results

Status: ✅ All visual tests passed!

All screenshots match the baseline. No visual regressions detected! 🎉

github-actions · 2026-04-27T17:03:45Z

♿ Accessibility Test Results

Overall Status: ✅ 0/0 tests passed

🦮 WCAG 2.1 AA Compliance

No WCAG test results available

⌨️ Keyboard Navigation

No keyboard navigation test results available

⚠️ No accessibility tests were executed. Check the workflow logs for setup issues.

📊 Detailed Report

Download the full HTML accessibility report from the workflow artifacts for:

Detailed WCAG violation descriptions
Specific element selectors and fixes
Color contrast issues
Keyboard navigation flow analysis

🔍 Testing Checklist

Our accessibility tests verify:

✅ WCAG 2.1 Level AA compliance
✅ Color contrast in light and dark modes
✅ Tab key navigation through all interactive elements
✅ Focus indicators are visible
✅ No keyboard traps
✅ Skip links and ARIA landmarks
✅ Screen reader compatibility

Powered by @axe-core/playwright and Playwright

…anch fix

github-actions · 2026-04-27T18:10:08Z

🧪 Coverage Report\n\n### Overall Coverage\n\n| Metric | Coverage |\n|--------|----------|\n| Lines | ⚠️ 74.00% |\n| Statements | ⚠️ 72.83% |\n| Functions | ⚠️ 74.08% |\n| Branches | ⚠️ 63.42% |\n\n### Coverage by Package\n\n| Package | Lines | Statements | Functions | Branches |\n|---------|-------|-----------|-----------|----------|\n| @stackwright/build-scripts | 78.40% | 76.66% | 77.33% | 67.58% |\n| @stackwright/cli | 56.35% | 56.03% | 53.14% | 55.01% |\n| @stackwright/collections | 100.00% | 92.85% | 100.00% | 85.71% |\n| @stackwright/core | 79.55% | 78.21% | 77.37% | 62.09% |\n| @stackwright/icons | 100.00% | 100.00% | 100.00% | 100.00% |\n| @stackwright/mcp | 86.89% | 84.71% | 78.43% | 66.07% |\n| @stackwright/nextjs | 84.52% | 83.52% | 77.27% | 83.16% |\n| @stackwright/themes | 98.85% | 93.68% | 96.15% | 82.35% |\n| @stackwright/types | 82.63% | 81.99% | 84.21% | 64.45% |\n\n---\n📊 Full HTML report available in workflow artifacts\n

github-actions · 2026-04-27T18:11:13Z

✅ Visual Regression Test Results

Status: ✅ All visual tests passed!

All screenshots match the baseline. No visual regressions detected! 🎉

perasperaactual and others added 28 commits April 10, 2026 11:27

fix(deploy): enable static export for R2 bucket hosting (#332)

a3436bf

Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

fix(deploy): add trailing slash support for R2 static hosting (#334)

6353011

Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

Merge branch 'main' into dev

facb5c4

fix(deploy): migrate from R2 to Cloudflare Pages (#336)

cb7679e

Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

Fix/cloudflare pages (#337)

abce1d7

* fix(deploy): migrate from R2 to Cloudflare Pages * fix(deploy): use env vars for deployment variables --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

feat(types,build-scripts): add env var resolution for integration sec…

83ce57d

…rets (#245)

chore: add changeset for #245

bbf58ef

feat(types,build-scripts): env var resolution for integration secrets (…

8fa3dcf

…#245) (#347) * feat(types,build-scripts): add env var resolution for integration secrets (#245) * chore: add changeset for #245 --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

feat(nextjs): add security headers - CSP, HSTS, COOP/CORP/COEP (#243) (…

6326d49

…#350) Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

fix(cli): remove duplicate preInstall hook call from processTemplate (#…

a410f02

…362) * fix(cli): remove duplicate preInstall hook call from processTemplate (fixes #351) * chore: add changeset for #351 fix --------- Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

fix(deps): bump hono override to >=4.12.14 to patch GHSA-458j-xx4x-4375

35c5673

fix(cli): --install flag now runs pnpm install before postInstall hoo…

90a22c6

…ks (fixes #352) (#365) Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

fix(core): prevent duplicate TopAppBar rendering — double dark-mode t…

5ad5035

…oggle icon (#366) Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

chore: adding image files to example pages

ef7684b

fix: remove broken changeset referencing non-existent stackwright pac…

13ce285

…kage

fix: remove broken changeset referencing non-existent stackwright pac…

6eba223

…kage

feat(cli): add --content flag to page add for inline YAML (#188) (#367)

f0b74ef

Co-authored-by: Stackwright Bot <bot@per-aspera.dev>

Merge pull request #377 from Per-Aspera-LLC/dependabot/npm_and_yarn/c…

5ffc0d2

…hangesets/cli-2.31.0 chore(deps-dev): bump @changesets/cli from 2.30.0 to 2.31.0

perasperaactual had a problem deploying to development April 27, 2026 16:53 — with GitHub Actions Failure

fix: basic-ftp HIGH vuln pnpm override, perf workflow playwright + br…

8925116

…anch fix

perasperaactual merged commit 46df0c5 into main Apr 27, 2026
17 of 18 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release Dev#382

Release Dev#382
perasperaactual merged 29 commits into
mainfrom
dev

perasperaactual commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

perasperaactual commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚡ Performance Benchmark Results

✅ Build Time Benchmarks: PASSED

❌ Bundle Size Benchmarks: FAILED

❌ Runtime Vitals Benchmarks: FAILED

Uh oh!

github-actions Bot commented Apr 27, 2026

✅ Visual Regression Test Results

Uh oh!

github-actions Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

♿ Accessibility Test Results

🦮 WCAG 2.1 AA Compliance

⌨️ Keyboard Navigation

📊 Detailed Report

🔍 Testing Checklist

Uh oh!

github-actions Bot commented Apr 27, 2026

Uh oh!

github-actions Bot commented Apr 27, 2026

✅ Visual Regression Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Apr 27, 2026 •

edited

Loading

github-actions Bot commented Apr 27, 2026 •

edited

Loading